marceloalmeida/k8s-api-calls

k8s-api-calls

该镜像旨在容器内通过ServiceAccount模拟Kubernetes API调用，便于测试和验证集群中的API访问权限与RBAC配置。

镜像概述

k8s-api-calls镜像提供了一种在容器环境中模拟Kubernetes API调用的方式，依赖K8s的ServiceAccount机制实现权限验证，适用于开发和测试场景。

核心功能

• 通过ServiceAccount模拟Kubernetes API调用
• 支持测试RBAC权限配置的有效性
• 验证ServiceAccount对K8s资源的访问范围

使用场景

• 开发人员测试K8s集群中ServiceAccount的权限配置
• 验证RBAC规则是否正确限制资源访问
• 模拟容器内对K8s API的正常调用流程

配置说明

创建命名空间

sh
kubectl create namespace k8s-api-calls

ServiceAccount配置

yml
# service_account.yml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "k8s-api-calls"
  namespace: "k8s-api-calls"
  labels:
    app: "k8s-api-calls"

执行命令：

sh
kubectl apply -n k8s-api-calls -f service_account.yml

Role配置

yml
# role.yml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: "k8s-api-calls-role"
  namespace: "k8s-api-calls"
  labels:
    app: "k8s-api-calls"
rules:
  - apiGroups: [""]
    resources:
      - pods
    verbs:
      - list
      - get

执行命令：

sh
kubectl apply -n k8s-api-calls -f role.yml

Role Binding配置

yml
# role_binding.yml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: "k8s-api-calls-rolebinding"
  namespace: "k8s-api-calls"
  labels:
    app: "k8s-api-calls"
subjects:
  - kind: ServiceAccount
    name: "k8s-api-calls"
    namespace: "k8s-api-calls"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: "k8s-api-calls-role"

执行命令：

sh
kubectl apply -n k8s-api-calls -f role_binding.yml

DaemonSet部署

yml
# daemonset.yml
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8s-api-calls
  namespace: k8s-api-calls
  labels:
    app: k8s-api-calls
spec:
  selector:
    matchLabels:
      app: k8s-api-calls
  template:
    metadata:
      labels:
        app: k8s-api-calls
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      containers:
      - name: k8s-api-calls
        image: marceloalmeida/k8s-api-calls:latest
        imagePullPolicy: Always
        tty: true
        livenessProbe:
          exec:
            command:
            - echo
            - alive
          failureThreshold: 3
          initialDelaySeconds: 60
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 500m
            memory: 200Mi
      serviceAccount: k8s-api-calls
      serviceAccountName: k8s-api-calls
      terminationGracePeriodSeconds: 30

执行命令：

sh
kubectl apply -n k8s-api-calls -f daemonset.yml