1.kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run测试创建角色。kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml将测试输出为yaml格式。
[[email protected] ~]# kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run
role.rbac.authorization.k8s.io/pods-reader created (dry run)
[[email protected] ~]# kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
creationTimestamp: null
name: pods-reader
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
2.kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml > manifests/role-demo.yaml 测试输出到文件。vim role-demo.yaml 编辑文件。cat role-demo.yaml查看文件。
[[email protected] ~]# kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml > manifests/role-demo.yaml
[[email protected] ~]# cd manifests/
[[email protected] manifests]# vim role-demo.yaml
[[email protected] manifests]# cat role-demo.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pods-reader
namespace: default
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
3.kubectl apply -f role-demo.yaml 声明资源。kubectl get role -o wide获取角色资源信息。kubectl describe role pods-reader获取角色资源详细信息。
[[email protected] manifests]# kubectl apply -f role-demo.yaml
role.rbac.authorization.k8s.io/pods-reader created
[[email protected] manifests]# kubectl get role -o wide
NAME AGE
pods-reader 14s
[[email protected] manifests]# kubectl describe role pods-reader
Name: pods-reader
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"pods-reader","namespace":"default"},"rules":[{"apiGroup...
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
pods [] [] [get list watch]
4.kubectl create rolebinding student-read-pods --role=pods-reader --user=student创建角色绑定。kubectl create rolebinding student-read-pods --role=pods-reader --user=student --dry-run -o yaml > rolebinding-demo.yaml输出到文件。kubectl describe rolebinding student-read-pods获取角色绑定详细信息。
[[email protected] manifests]# kubectl create rolebinding student-read-pods --role=pods-reader --user=student
rolebinding.rbac.authorization.k8s.io/student-read-pods created
[[email protected] manifests]# kubectl create rolebinding student-read-pods --role=pods-reader --user=student --dry-run -o yaml > rolebinding-demo.yaml
[[email protected] manifests]# kubectl describe rolebinding student-read-pods
Name: student-read-pods
Labels: <none>
Annotations: <none>
Role:
Kind: Role
Name: pods-reader
Subjects:
Kind Name Namespace
---- ---- ---------
User student
5.kubectl config use-context [email protected]变换上下文。kubectl get pods -o wide获取Pod资源信息。kubectl get pods -n kube-system获取其他空间的Pod资源信息失败（角色授权仅限于当前空间）。
[[email protected] manifests]# kubectl config use-context [email protected]
Switched to context "[email protected]".
[[email protected] manifests]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE
myapp-deploy-67f6f6b4dc-7t9ph 1/1 Running 0 2h 10.244.2.105 node2.example.com
myapp-deploy-67f6f6b4dc-qmznr 1/1 Running 0 2h 10.244.1.17 node1.example.com
myapp-deploy-67f6f6b4dc-sbmhc 1/1 Running 0 2h 10.244.2.104 node2.example.com
pod-sa-demo 1/1 Running 0 2h 10.244.1.18 node1.example.com
[[email protected] manifests]# kubectl get pods -n kube-system
No resources found.
Error from server (Forbidden): pods is forbidden: User "student" cannot list pods in the namespace "kube-system"
[[email protected] manifests]# kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: null
name: cluster-reader
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
6.kubectl config use-context [email protected]变换上下文。kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run测试创建集群角色绑定。kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run > clusterrole-demo.yaml输出到文件。
[[email protected] manifests]# kubectl config use-context [email protected]
Switched to context "[email protected]".
[[email protected] manifests]# kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: null
name: cluster-reader
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
[[email protected] manifests]# kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run > clusterrole-demo.yaml
7.vim clusterrole-demo.yaml编辑文件。cat clusterrole-demo.yaml查看文件。kubectl apply -f clusterrole-demo.yaml声明资源。kubectl delete rolebinding student-read-pods删除之前的资源。
[[email protected] manifests]# vim clusterrole-demo.yaml
[[email protected] manifests]# cat clusterrole-demo.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cluster-reader
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
[[email protected] manifests]# kubectl apply -f clusterrole-demo.yaml
clusterrole.rbac.authorization.k8s.io/cluster-reader created
[root@master manifests]# kubectl delete rolebinding student-read-pods
rolebinding.rbac.authorization.k8s.io "student-read-pods" deleted
8.useradd ik8s创建用户。cp -rp .kube/ /home/ik8s/复制认证信息。 chown -R ik8s.ik8s /home/ik8s/修改所有者。kubectl config use-context [email protected]修改上下文。kubectl config view查看配置信息。kubectl get pods获取pod资源失败（因为授权相关的rolebinding资源已经删除）。
[[email protected] ~]# useradd ik8s
[[email protected] ~]# cp -rp .kube/ /home/ik8s/
[[email protected] ~]# chown -R ik8s.ik8s /home/ik8s/
[[email protected] ~]# su - ik8s
[[email protected] ~]$ kubectl config use-context [email protected]
Switched to context "[email protected]".
