Skip to main content

How to create a user in kubernetes cluster and assign read only permissions

root@ip-172-31-16-42:~# kubectl get secrets
NAME                  TYPE                                  DATA   AGE
default-token-2m258   kubernetes.io/service-account-token   3      48m
root@ip-172-31-16-42:~# kubectl create serviceaccount readonlyuser
serviceaccount/readonlyuser created
root@ip-172-31-16-42:~# kubectl create clusterrole readonlyuser --verb=get --verb=list --verb=watch --resource=pods
clusterrole.rbac.authorization.k8s.io/readonlyuser created

root@ip-172-31-16-42:~# kubectl create clusterrolebinding readonlyuser --serviceaccount=default:readonlyuser --clusterrole=readonlyuser
clusterrolebinding.rbac.authorization.k8s.io/readonlyuser created
root@ip-172-31-16-42:~# TOKEN=$(kubectl describe secrets "$(kubectl describe serviceaccount readonlyuser | grep -i Tokens | awk '{print $2}')" | grep token: | awk '{print $2}')

root@ip-172-31-16-42:~# kubectl config set-credentials vikash --token=$TOKEN
User "vikash" set.
root@ip-172-31-16-42:~# kubectl config set-context podreader --cluster=kubernetes --user=vikash
Context "podreader" created.
root@ip-172-31-16-42:~# kubectl config use-context podreader
Switched to context "podreader".

root@ip-172-31-16-42:~# kubectl auth can-i get pods --all-namespaces
yes
root@ip-172-31-16-42:~# kubectl auth can-i create pods
no

root@ip-172-31-16-42:~# kubectl get svc
Error from server (Forbidden): services is forbidden: User "system:serviceaccount:default:readonlyuser" cannot list resource "services" in API group "" in the namespace "default"
root@ip-172-31-16-42:~# kubectl auth can-i delete pods
no

root@ip-172-31-16-42:~# kubectl get nodes
Error from server (Forbidden): nodes is forbidden: User "system:serviceaccount:default:readonlyuser" cannot list resource "nodes" in API group "" at the cluster scope



Comments

  1. Madhava Krishna MeduriMay 11, 2020 at 3:56 PM

    The high liter is spoiling the article’s visibility. Why don’t you remove the highlights?

    ReplyDelete

Post a Comment

Popular posts from this blog

How to copy files from one server to another server by using ansible copy module

 We have two servers 1.master 2.worker1 create playbook example: play.yml ---   - hosts: all     tasks:     - name: Ansible copy file to remote server       copy:        src: ~/kube-cluster        dest: /root Run ansible playbook  ansible-playbook play.yml
1 comment
Read more

Kubernetes interview questions and answers

1.H ow to setup kubernetes dashboard on ubuntu16.04 cluster? To create kubernetes dashboard follow below link https://docs.aws.amazon.com/eks/latest/userguide/dashboard-tutorial.html To deploy the Metrics Server kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.3.6/components.yaml kubectl get deployment metrics-server -n kube-system Deploy the dashboard kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta8/aio/deploy/recommended.yaml root@ip-172-31-43-76:~# kubectl get svc -n kubernetes-dashboard NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)         AGE dashboard-metrics-scraper   ClusterIP   10.102.6.123   <none>        8000/TCP        120m kubernetes-dashboard  ...
3 comments
Read more

Jenkins interview questions and answers

1. In Jenkins I have a 3 jobs like env , uat , prod Case 1 If trigger a job 'env', based on condition it go-to 'uat 'job and trigger job Case2 trigger a job 'env', based on condition it go-to 'prod' job and trigger job How to write job freestyle or pipeline? A. Install build pipe line plugin Then click on plus symbol in that view name give Buildpipelinetest select .Build Pipeline View then click on ok. under select Upstream / downstream config   Select Initial Job as env Then next select similarly uat and next prod then these three will be chain linked and each one build one by one if one becomes success.
4 comments
Read more