forked from ReyazShaik/devopsscripts
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsetup-dev-user-rbac.sh
More file actions
79 lines (68 loc) · 2.03 KB
/
setup-dev-user-rbac.sh
File metadata and controls
79 lines (68 loc) · 2.03 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
#!/bin/bash
# ✅ Variables
USER_NAME="dev-user"
NAMESPACE="dev"
GROUP_NAME="dev-group"
CSR_NAME="${USER_NAME}"
CLUSTER_NAME=$(kubectl config current-context)
# ✅ Step 1: Generate Key and CSR
openssl genrsa -out ${USER_NAME}.key 2048
openssl req -new -key ${USER_NAME}.key -out ${USER_NAME}.csr -subj "/CN=${USER_NAME}/O=${GROUP_NAME}"
# ✅ Step 2: Encode CSR
CSR_BASE64=$(cat ${USER_NAME}.csr | base64 | tr -d '\n')
# ✅ Step 3: Create Kubernetes CSR
cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: ${CSR_NAME}
spec:
request: ${CSR_BASE64}
signerName: kubernetes.io/kube-apiserver-client
usages:
- client auth
EOF
# ✅ Step 4: Approve CSR
kubectl certificate approve ${CSR_NAME}
# ✅ Step 5: Retrieve signed certificate
kubectl get csr ${CSR_NAME} -o jsonpath='{.status.certificate}' | base64 --decode > ${USER_NAME}.crt
# ✅ Step 6: Set user credentials in kubeconfig
kubectl config set-credentials ${USER_NAME} \
--client-certificate=${USER_NAME}.crt \
--client-key=${USER_NAME}.key
# ✅ Step 7: Create namespace (if not exists)
kubectl get namespace ${NAMESPACE} >/dev/null 2>&1 || kubectl create namespace ${NAMESPACE}
# ✅ Step 8: Set context for the new user
kubectl config set-context ${USER_NAME}-context \
--cluster=${CLUSTER_NAME} \
--namespace=${NAMESPACE} \
--user=${USER_NAME}
# ✅ Step 9: Create Role and RoleBinding
cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: ${NAMESPACE}
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ${USER_NAME}-binding
namespace: ${NAMESPACE}
subjects:
- kind: User
name: ${USER_NAME}
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
EOF
# ✅ Step 10: Test access (optional)
echo -e "\n🔍 Try testing access using:"
echo "kubectl --context=${USER_NAME}-context get pods"