[[email protected] ~]$ kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: REDACTED
server: https://172.20.0.128:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: [email protected]
- context:
cluster: kubernetes
user: student
name: [email protected]
current-context: [email protected]
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: student
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
[[email protected] ~]$ kubectl get pods
No resources found.
Error from server (Forbidden): pods is forbidden: User "student" cannot list pods in the namespace "default"
9. kubectl create clusterrolebinding student-read-all-pods --clusterrole=cluser-reader --user=student --dry-run -o yaml测试clusterrolebinding输出为yaml格式。kubectl get clusterrole获取clusterrole信息。
[[email protected] manifests]# kubectl create clusterrolebinding student-read-all-pods --clusterrole=cluser-reader --user=student --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
creationTimestamp: null
name: student-read-all-pods
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluser-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: student
[[email protected] manifests]# kubectl get clusterrole
NAME AGE
admin 4d
cluster-admin 4d
cluster-reader 10m
edit 4d
flannel 3d
system:aggregate-to-admin 4d
system:aggregate-to-edit 4d
system:aggregate-to-view 4d
system:auth-delegator 4d
system:aws-cloud-provider 4d
system:basic-user 4d
system:certificates.k8s.io:certificatesigningrequests:nodeclient 4d
system:certificates.k8s.io:certificatesigningrequests:selfnodeclient 4d
system:controller:attachdetach-controller 4d
system:controller:certificate-controller 4d
system:controller:clusterrole-aggregation-controller 4d
system:controller:cronjob-controller 4d
system:controller:daemon-set-controller 4d
system:controller:deployment-controller 4d
system:controller:disruption-controller 4d
system:controller:endpoint-controller 4d
system:controller:expand-controller 4d
system:controller:generic-garbage-collector 4d
system:controller:horizontal-pod-autoscaler 4d
system:controller:job-controller 4d
system:controller:namespace-controller 4d
system:controller:node-controller 4d
system:controller:persistent-volume-binder 4d
system:controller:pod-garbage-collector 4d
system:controller:pv-protection-controller 4d
system:controller:pvc-protection-controller 4d
system:controller:replicaset-controller 4d
system:controller:replication-controller 4d
system:controller:resourcequota-controller 4d
system:controller:route-controller 4d
system:controller:service-account-controller 4d
system:controller:service-controller 4d
system:controller:statefulset-controller 4d
system:controller:ttl-controller 4d
system:coredns 4d
system:csi-external-attacher 4d
system:csi-external-provisioner 4d
system:discovery 4d
system:heapster 4d
system:kube-aggregator 4d
system:kube-controller-manager 4d
system:kube-dns 4d
system:kube-scheduler 4d
system:kubelet-api-admin 4d
system:node 4d
system:node-bootstrapper 4d
system:node-problem-detector 4d
system:node-proxier 4d
system:persistent-volume-provisioner 4d
system:volume-scheduler 4d
view
10.kubectl create clusterrolebinding student-read-all-pods --clusterrole=cluser-reader --user=student --dry-run -o yaml > clusterrolebinding-demo.yaml输出为文件。 vim clusterrolebinding-demo.yaml编辑文件。cat clusterrolebinding-demo.yaml 查看文件。
[[email protected] manifests]# kubectl create clusterrolebinding student-read-all-pods --clusterrole=cluser-reader --user=student --dry-run -o yaml > clusterrolebinding-demo.yaml
[[email protected] manifests]# vim clusterrolebinding-demo.yaml
[[email protected] manifests]# cat clusterrolebinding-demo.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: student-read-all-pods
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: student
11.kubectl apply -f clusterrolebinding-demo.yaml 声明资源。kubectl get clusterrolebinding | grep student获取新增的clusterrolebinding资源信息。kubectl describe clusterrolebinding student-read-all-pods查看资源详细信息。
[[email protected] manifests]# kubectl apply -f clusterrolebinding-demo.yaml
clusterrolebinding.rbac.authorization.k8s.io/student-read-all-pods created
[[email protected] manifests]# kubectl get clusterrolebinding | grep student
student-read-all-pods
[[email protected] manifests]# kubectl describe clusterrolebinding student-read-all-pods
Name: student-read-all-pods
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1beta1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"student-read-all-pods","namespace":"...
