如何配置 kubectl 充当服务帐户？

Question

我希望运行 Drone CI/CD pipeline on a Raspberry Pi, including a stage to update a Kubernetes Deployment. Unfortunately, all the pre-built solutions that I've found for doing so (e.g. 1, e.g. ) 不是为 arm64 架构构建的，所以我认为我需要构建自己的架构。

我正在尝试调整来自 here (see also README.md 的命令，其中描述了所需的授权），但我尝试联系集群仍然失败，并出现授权问题：

$ cat service-account-definition.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: drone-demo-service-account
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: drone-demo-service-account-clusterrolebinding
subjects:
  - kind: ServiceAccount
    name: drone-demo-service-account
    namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

$ kubectl apply -f service-account-definition.yaml
serviceaccount/drone-demo-service-account created
clusterrolebinding.rbac.authorization.k8s.io/drone-demo-service-account-clusterrolebinding created

$ kubectl get serviceaccount drone-demo-service-account
NAME                         SECRETS   AGE
drone-demo-service-account   1         10s

$ kubectl get secret $(kubectl get secrets | grep 'drone-demo-service-account-token' | cut -f1 -d' ') -o jsonpath='{.data.ca\.crt}' > secrets/cert

$ head -c 10 secrets/cert
LS0tLS1CRU%

$ kubectl get secret $(kubectl get secrets | grep 'drone-demo-service-account-token' | cut -f1 -d' ') -o jsonpath='{.data.token}' | base64 > secrets/token

$ head -c 10 secrets/token
WlhsS2FHSk%

$ cat Dockerfile
FROM busybox

COPY . .
CMD ["./script.sh"]

$ cat script.sh
#!/bin/sh

server=$(cat secrets/server) # Pre-filled
cert=$(cat secrets/cert)
# Added this `tr` call, which is not present in the source I'm working from, after noticing that
# the file-content contains newlines
token=$(cat secrets/token | tr -d '\n')

echo "DEBUG: server is $server, cert is $(echo $cert | head -c 10)..., token is $(echo $token | head -c 10)..."

# Cannot depend on the binami/kubectl image (https://hub.docker.com/r/bitnami/kubectl), because
# it's not available for arm64 - https://github.com/bitnami/charts/issues/7305
wget https://storage.googleapis.com/kubernetes-release/release/v1.19.2/bin/linux/arm64/kubectl
chmod +x kubectl
./kubectl config set-credentials default --token=$token
echo $cert | base64 -d > ca.crt
./kubectl config set-cluster default --server=$server --certificate-authority=ca.crt
./kubectl config set-context default --cluster=default --user=default
./kubectl config use-context default
echo "Done with setup, now cat-ing .kube/config"
echo
cat $HOME/.kube/config
echo "Attempting to get pods"
echo
./kubectl get pods

$ docker build -t stack-overflow-testing . && docker run stack-overflow-testing
Sending build context to Docker daemon  10.75kB
Step 1/3 : FROM busybox
 ---> 3c277069c6ae
Step 2/3 : COPY . .
 ---> 74c6a132d255
Step 3/3 : CMD ["./script.sh"]
 ---> Running in dc55f33f74bb
Removing intermediate container dc55f33f74bb
 ---> dc68a5d6ba9b
Successfully built dc68a5d6ba9b
Successfully tagged stack-overflow-testing:latest
DEBUG: server is https://rassigma.avril:6443, cert is LS0tLS1CRU..., token is WlhsS2FHSk...
Connecting to storage.googleapis.com (142.250.188.16:443)
wget: note: TLS certificate validation not implemented
saving to 'kubectl'
kubectl               18% |*****                           | 7118k  0:00:04 ETA
kubectl               43% |*************                   | 16.5M  0:00:02 ETA
kubectl               68% |**********************          | 26.2M  0:00:01 ETA
kubectl               94% |******************************  | 35.8M  0:00:00 ETA
kubectl              100% |********************************| 38.0M  0:00:00 ETA
'kubectl' saved
User "default" set.
Cluster "default" set.
Context "default" created.
Switched to context "default".
Done with setup, now cat-ing .kube/config

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /ca.crt
    server: https://rassigma.avril:6443
  name: default
contexts:
- context:
    cluster: default
    user: default
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
  user:
    token: WlhsS2FHSkhZM[...REDACTED]
Attempting to get pods

error: You must be logged in to the server (Unauthorized)

如果我将 ~/.kube/config 从笔记本电脑复制到 docker 容器，kubectl 命令会按预期成功 - 因此，这不是网络问题，只是授权问题.我确实注意到我的基于笔记本电脑的 ~/.kube/config 列出了 client-certificate-data 和 client-key-data 而不是 users: user: 下的 token，但我怀疑这是因为我的基本配置正在记录一个非服务帐户。

如何设置 kubectl 授权为服务帐户？

我读过的一些书没有回答我的问题：

kubenetes documentation on AuthN/AuthZ
Google Kubernetes Engine article on service accounts
Configure Service Accounts for Pods（这描述了如何创建和关联帐户，但没有描述如何充当帐户）
两篇博文 (1, 2) 涉及服务帐户

Answer 1

您似乎使用了 | base64 而不是 | base64 --decode

如何配置 kubectl 充当服务帐户？

How to configure kubectl to act as a service account?

kubernetes