【Kubernetes】开发中与 APIServer 常见的几种认证方式

packageresourcesimport (
"strings""time"corev1"k8s.io/api/core/v1")
const (
NodeRoleLabel="node-role.kubernetes.io/"KubernetesRoleLabel="kubernetes.io/role")
funcGetNodeFormattedInfo(node*corev1.Node) []string {
var (
statusstringroles=make([]string, 0)
    )
// 解析节点状态，status conditions 中最后实例中的 Type 表示最后的状态iflen(node.Status.Conditions) !=0 {
status=string(node.Status.Conditions[len(node.Status.Conditions)-1].Type)
    } else {
status="Unknown"    }
// 节点的角色标签可以从 labels 中过滤出来fork, v :=rangenode.Labels {
switch {
casestrings.HasPrefix(k, NodeRoleLabel):
ifrole :=strings.TrimPrefix(k, NodeRoleLabel); len(role) >0 {
roles=append(roles, role)
            }
casek==KubernetesRoleLabel&&v!="":
roles=append(roles, v)
        }
    }
return []string{
node.Name,
status,
strings.Join(roles, ","),
// 通过节点创建时间与现在时间差可以计算出节点存活时间time.Now().Sub(node.CreationTimestamp.Time).String(),
// version 代表的是该节点 kubelet 注册上来的版本node.Status.NodeInfo.KubeletVersion,
    }
}

packagemainimport (
"context""flag""path/filepath""strings""fmt""k8s.io/client-go/tools/clientcmd""k8s.io/client-go/kubernetes"metav1"k8s.io/apimachinery/pkg/apis/meta/v1""k8s.io/client-go/util/homedir""kubernetes-auth/pkg/resources")
funcmain() {
varkubeconfig*stringifhome :=homedir.HomeDir(); home!="" {
kubeconfig=flag.String("kubeconfig", filepath.Join(home, ".kube", "config"), "")
    } else {
kubeconfig=flag.String("kubeconfig", "", "")
    }
flag.Parse()
// 自动通过 homedir 解析 kubeconfig 路径// 此处同样可以手动指定 kubeconfig 的 pathrc, err :=clientcmd.BuildConfigFromFlags("", *kubeconfig)
iferr!=nil {
panic(err)
    }
// 获取 client-setcs, err :=kubernetes.NewForConfig(rc)
iferr!=nil {
panic(err)
    }
// 通过 clientset 获取 NodeListnodes, err :=cs.CoreV1().Nodes().List(context.Background(), metav1.ListOptions{})
iferr!=nil {
panic(err)
    }
for_, node :=rangenodes.Items {
fmt.Println(strings.Join(resources.GetNodeFormattedInfo(&node), " "))
    }
}

rc, err :=clientcmd.BuildConfigFromFlags("", *kubeconfig)
iferr!=nil {
panic(err)
}

// 获取 client-setcs, err :=kubernetes.NewForConfig(rc)
iferr!=nil {
panic(err)
}
// 通过 clientset 获取 NodeListnodes, err :=cs.CoreV1().Nodes().List(context.Background(), metav1.ListOptions{})
iferr!=nil {
panic(err)
}

certDataBase64 :="your_cert_data"keyDataBase64 :="your_key_data"certData, err :=base64.StdEncoding.DecodeString(certDataBase64)
iferr!=nil {
panic(err)
}
keyData, err :=base64.StdEncoding.DecodeString(keyDataBase64)
iferr!=nil {
panic(err)
}
rc :=&rest.Config{
Host: "https://127.0.0.1:62866",
TLSClientConfig: rest.TLSClientConfig{
Insecure: true,
// CAData: []byte(""), 如果 Insecure: true 未开启，需要 CADataCertData: certData,
KeyData:  keyData,
    },
QPS:   10,
Burst: 100,
}

tokenBase64 :="your secret token"token, err :=base64.StdEncoding.DecodeString(tokenBase64)
iferr!=nil {
panic(err)
}
rc :=&rest.Config{
Host: "https://127.0.0.1:62866",
TLSClientConfig: rest.TLSClientConfig{
Insecure: true,
// CAData: []byte(""), 如果 Insecure: true 未开启，需要 CAData    },
BearerToken: string(token),
}

url :="https://your_api_server/api/v1/nodes"r, err :=http.NewRequest(http.MethodGet, url, nil)
iferr!=nil {
panic(err)
}
tokenBase64 :="your_token_base64"token, err :=base64.StdEncoding.DecodeString(tokenBase64)
iferr!=nil {
panic(err)
}
r.Header.Set("Authorization", "Bearer "+string(token))
client :=&http.Client{
// 可选, 这里我们跳过 ca 认证Transport: &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
    },
}
resp, err :=client.Do(r)
iferr!=nil {
panic(err)
}
deferresp.Body.Close()
body, err :=ioutil.ReadAll(resp.Body)
nodes :=&corev1.NodeList{}
iferr :=json.Unmarshal(body, nodes); err!=nil {
panic(err)
}
for_, node :=rangenodes.Items {
fmt.Println(resources.GetNodeFormattedInfo(&node))
}

rc, err :=rest.InClusterConfig()
iferr!=nil {
panic(err)
}