-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Randy Lau <randychilau@gmail.com>
- Loading branch information
Showing
174 changed files
with
21,132 additions
and
94 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file added
BIN
+137 KB
.../2023/2023-06-30-bind-kubernetes-service-account-with-clusterRole/blog-post.png
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
1,753 changes: 1,753 additions & 0 deletions
1,753
.../2023/2023-06-30-bind-kubernetes-service-account-with-clusterRole/blog-post.svg
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
99 changes: 99 additions & 0 deletions
99
...blog/2023/2023-06-30-bind-kubernetes-service-account-with-clusterRole/index.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,99 @@ | ||
--- | ||
title: "How To Bind Kubernetes Service Account with ClusterRole" | ||
subtitle: A Comprehensive Guide | ||
date: 2023-06-30 04:10:00 -0530 | ||
author: Layer5 Team | ||
thumbnail: ./blog-post.png | ||
darkthumbnail: ./blog-post.png | ||
type: Blog | ||
category: "Meshery" | ||
tags: | ||
- Meshery | ||
- Kubernetes | ||
featured: true | ||
published: true | ||
--- | ||
|
||
import { BlogWrapper } from "../../Blog.style.js"; | ||
|
||
<BlogWrapper> | ||
<p>Kubernetes provides robust RBAC (Role-Based Access Control) capabilities to manage access and authorization within a cluster. This allows you to control and restrict permissions for various resources. In this blog post, we will explore the process of binding a Kubernetes Service Account with a ClusterRole. We will also discuss how Meshery, a service mesh management tool, can be utilized to streamline the lifecycle management of Kubernetes clusters using MeshMap visual diagrams.</p> | ||
|
||
<h2>Prerequisites</h2> | ||
|
||
<p>Before we delve into the details, ensure that you have the following prerequisites in place:</p> | ||
|
||
<ol> | ||
<li>Access to a running Kubernetes cluster.</li> | ||
<li><code>kubectl</code>, the Kubernetes command-line tool, installed and configured to communicate with your cluster.</li> | ||
<li>Meshery, the cloud native manager, installed and <a href="https://docs.meshery.io/installation/quick-start">set up</a> on your local machine.</li> | ||
</ol> | ||
|
||
<h2>Binding a Kubernetes Service Account with ClusterRole:</h2> | ||
|
||
<p>To bind a Service Account with a ClusterRole, follow the steps outlined below:</p> | ||
|
||
<p><strong>Step 1: Create a Service Account</strong></p> | ||
<p>First, we need to create a Service Account that we will later bind to a ClusterRole. Use the following kubectl command to create a Service Account named <code>my-service-account</code>:</p> | ||
|
||
<pre><code>sh kubectl create serviceaccount my-service-account</code></pre> | ||
<br /> | ||
<p><strong>Step 2: Create a ClusterRole</strong></p> | ||
<p>Next, let's create a ClusterRole that defines the desired permissions. You can either create a new ClusterRole or use an existing one. For the purpose of this example, we will create a ClusterRole named <code>my-cluster-role</code> that has read-only access to Pods and Services:</p> | ||
|
||
```yaml | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
kind: ClusterRole | ||
metadata: | ||
name: my-cluster-role | ||
rules: | ||
- apiGroups: [""] | ||
resources: ["pods", "services"] | ||
verbs: ["get", "watch", "list"] | ||
``` | ||
<br /> | ||
<p>Save the above YAML definition to a file named <code>clusterrole.yaml</code>, and create the ClusterRole using the following command:</p> | ||
|
||
<pre><code>bash kubectl apply -f clusterrole.yaml</code></pre> | ||
<br /> | ||
<p><strong>Step 3: Bind the Service Account with ClusterRole</strong></p> | ||
<p>Finally, we need to bind the Service Account <code>my-service-account</code> with the ClusterRole <code>my-cluster-role</code>. This can be achieved by creating a ClusterRoleBinding. Execute the following command to create the binding:</p> | ||
|
||
<pre><code>bash kubectl create clusterrolebinding my-cluster-role-binding --clusterrole=my-cluster-role --serviceaccount=default:my-service-account</code></pre> | ||
