k8s创建只读权限用户

#!/bin/bash

# 脚本名称: create_k8s_ro_user.sh
# 脚本功能: 创建k8s只读用户
# 脚本编写者: chengfeng
# 脚本编写时间: 20260606

ssl_dir=/home/game/gameca

check_group_exists() {
    if getent group "game" &>/dev/null; then
        return 0
    else
        groupadd -g 2050 game
    fi
}

check_user_exists() {
    if id "game" &>/dev/null; then
        return 0
    else
        useradd -g 2050 -u 2050 game
    fi
}

create_game_ssl(){
	[ ! -d $ssl_dir ] && mkdir $ssl_dir
	cd $ssl_dir
	openssl genrsa -out game.key 2048
	openssl req -new -key game.key -out game.csr -subj "/CN=game/O=game"
	openssl x509 -req -in game.csr -CA /etc/kubernetes/ssl/ca.pem -CAkey /etc/kubernetes/ssl/ca-key.pem -CAcreateserial -out game.crt -days 10000
	openssl x509 -noout -text -in game.crt
	cd /home/game	&& chown -R game.game gameca
}

create_game_k8s_info(){
	runuser -l - game -c'
	kubectl config set-cluster kubernetes --server=https://127.0.0.1:6443 --certificate-authority=/etc/kubernetes/ssl/ca.pem --embed-certs=true
	kubectl config set-credentials game --client-certificate='${ssl_dir}'/game.crt --client-key='${ssl_dir}'/game.key --embed-certs=true
	kubectl config set-context game --cluster=kubernetes --user=game
	kubectl config set current-context game
	kubectl config current-context
	kubectl config view'
}

create_game_role(){
cat > ${ssl_dir}/game-role.yaml <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: game-defualt
rules:
- apiGroups: ["*"]
  resources: ["pods","pods/log"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: game-rolebinding
  namespace: default
subjects:
- kind: User
  name: game
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: game-defualt
  apiGroup: rbac.authorization.k8s.io
EOF

kubectl apply -f ${ssl_dir}/game-role.yaml
}

main(){
	check_group_exists
	check_user_exists
	create_game_ssl
	create_game_k8s_info
	create_game_role
}

main