某空间下的令牌访问产生过程--Kubernetes Dashboard（k8s-Dashboard）

在面试中发现，有些运维人员基本的令牌访问方式都不知道，
下面介绍下令牌的产生过程

某个空间下的令牌访问产生过程(空间名称为cc)

###创建命名空间
[root@vms61 ccadmin]# kubectl create namespace cc

创建cc的用户
[root@vms61 ccadmin]#kubectl create serviceaccount ccadmin -n cc
#再次创建一个 serviceaccount ，指定名称空间为 default

创建角色
创建 rolebinding 把ccrole绑定 ccadmin
######角色名称为 cc-rolebinding
[root@vms61 ccadmin]# kubectl create rolebinding cc-rolebinding --user=ccadmin --clusterrole=admin
--serviceaccount=cc:ccadmin -n cc

#使用rolebinding绑定clusterrole用户admin到刚刚创建的serviceaccount上

[root@fp-web-157]# kubectl get secret -n cc
NAME TYPE DATA AGE
ccadmin-token-5blfz kubernetes.io/service-account-token 3 40s
ccharborsecretkey kubernetes.io/dockerconfigjson 1 3d
default-token-9cb2v kubernetes.io/service-account-token 3 6d

//查看得到令牌token
[root@fpNet-web-38 home]# kubectl describe secret ccadmin-token-5blfz -n cc
Name: ccadmin-token-5blfz
Namespace: cc
Labels: <none>
Annotations: kubernetes.io/service-account.name=ccadmin
kubernetes.io/service-account.uid=3ceefcbf-40fa-11ec-a9ed-063598000e9e

Type: kubernetes.io/service-account-token

Data
====
ca.crt: 2053 bytes
namespace: 3 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJjY3kiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiY2N5YWRtaW4tdG9rZW4tNWJsZnoiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2N5YWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIzY2VlZmNiZi00MGZhLTExZWMtYTllZC0wNjM1OTgwMDBlOWUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6Y2N5OmNjeWFkbWluIn0.UkzQwY8Z_VCJ_HXp0eFWX-XLzC_90-p72HNCryweJGb3JYDqd4BRcYjnCtu5zEPgHUAmHHtlyaQrEA0OtqqZTBPnuZFhCDLBq5z0m2cpTVCI6XA4NUCnHR-508vvgE9bs3Y95FndNooOrEpbHDY6IPwo0igXTBrUoZrP3Jlgg5VGeRpibgXhvOrQ9_d-JTQV044t_t5wxA8GpSe7A0pY3iEj8bf2_XLMRNhSAqrEpjq8s3n2CyoCviRwTHAC_vFcmiRiPg2xw9ArCc2xn4EVIDfQWCbz5nesbAcmEs8BnJ9wgNkMM-AqoZ65CXzJ6hebuZ_ZKIXpPdrd0O_67UCXNs9_LxdxcdM5kqvoXrV2NJ69TjGm-4USGvDDpyiwpi4xEiEyZEkO65fAEgIvG1N23JKOLkDxeqz2M7QOaxSK4ASdUCbrq0XBeq1P9725W96UmSYGh_2CRajiinT0rvD9gBrd_HCE76FQaAwk7LPCk8BdWwoAk5a0tDyA63hiO6CRTaTybku8NjCJti0Hkn0zMJE9rVBev58M4yEPoOwfxApcC1tICgJ75SgqLFN0yjqZtgHjerb2NbE3_YTEO1AKPOIATO6rL_PKy57lrAw4p6BnJSoqUzvhlRcwadUJKk0vTJboJhbAhjTP5FR63rhO4QR

我们可以通过service暴露出外部机器可以访问的端口，然后再nginx上进行配置为单独的域名访问，令牌登录界面如下：