Kubernetes (K8s)是我喜欢的部署平台之一。我花了一个周末的时间在CI管道上连接集群。

gcloud container clusters create cluster-1 --zone europe-west3-a

# 环境变量
SERVICE_ACCOUNT_NAME=deployer
NAMESPACE=default
TARGET_FOLDER="/tmp/kube"
KUBECFG_FILE_NAME="${TARGET_FOLDER}/k8s-${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-conf"

# 创建临时文件夹 
mkdir -p "/tmp/kube"

kubectl create sa deployer --namespace default
kubectl create clusterrolebinding deployer --clusterrole cluster-admin --serviceaccount default:deployer

SECRET_NAME=$(kubectl get sa deployer --namespace=default -o json | jq -r .secrets[].name)

# 将证书放入临时文件夹
kubectl get secret --namespace default "${SECRET_NAME}" -o json | jq \
-r '.data["ca.crt"]' | base64 --decode  > "tmp/kube/ca.crt"

# 提取并声明用户令牌
USER_TOKEN=$(kubectl get secret --namespace default "${SECRET_NAME}" -o json | jq -r '.data["token"]' | base64 --decode)

CONTEXT=$(kubectl config current-context)

CLUSTER_NAME=$(kubectl config get-contexts "${CONTEXT}" | awk '{print $3}' | tail -n 1)

ENDPOINT=$(kubectl config view \
-o jsonpath="{.clusters[?(@.name == \"${CLUSTER_NAME}\")].cluster.server}")

# 在 kube config 中设置集群
kubectl config set-cluster "${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}" \
--server="${ENDPOINT}" \
--certificate-authority="${TARGET_FOLDER}/ca.crt" \
--embed-certs=true

# 在 kube config中设置令牌凭据  
kubectl config set-credentials \
    deployer-default-${CLUSTER_NAME}" \
    --kubeconfig=/tmp/kube/kube-conf \
    --token="${USER_TOKEN}"

# 在 kube config 中设置上下文kubectl config set-context \
    "deployer-default-${CLUSTER_NAME}" \
    --kubeconfig=/tmp/kube/kube-conf \
    --cluster="${CLUSTER_NAME}" \
    --user="deployer-default-${CLUSTER_NAME}" \
    --namespace=default

# 在 kube config 中使用上下文kubectl config use-context "deployer-default-${CLUSTER_NAME}" \
    --kubeconfig=/tmp/kube/kube-conf

# kube config 配置文件示例
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: BASE64_CA_CERT
server: https://YOUR_API_IP
name: k8s
contexts:
- context:
cluster: k8s
user: k8s-deployer
name: k8s
current-context: k8s
kind: Config
preferences: {}
users:
- name: k8s-deployer
user:
token: BASE64_TOKEN

# permissions-template.yaml
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: my_account-clusterrolebinding
subjects:
- kind: ServiceAccount
name: my_account
namespace: my_namespace
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: ""

# 调整模板并为服务帐户创建权限文件
sed -e "s|my_account|deployer|g" -e "s|my_namespace|default|g" \
    permissions-template.yaml > permissions_deployer.yaml     

# 申请许可
kubectl apply -f permissions_deployer.yaml

现在我们可以简单地在任何实例上使用这个 kube config 配置文件并连接到我们的集群。您可以使用此命令测试连接

KUBECONFIG=/tmp/kube/kube-conf kubectl get pods