mirror of
https://github.com/jpetazzo/container.training.git
synced 2026-07-28 01:01:12 +00:00
0dfff26410
This is a rather convoluted example, showing step by step how to build a system where each user gets a ServiceAcccount and token with limited access, and can use this token to submit a CSR that will give them a short-lived certificate. Even if this is not a 100% realistic scenario, the general idea (using a "long-term" password or token to obtain a "short-term" token) is used by many other systems, so it makes sense to get acquainted with the various moving parts.
34 lines
730 B
YAML
34 lines
730 B
YAML
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: jean.doe
|
|
namespace: users
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: users:jean.doe
|
|
rules:
|
|
- apiGroups: [ certificates.k8s.io ]
|
|
resources: [ certificatesigningrequests ]
|
|
verbs: [ create ]
|
|
- apiGroups: [ certificates.k8s.io ]
|
|
resourceNames: [ users:jean.doe ]
|
|
resources: [ certificatesigningrequests ]
|
|
verbs: [ get, create, delete, watch ]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: users:jean.doe
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: users:jean.doe
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: jean.doe
|
|
namespace: users
|
|
|