k8s创建只具有更新deployments statefulsets和创建、删除scaledobjects权限用户

#!/bin/bash

# 脚本名称: k8s_create_update_scaledobjects_user.sh
# 脚本功能: k8s创建只具有更新deployments statefulsets和创建、删除scaledobjects权限用户
# 脚本编写者: chengfeng
# 脚本编写时间: 20260818

ssl_dir=/home/devops22/devops22ca

check_group_exists() {
    if getent group "devops22"; then
        echo "devops22组已存在"
        exit
    else
        groupadd -g 2060 devops22
    fi
}

check_user_exists() {
    if id "devops22"; then
        echo "devops22 用户已存在"
        exit
    else
        useradd -g 2060 -u 2060 -m devops22
        echo 'devops22:123456' | sudo chpasswd
        su - devops22 -c "ssh-keygen -t rsa -b 2048 -f /home/devops22/.ssh/id_rsa -N '' -C 'devops22@example.com' -q;cat /home/devops22/.ssh/id_rsa.pub > /home/devops22/.ssh/authorized_keys;chmod 600 /home/devops22/.ssh/authorized_keys"        
    fi
}

create_game_ssl(){
        [ ! -d $ssl_dir ] && mkdir $ssl_dir
        cd $ssl_dir
        openssl genrsa -out devops22.key 2048
        openssl req -new -key devops22.key -out devops22.csr -subj "/CN=devops22/O=devops22"
        openssl x509 -req -in devops22.csr -CA /etc/kubernetes/ssl/ca.pem -CAkey /etc/kubernetes/ssl/ca-key.pem -CAcreateserial -out devops22.crt -days 10000
        openssl x509 -noout -text -in devops22.crt
        cd /home/devops22       && chown -R devops22:devops22 devops22ca
}

create_game_k8s_info(){
        runuser -l - devops22 -c'
        kubectl config set-cluster kubernetes --server=https://127.0.0.1:6443 --certificate-authority=/etc/kubernetes/ssl/ca.pem --embed-certs=true
        kubectl config set-credentials devops22 --client-certificate='${ssl_dir}'/devops22.crt --client-key='${ssl_dir}'/devops22.key --embed-certs=true
        kubectl config set-context devops22 --cluster=kubernetes --user=devops22
        kubectl config set current-context devops22
        kubectl config current-context
        kubectl config view'
}

create_game_role(){
cat > ${ssl_dir}/devops22-role.yaml <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: devops22-default
rules:
- apiGroups: ["apps"]
  resources: ["deployments/scale","statefulsets/scale"]
  verbs: ["patch","get"]
- apiGroups: ["keda.sh"]
  resources: ["scaledobjects"]
  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments","statefulsets"]
  verbs: ["patch","get","list","update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: devops22-rolebinding
  namespace: default
subjects:
- kind: User
  name: devops22
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: devops22-default
  apiGroup: rbac.authorization.k8s.io
EOF

kubectl apply -f ${ssl_dir}/devops22-role.yaml
}

main(){
        check_group_exists
        check_user_exists
        create_game_ssl
        create_game_k8s_info
        create_game_role
}

main

sh k8s_create_update_scaledobjects_user.sh