Role:
Kind: ClusterRole
Name: cluser-reader
Subjects:
Kind Name Namespace
---- ---- ---------
User student
12.kubectl get pod获取pod资源。kubectl get pods -n kube-system获取其他空间资源。 kubectl delete pods myapp-deploy-67f6f6b4dc-qmznr删除资源失败（因为只授权查询）。
[[email protected] ~]$ kubectl get pods
NAME READY STATUS RESTARTS AGE
myapp-deploy-67f6f6b4dc-7t9ph 1/1 Running 0 3h
myapp-deploy-67f6f6b4dc-ftm2w 1/1 Running 0 8m
myapp-deploy-67f6f6b4dc-qmznr 1/1 Running 0 3h
pod-sa-demo 1/1 Running 0 2h
[[email protected] ~]$ kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-78fcdf6894-p2rb6 1/1 Running 4 4d
coredns-78fcdf6894-pcb99 1/1 Running 3 4d
etcd-master.example.com 1/1 Running 6 4d
kube-apiserver-master.example.com 1/1 Running 4 4d
kube-controller-manager-master.example.com 1/1 Running 6 4d
kube-flannel-ds-amd64-9lwsn 1/1 Running 3 4d
kube-flannel-ds-amd64-h96pj 1/1 Running 3 4d
kube-flannel-ds-amd64-jwhmr 1/1 Running 3 4d
kube-proxy-56hs9 1/1 Running 3 4d
kube-proxy-r4j2h 1/1 Running 6 4d
kube-proxy-t985x 1/1 Running 4 4d
kube-scheduler-master.example.com 1/1 Running 6 4d
[i[email protected] ~]$ kubectl delete pods myapp-deploy-67f6f6b4dc-qmznr
Error from server (Forbidden): pods "myapp-deploy-67f6f6b4dc-qmznr" is forbidden: User "student" cannot delete pods in the namespace "default"
13.kubectl delete -f clusterrolebinding-demo.yaml 删除资源。 kubectl create rolebinding student-read-pods --clusterrole=cluster-reader --user=student --dry-run -o yaml测试并输出为yaml格式。kubectl create rolebinding student-read-pods --clusterrole=cluster-reader --user=student --dry-run -o yaml > rolebinding-clusterrole-demo.yaml输出为文件。vim rolebinding-clusterrole-demo.yaml编辑文件（注意这里的default空间）。cat rolebinding-clusterrole-demo.yaml查看文件。
[[email protected] manifests]# kubectl delete -f clusterrolebinding-demo.yaml
clusterrolebinding.rbac.authorization.k8s.io "student-read-all-pods" deleted
[[email protected] manifests]# kubectl create rolebinding student-read-pods --clusterrole=cluster-reader --user=student --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
creationTimestamp: null
name: student-read-pods
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: student
[[email protected] manifests]# kubectl create rolebinding student-read-pods --clusterrole=cluster-reader --user=student --dry-run -o yaml > rolebinding-clusterrole-demo.yaml
[[email protected] manifests]# vim rolebinding-clusterrole-demo.yaml
[[email protected] manifests]# cat rolebinding-clusterrole-demo.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: student-read-pods
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: student
14.kubectl apply -f rolebinding-clusterrole-demo.yaml声明资源。kubectl describe rolebinding student-read-pods获取资源详细信息。
[[email protected] manifests]# kubectl apply -f rolebinding-clusterrole-demo.yaml
rolebinding.rbac.authorization.k8s.io/student-read-pods created
[[email protected] manifests]# kubectl describe rolebinding student-read-pods
Name: student-read-pods
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"annotations":{},"name":"student-read-pods","namespace":"default"},"roleR...
Role:
Kind: ClusterRole
Name: cluster-reader
Subjects:
Kind Name Namespace
---- ---- ---------
User student
15. kubectl get pods获取资源。kubectl get pods -n kube-system获取其他名称空间资源失败（因为仅授权default空间）。
[[email protected] ~]$ kubectl get pods
NAME READY STATUS RESTARTS AGE
myapp-deploy-67f6f6b4dc-7t9ph 1/1 Running 0 3h
myapp-deploy-67f6f6b4dc-ftm2w 1/1 Running 0 17m
myapp-deploy-67f6f6b4dc-qmznr 1/1 Running 0 3h
pod-sa-demo 1/1 Running 0 3h
[[email protected] ~]$ kubectl get pods -n kube-system
No resources found.
