Exercise 6.3: Working with ServiceAccounts

1. default 네임스페이스에 있는 Secret 확인

   kubectl get secret

2. https://itnext.io/big-change-in-k8s-1-24-about-serviceaccounts-and-their-secrets-4b909a4af4e0

3. 모든 네임스페이스에 있는 Secret 확인

   kubectl get secret -A

4. ServiceAccount 생성

   cat <<EOF | kubectl create -f -
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: secret-access
   EOF

5. ServiceAccount 생성 확인

   kubectl get sa secret-access

6. ClusterRole 확인

   kubectl get clusterroles

7. admin 과 cluster-admin 를 비교

   diff <(kubectl get clusterroles admin -o yaml) <(kubectl get clusterroles cluster-admin -o yaml) -y

8. ClusterRole 생성

   cat <<EOF | kubectl create -f -
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
    name: secret-access
   rules:
   - apiGroups:
     - ""
     resources:
     - secrets
     verbs:
     - get
     - list
   EOF

9. ClusterRole 생성 확인

   kubectl get clusterrole secret-access

10. RoleBinding 생성

    cat <<EOF | kubectl create -f -
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
     name: secret-access
    subjects:
    - kind: ServiceAccount
      name: secret-access
    roleRef:
     kind: ClusterRole
     name: secret-access
     apiGroup: rbac.authorization.k8s.io
    EOF

11. RoleBinding 생성 확인

    kubectl get rolebindings secret-access

12. Pod 생성

    cat <<EOF | kubectl create -f -
    apiVersion: v1
    kind: Pod
    metadata:
      name: kubectl
    spec:
      containers:
      - name: kubectl
        image: bitnami/kubectl
        command: [ "sleep" ]
        args: [ "infinity" ]
    EOF

13. default 네임스페이스에 있는 Secret 확인

    kubectl exec -it kubectl -- kubectl get secrets

14. Pod에 부여된 ServiceAccount 확인

    kubectl get pod kubectl -o yaml

15. Pod 삭제

    kubectl delete pod kubectl

16. Pod 생성

    cat <<EOF | kubectl create -f -
    apiVersion: v1
    kind: Pod
    metadata:
      name: kubectl
    spec:
      serviceAccountName: secret-access
      containers:
      - name: kubectl
        image: bitnami/kubectl
        command: [ "sleep" ]
        args: [ "infinity" ]
    EOF

17. Pod에 부여된 ServiceAccount 확인

    kubectl get pod kubectl -o yaml | grep -i serviceaccount

18. default 네임스페이스에 있는 Secret 확인

    kubectl exec -it kubectl -- kubectl get secrets

19. Pod에 부여된 토큰 확인

    kubectl exec -it kubectl -- cat /var/run/secrets/kubernetes.io/serviceaccount/token

20. https://jwt.io 에서 토큰 내용 확인

21. 리소스 삭제

    {
        kubectl delete pod kubectl 
        kubectl delete rolebindings secret-access
        kubectl delete clusterrole secret-access
        kubectl delete sa secret-access
    }