簡單記錄安裝配置permission-manager的過程。permission-manager 是sighupio公司開源的很新的一個用于 Kubernetes RBAC 和 用戶管理工具。項目地址：https://github.com/sighupio/permission-manager

permission-manager部署

部署依賴

#拉取項目到本地
$ git clone https://github.com/sighupio/permission-manager

#部署依賴
$ cd permission-manager/
$ vim k8s/k8s-seeds/auth-secret.yml #修改密碼 可忽略。此項目的密碼是用的stringDate設(shè)置的明文密碼。也可以用data設(shè)置base64加密的密碼
apiVersion: v1
kind: Secret
metadata:
  name: auth-password-secret
  namespace: permission-manager
type: Opaque
stringData:
  password: admin000
$ kubectl apply -f k8s/k8s-seeds/namespace.yml
$ kubectl apply -f k8s/k8s-seeds

編輯k8s/deploy.yaml以設(shè)置環(huán)境變量

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: permission-manager
  name: permission-manager-deployment
  labels:
    app: permission-manager
spec:
  replicas: 1
  selector:
    matchLabels:
      app: permission-manager
  template:
    metadata:
      labels:
        app: permission-manager
    spec:
      serviceAccountName: permission-manager-service-account
      containers:
        - name: permission-manager
          image: quay.io/sighup/permission-manager:1.5.0
          ports:
            - containerPort: 4000
          env:
            - name: PORT
              value: "4000"
            - name: CLUSTER_NAME
              value: "cluster1"
            - name: CONTROL_PLANE_ADDRESS
              value: "https://172.16.77.40:6443"
            - name: BASIC_AUTH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: auth-password-secret
                  key: password

---
apiVersion: v1
kind: Service
metadata:
  namespace: permission-manager
  name: permission-manager-service
spec:
  selector:
    app: permission-manager
  type: NodePort
  ports:
    - protocol: TCP
      port: 4000
      targetPort: 4000
      nodePort: 30180

• 除了修改對應ENV變量，此處還將service改為了NodePort方式。設(shè)置了暴露的端口為30180

部署

$ kubectl apply -f k8s/deploy.yaml

WEB UI展示

官方圖片

<center>官方演示</center>

使用

訪問：172.16.77.40:30180

• 首頁

• 創(chuàng)建用戶設(shè)置權(quán)限

• 點擊show kubeconfig for test查看kubeconfig文件

將此內(nèi)容寫入到~/.kube/config中即可

參考鏈接

官方文檔