Error from server (Forbidden): pods is forbidden: User "student" cannot list pods in the namespace "kube-system"
16.kubectl get clusterrole admin -o yaml查看管理员信息。kubectl create rolebinding default-ns-admin --clusterrole=admin --user=student创建rolebinding。
[[email protected] manifests]# kubectl get clusterrole admin -o yaml
aggregationRule:
clusterRoleSelectors:
- matchLabels:
rbac.authorization.k8s.io/aggregate-to-admin: "true"
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
creationTimestamp: 2018-12-13T14:05:25Z
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: admin
resourceVersion: "348"
selfLink: /apis/rbac.authorization.k8s.io/v1/clusterroles/admin
uid: 23518343-fee0-11e8-8c03-000c290c9b7a
rules:
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- bindings
- events
- limitranges
- namespaces/status
- pods/log
- pods/status
- replicationcontrollers/status
- resourcequotas
- resourcequotas/status
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- impersonate
- apiGroups:
- apps
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- statefulsets/scale
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- ingresses
- networkpolicies
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- networking.k8s.io
resources:
- networkpolicies
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- authorization.k8s.io
resources:
- localsubjectaccessreviews
verbs:
- create
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
- roles
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
[[email protected] manifests]# kubectl create rolebinding default-ns-admin --clusterrole=admin --user=student
rolebinding.rbac.authorization.k8s.io/default-ns-admin created
17. kubectl get pods获取pod资源。 kubectl delete pods myapp-deploy-67f6f6b4dc-qmznr删除Pod资源（管理员权限）。kubectl get pods -n kube-system获取其他域名空间资源失败（管理员权限仅限当前空间）。
[[email protected] ~]$ kubectl get pods
NAME READY STATUS RESTARTS AGE
myapp-deploy-67f6f6b4dc-7t9ph 1/1 Running 0 3h
myapp-deploy-67f6f6b4dc-ftm2w 1/1 Running 0 32m
myapp-deploy-67f6f6b4dc-qmznr 1/1 Running 0 3h
pod-sa-demo 1/1 Running 0 3h
[i[email protected] ~]$ kubectl delete pods myapp-deploy-67f6f6b4dc-qmznr
pod "myapp-deploy-67f6f6b4dc-qmznr" deleted
[[email protected] ~]$ kubectl get pods -n kube-system
No resources found.
Error from server (Forbidden): pods is forbidden: User "student" cannot list pods in the namespace "kube-system"
18.kubectl get clusterrolebinding cluster-admin -o yaml信息以yaml格式输出（注意：kind: Group中的信息）。kubectl config view查看配置信息。openssl x509 -in apiserver-kubelet-client.crt -text -noout | grep -i subject（可以看到对这个组进行了认证授权）。
[[email protected] manifests]# kubectl get clusterrolebinding cluster-admin -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
creationTimestamp: 2018-12-13T14:05:25Z
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: cluster-admin
resourceVersion: "110"
selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin
uid: 237f9295-fee0-11e8-8c03-000c290c9b7a
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:masters
[[email protected] manifests]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: REDACTED
server: https://172.20.0.128:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: [email protected]
- context:
cluster: kubernetes
user: student
name: [email protected]
current-context: [email protected]
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: student
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
[[email protected] pki]# openssl x509 -in apiserver-kubelet-client.crt -text -noout | grep -i subject
Subject: O=system:masters, CN=kube-apiserver-kubelet-client
Subject Public Key Info:
19.kubectl get pods -n kube-system获取系统空间的资源信息。kubectl get pods kube-flannel-ds-amd64-jwhmr -o yaml -n kube-system | grep -i serviceaccount可以看到系统是通过serviceaccount并绑定授权去对各种资源进行使用的。
[[email protected] pki]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-78fcdf6894-p2rb6 1/1 Running 4 4d
coredns-78fcdf6894-pcb99 1/1 Running 3 4d
etcd-master.example.com 1/1 Running 6 4d
kube-apiserver-master.example.com 1/1 Running 4 4d
kube-controller-manager-master.example.com 1/1 Running 6 4d
kube-flannel-ds-amd64-9lwsn 1/1 Running 3 4d
kube-flannel-ds-amd64-h96pj 1/1 Running 3 4d
kube-flannel-ds-amd64-jwhmr 1/1 Running 3 4d
kube-proxy-56hs9 1/1 Running 3 4d
kube-proxy-r4j2h 1/1 Running 6 4d
kube-proxy-t985x 1/1 Running 4 4d
kube-scheduler-master.example.com 1/1 Running 6 4d
[[email protected] pki]# kubectl get pods kube-flannel-ds-amd64-jwhmr -o yaml -n kube-system | grep -i serviceaccount
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
serviceAccount: flannel
serviceAccountName: flannel
![深入理解Kubernetes资源限制：内存深入理解Kubernetes资源限制：内存[图]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)