这篇文章主要讲解了“k8s中kubeconfig怎么配置使用”,文中的讲解内容简单清晰,易于学习与理解,下面请大家跟着小编的思路慢慢深入,一起来研究和学习“k8s中kubeconfig怎么配置使用”吧!
1、概述
kubeconfig文件保存了k8s集群的集群、用户、命名空间、认证的信息。kubectl命令使用kubeconfig文件来获取集群的信息,然后和API server进行通讯。
注意:用于配置对集群的访问的文件称为kubecconfig文件。也就是说,kubeconfig文件中包含的内容是集群的配置。但是,并不是必须有个文件名字叫kubeconfig
默认情况下,kubectl命令从$HOME/.kube目录下查找一个名字叫做config的文件。可以通过KUBECONFIG环境变量或者--kubeconfig参数来指定其他的kubeconfig文件。
kubeconfig中主要由如下部分组成:
clusters (集群)
users(用户)
context(上下文)
2、kubeconfig支持多集群、多用户、多认证
在实际的使用中的如下场景:
kubelet使用证书认证(kubelet和api server进行认证)
用户使用token进行认证
管理员为不同的用户提供不同的证书
都可以使用kubeconfig来组织起集群、用户、命名空间的信息。同样,也可以使用context在集群和命名空间之间进行切换。
3、Context的定义
在kubeconfig中,context中将访问一个集群的参数进行分组。访问这个context名称就是访问这个参数组。context就是一组信息的别名,举例来说,当在高德中使用家的地址,公司的地址就是一个别名,就能迅速的定位到具体的地址信息。
每个context都有3个参数:
cluster (集群)
namespace(命名空间)
user(用户)
默认情况下,kubectl命令从current context中来获取参数,然后与集群进行通讯。
4、查看kubeconfig的配置
如果有KUBECONFIG环境变量,看到的配置是合并的配置
[root@nccztsjb-node-11 ~]# kubectl config viewapiVersion: v1clusters:- cluster: certificate-authority-data: DATA+OMITTED server: https://k8s.apiserver.io:6443 name: cluster.localcontexts:- context: cluster: cluster.local user: kubernetes-admin-cluster.local name: kubernetes-admin-cluster.local@cluster.localcurrent-context: kubernetes-admin-cluster.local@cluster.localkind: Configpreferences: {}users:- name: kubernetes-admin-cluster.local user: client-certificate-data: REDACTED client-key-data: REDACTED[root@nccztsjb-node-11 ~]#
通过kubectl config view得到的配置可能是来自一个kubeconfig文件,也可能是来自多个kubeconfig文件合并的结果。
5、kubeconfig设置
5.1、设置集群
(1)集群有CA认证,并且将证书的输入嵌入到配置文件中
kubectl config --kubeconfig=config-demo set-cluster development --server=https://1.2.3.4 --embed-certs --certificate-authority=ca.crt
指定--kubeconfig参数后,所有的配置都会写到对应的文件中。如果不指定--kubeconfig参数那么就会将配置文件写到~/.kube/config这个文件中。
--certificate-authority后面是ca证书的路径,需要确保这个证书是存在的。
查看config-demo文件的内容
[root@nccztsjb-node-11 config-exercise]# cat config-demo apiVersion: v1clusters:- cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM2VENDQWRHZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQ0FYRFRJeE1USXdNakE0TURjMU5sb1lEekl4TVRFeE1URXhNRGd3TnpVMldqQVZNUk13RVFZRApWUVFERXdwcmRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCnFaWkVNZDhORHpoek5hTE1ab2tCenlabVUzQWh7R1Z4OW15MzJxaTB3UzkzS3Jib0xMUWhSSUhCYnYzdzZCbCsKZlBYaUdSeCt4OVpKY2lta1BqdmJtQ0ZpKzEvQmsxZkFONlNBSi9ISjJoenQxcExZbW41NXVVclpqdmFCTXNUdAp5U3B4QUlOUWNNU1NJYUFyeHF1VDJ0QjYzWkMvTHloQVFWWG4xL2lYS3hLTmpidjVlS21BdlRRTlQrNlMxaFIxCkJNQXNjSFc0R1lhNXVBTFZBTmZrVlpGaG5GMmt2cVMyRzRDMXV4emZtOFpyUnREOExRUjFmTnk1VnpnVkJLQjMKT2RKQkExNnl4YXk5N2JjaEtqenpqTmxKMFBlVDBOdFZZWVRlZ3F1ZG5iRURRSEdObC91Ym5UcGtWWHpFUGRKNAo3a3FQREdWUzRXYi9DZXpVcm9IQ1hRSURBUUFCbzBJd1FEQU9CZ05WSFE4QkFmOEVCQU1DQXFRd0R3WURWUjBUCkFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVmQldoK3hIdlVSdFdKdUVuUUlYTHRDUzh3MEl3RFFZSktvWkkKaHZjTkFRRUxCUUFEZ2dFQkFHeHNvSXJOZkJYRkp1RjZwYmtvSkh4eVdCSkp0Qzlud1VabWNCMmYzT0xTZTN4LwpQQU5oYm9LcHZ6ME5ocm5IQ2VnUk1rWGlmSmhKZW9VU25sYUhJaWpjVlFDZ09sTDVnT0EyeFZkRk01MlZCTk5jCnN1Qmp2MHJoQnZXMWxaYWVEUGJuaGp3dGY5elp2WG4vMUkvZ1RKSVRiNmFVdk55b1U3WHY2c3RmN1NjaExwU3kKZmVwRjNKRFc5TXRvem9yMHhoV0U3M0FrZHE1bnE4OFlSdEcxK3UwRTJXbDJ5U20yR0dzRUkvcU1HOXlvd0NsRgozSnhOQm45MEk3V0xKd0pETGZZMXYwWXdRNDR3QUJteGN4R01qVzNmOHAvL3pxSHNaaXJGdTR3QUlUK003Mmw3CkhDbXAwbm84VXpKMUdMUFcxNzF5TWNsdlJNM3h3SENtZHd0VktBMD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= server: https://1.2.3.4 name: developmentcontexts: nullcurrent-context: ""kind: Configpreferences: {}users: null[root@nccztsjb-node-11 config-exercise]#
已经设置好了集群
(2)集群没有证书的
kubectl config --kubeconfig=config-demo set-cluster development --server=https://1.2.3.4
查看证书内容
[root@nccztsjb-node-11 config-exercise]# kubectl config --kubeconfig=config-demo set-cluster development --server=https://1.2.3.4Cluster "development" set.[root@nccztsjb-node-11 config-exercise]# cat config-demo apiVersion: v1clusters:- cluster: server: https://1.2.3.4 name: developmentcontexts: nullcurrent-context: ""kind: Configpreferences: {}users: null[root@nccztsjb-node-11 config-exercise]
(3)集群有证书,但是证书验证的
kubectl config --kubeconfig=config-demo set-cluster scratch --server=https://5.6.7.8 --insecure-skip-tls-verify
查看证书的内容
[root@nccztsjb-node-11 config-exercise]# cat config-demo apiVersion: v1clusters:- cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM2VENDQWRHZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQ0FYRFRJeE1USXdNakE0TURjMU5sb1lEekl4TVRFeE1URXhNRGd3TnpVMldqQVZNUk13RVFZRApWUVFERXdwcmRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCnFaWkVNZDhORHpoek5hTE1ab2tCenlabVUzQWh7R1Z4OW15MzJxaTB3UzkzS3Jib0xMUWhSSUhCYnYzdzZCbCsKZlBYaUdSeCt4OVpKY2lta1BqdmJtQ0ZpKzEvQmsxZkFONlNBSi9ISjJoenQxcExZbW41NXVVclpqdmFCTXNUdAp5U3B4QUlOUWNNU1NJYUFyeHF1VDJ0QjYzWkMvTHloQVFWWG4xL2lYS3hLTmpidjVlS21BdlRRTlQrNlMxaFIxCkJNQXNjSFc0R1lhNXVBTFZBTmZrVlpGaG5GMmt2cVMyRzRDMXV4emZtOFpyUnREOExRUjFmTnk1VnpnVkJLQjMKT2RKQkExNnl4YXk5N2JjaEtqenpqTmxKMFBlVDBOdFZZWVRlZ3F1ZG5iRURRSEdObC91Ym5UcGtWWHpFUGRKNAo3a3FQREdWUzRXYi9DZXpVcm9IQ1hRSURBUUFCbzBJd1FEQU9CZ05WSFE4QkFmOEVCQU1DQXFRd0R3WURWUjBUCkFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVmQldoK3hIdlVSdFdKdUVuUUlYTHRDUzh3MEl3RFFZSktvWkkKaHZjTkFRRUxCUUFEZ2dFQkFHeHNvSXJOZkJYRkp1RjZwYmtvSkh4eVdCSkp0Qzlud1VabWNCMmYzT0xTZTN4LwpQQU5oYm9LcHZ6ME5ocm5IQ2VnUk1rWGlmSmhKZW9VU25sYUhJaWpjVlFDZ09sTDVnT0EyeFZkRk01MlZCTk5jCnN1Qmp2MHJoQnZXMWxaYWVEUGJuaGp3dGY5elp2WG4vMUkvZ1RKSVRiNmFVdk55b1U3WHY2c3RmN1NjaExwU3kKZmVwRjNKRFc5TXRvem9yMHhoV0U3M0FrZHE1bnE4OFlSdEcxK3UwRTJXbDJ5U20yR0dzRUkvcU1HOXlvd0NsRgozSnhOQm45MEk3V0xKd0pETGZZMXYwWXdRNDR3QUJteGN4R01qVzNmOHAvL3pxSHNaaXJGdTR3QUlUK003Mmw3CkhDbXAwbm84VXpKMUdMUFcxNzF5TWNsdlJNM3h3SENtZHd0VktBMD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= server: https://1.2.3.4 name: development- cluster: insecure-skip-tls-verify: true server: https://5.6.7.8 name: scratchcontexts: nullcurrent-context: ""kind: Configpreferences: {}users: null[root@nccztsjb-node-11 config-exercise]#