<br /> | ||
<p>The above command creates a ClusterRoleBinding named <code>my-cluster-role-binding</code> that associates the Service Account <code>my-service-account</code> with the ClusterRole <code>my-cluster-role</code>.</p> | ||
|
||
<p><strong>Verification:</strong></p> | ||
<p>To verify the successful binding, you can use the following command to check the ClusterRoleBinding:</p> | ||
|
||
<pre><code>bash kubectl describe clusterrolebinding my-cluster-role-binding</code></pre> | ||
<br /> | ||
<p>You should see the Service Account and ClusterRole information listed under the <code>Subjects</code> and <code>RoleRef</code> sections, respectively.</p> | ||
|
||
<h2>Using Meshery and MeshMap for Kubernetes Cluster Lifecycle Management:</h2> | ||
<p>Meshery is a powerful service mesh management tool that simplifies the management and operation of service meshes, including <a href="https://layer5.io/blog/meshery/multi-cluster-kubernetes-management-with-meshery" target="_blank">Kubernetes clusters</a>. MeshMap, a visual diagram feature of Meshery, provides a graphical representation of the service mesh components and their interactions.</p> | ||
|
||
<p>To utilize Meshery and MeshMap for Kubernetes cluster lifecycle management, follow these steps:</p> | ||
|
||
<p><strong>Step 1: Install Meshery</strong></p> | ||
<p>Refer to the official Meshery <a href="https://docs.meshery.io/installation/quick-start" target="_blank">documentation</a> to install Meshery on your local machine or within your Kubernetes cluster.</p> | ||
|
||
<p><strong>Step 2: Connect to Your Kubernetes Cluster</strong></p> | ||
<p>Once Meshery is installed, connect it to your Kubernetes cluster by configuring the necessary authentication and connection details.</p> | ||
|
||
<p><strong>Step 3: Access MeshMap</strong></p> | ||
<p>After successfully connecting Meshery to your Kubernetes cluster, you can access MeshMap from the <a href = "https://playground.meshery.io/" target="_blank">Meshery</a> user interface. MeshMap visually represents the deployed service mesh, including service endpoints, traffic flows, and workload distribution.</p> | ||
<p><strong>Step 4: Visualize the Kubernetes Cluster with MeshMap</strong></p> | ||
<p>Once you have accessed Meshery and connected it to your Kubernetes cluster, follow these steps to visualize the cluster using MeshMap:</p> | ||
|
||
<ol> | ||
<li>From the Meshery user interface, navigate to the MeshMap section.</li> | ||
<li>Select your connected Kubernetes cluster from the dropdown menu.</li> | ||
<li>Click on the "Generate Map" button to generate a visual representation of the service mesh components and their interactions within the cluster.</li> | ||
<li>Explore the generated MeshMap to gain insights into your Kubernetes cluster's architecture, traffic patterns, and workload distribution.</li> | ||
</ol> | ||
|
||
<h2>Conclusion</h2> | ||
<p>In this blog post, we have learned how to bind a Kubernetes Service Account with a ClusterRole to control access and authorization within a cluster. We have also explored how Meshery and its MeshMap feature can be used for visualizing the service mesh components and their interactions within a Kubernetes cluster. By following these steps, you can effectively manage and monitor your Kubernetes cluster's lifecycle using RBAC and visualization tools.</p> | ||
|
||
</BlogWrapper> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
--- | ||
name: Aabid Sofi | ||
position: Contributor | ||
image_path: ./aabid-sofi.webp | ||
github: aabidsofi19 | ||
twitter: codingaabid | ||
linkedin: aabid-sofi | ||
location: Srinagar, Jammu & Kashmir, India | ||
bio: Hi, I'm Aabid Sofi, a software engineer and web developer. | ||
I specialize in creating custom software and web applications that are both functional and visually appealing, with a focus on design, security, and performance. Highly passionate about cloud native and open source . | ||
badges: | ||
status: Active | ||
published: true | ||
--- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.