Package: kubernetes-user
Kubernetes User CreatorThe goal of this project is to make it easy to create a Kubernetes user. While the k8s
documentation is quick to point out that users do not exist in Kubernetes, sometimes
you just want to generate a kubeconfig which has access to the cluster.This access can be achived by the following means:create a Service Account with a token with access to the clustercreate a RSA certificate/key pair allowing access to the clusterThe "user" is not given any permissions be default, so you still need to create/associate
the user with ClusterRoleBindings/RoleBindgins.This project is inspired by the following blog post:https://www.openlogic.com/blog/granting-user-access-your-kubernetes-clusterTODOAutomate the creation of openssl key and csrAutomate the creation of a k8s CSR resourceAutomate the approval of the CSR resourceAutomate the creation of a kubeconfigAutomate or document the creation of cluster premissionsCreate a command line tool as well as python apiAutomate the SA Token workflowAllow passing in SA and CSR resource metadata to CLIDocument wellAutomate the build95% test coverageInstallpipinstallkubernetes-userCLI Quick StartGenerate a CSR-based User# basic usagek8s_usercsrmyusername# or providing a non-default kubeconfigpython-mk8s_usercsrmyusername\--kubeconfig~/.kube/config# or without installingpython-mk8s_usercsrmyusername# or without installing and providing a non-default kubeconfigpython-mk8s_usercsrmyusername\--kubeconfig~/.kube/configGenerate a SA-based User with token# basic usagek8s_usersamyusername# or providing a non-default kubeconfigk8s_usersamyusername\--kubeconfig~/.kube/config# or without installingpython-mk8s_usersamyusername# or without installing and providing a non-default kubeconfigpython-mk8s_usersamyusername\--kubeconfig~/.kube/configAdd a clusterrollbinding for the new userkubectlcreateclusterrolebindingjoe-admin--clusterrole=admin--user=joePython API Quick StartCreate and sign the userimportkubernetesfromkubernetesimportclient,configapi_client=config.new_client_from_config()fromk8s_userimportCSRK8sUseruser=CSRK8sUser(name="joe")inputs={"cluster_name":"default","context_name":"default","out_kubeconfig":"new-kubeconfig.yaml","creds_dir":".",}user.create(api_client,inputs)Add a clusterrollbinding for the new userkubectlcreateclusterrolebindingjoe-admin--clusterrole=admin--user=joeLow-Level CSR API InteractionThis example assumes you are connected to a Kubernetes cluster with a kubeconfig in
the default location.importkubernetesfromkubernetesimportclient,configfromk8s_user.k8s.csr_resourceimportCSRResourcefromk8s_user.pkiimportCSRandKey,Certcsr_name='joe'# create a KEY and CSRcandk=CSRandKey(csr_name,additional_subject={"O":"jazstudios"})# save the csr and keycandk.csr.save("joe.csr.pem")candk.key.save("joe.key.pem")# create the k8s api client. Load the kubeconfig from the default location (~/.kube/config)api_client=config.new_client_from_config()# Define the CertificateSigningRequest Kubernetes Resourcecsr=CSRResource(name=csr_name,# the name of the CertificateSigningRequest k8s objectcsr_str=candk.csr.base64,# the base64 encoded csr stringmetadata={"labels":{"foo":"bar"}},# optional dict with fields matching k8s V1ObjectMeta object)# Check if the k8s CSR resource existscsr.resource_exists(api_client)# Create the k8s CSR resourceobj=csr.create(api_client)# Check again if the k8s CSR resource exists (it will now)csr.resource_exists(api_client)# Approve the k8s CSR resourceapproved_csr_obj=csr.approve(api_client)# Get the certificate filecrt_str=csr.get_cert(api_client)# Save the certificate to a filecandk=Cert(crt_data=base64.b64decode(crt_str))candk.save('joe.crt.pem')