(4)删除集群
kubectl config --kubeconfig=config-demo unset clusters.development
5.2、设置用户
(1)设置用户,使用客户端的证书和客户端密钥,并且将证书数据嵌入到配置文件中
kubectl config --kubeconfig=config-demo set-credentials developer --client-certificate=fake-cert-file --client-key=fake-key-seefile --embed-certs=true
注意:客户端证书和key必须要存在。
(2)设置用户,使用用户名和密码
kubectl config --kubeconfig=config-demo set-credentials experimenter --username=exp --password=some-password
(3)删除用户
kubectl config --kubeconfig=config-demo unset users.experimenter
experimenter这个就是使用set-credentials参数后面的名字。
5.3、增加上下文信息context
kubectl config --kubeconfig=config-demo set-context dev-frontend --cluster=development --namespace=frontend --user=developer
设置context将集群、命名空间、用户进行分组。即在dev-fronted这个context的以developer用户的信息访问developement集群的frontend命名空间。
kubectl config --kubeconfig=config-demo set-context dev-storage --cluster=development --namespace=storage --user=developer
dev-stroage这个context访问stroage命名空间。
查看通过以上的所有配置形成的kubeconfig文件
[root@nccztsjb-node-11 config-exercise]# cat config-demo apiVersion: v1clusters:- cluster: certificate-authority: fake-ca-file server: https://1.2.3.4 name: development- cluster: insecure-skip-tls-verify: true server: https://5.6.7.8 name: scratchcontexts:- context: cluster: development namespace: frontend user: developer name: dev-frontend- context: cluster: development namespace: storage user: developer name: dev-storage- context: cluster: scratch namespace: default user: experimenter name: exp-scratchcurrent-context: ""kind: Configpreferences: {}users:- name: developer user: client-certificate: fake-cert-file client-key: fake-key-seefile- name: experimenter user: password: some-password. username: exp
5.4、设置当前的context
kubectl config --kubeconfig=config-demo use-context dev-frontend
查看当前的context
kubectl config --kubeconfig=config-demo current-context
5.5、只查看和当前context有关的配置信息
kubectl config --kubeconfig=config-demo view --minify
[root@nccztsjb-node-11 config-exercise]# kubectl config --kubeconfig=config-demo view --minifyapiVersion: v1clusters:- cluster: certificate-authority: fake-ca-file server: https://1.2.3.4 name: developmentcontexts:- context: cluster: development namespace: frontend user: developer name: dev-frontendcurrent-context: dev-frontendkind: Configpreferences: {}users:- name: developer user: client-certificate: fake-cert-file client-key: fake-key-seefile
那么kubeconfig中的其他的信息就不会显示
5.6、查看配置中所有的context
[root@nccztsjb-node-11 config-exercise]# kubectl config --kubeconfig=config-demo get-contextsCURRENT NAME CLUSTER AUTHINFO NAMESPACE* dev-frontend development developer frontend dev-storage development developer storage exp-scratch scratch experimenter default
感谢各位的阅读,以上就是“k8s中kubeconfig怎么配置使用”的内容了,经过本文的学习后,相信大家对k8s中kubeconfig怎么配置使用这一问题有了更深刻的体会,具体使用情况还需要大家实践验证。这里是编程网,小编将为大家推送更多相关知识点的文章,欢迎关注!