ehlxr/docker_practice
1
0
Fork 0
mirror of https://github.com/yeasy/docker_practice.git synced 2026-08-10 16:37:34 +00:00
Code Issues Projects Releases Wiki Activity

docs: harden Docker practice security examples

Browse Source
This commit is contained in:
yeasy
2026-05-20 15:58:46 -07:00
parent 1b651e5f8c
commit d47afa7e75
4 changed files with 20 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
14_kubernetes_setup/14.7_dashboard.md
+10 -4
View File
@@ -29,14 +29,20 @@ $ kubectl -n kubernetes-dashboard port-forward svc/kubernetes-dashboard-kong-pro
### 14.7.3 登录
创建管理员服务账户并获取登录令牌：
为历史 Dashboard 创建只读服务账户并获取短期登录令牌。不要为 Dashboard 创建 `cluster-admin` 绑定；如果确实需要临时管理员权限，应走单独的 break-glass 审批和审计流程。
```bash
$ kubectl create sa dashboard-admin -n kubernetes-dashboard
$ kubectl create sa dashboard-readonly -n kubernetes-dashboard
$ kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin
$ kubectl create clusterrole dashboard-readonly \
--verb=get,list,watch \
--resource=pods,deployments,services,configmaps,namespaces,nodes
$ kubectl create token dashboard-admin -n kubernetes-dashboard
$ kubectl create clusterrolebinding dashboard-readonly \
--clusterrole=dashboard-readonly \
--serviceaccount=kubernetes-dashboard:dashboard-readonly
$ kubectl create token dashboard-readonly -n kubernetes-dashboard --duration=1h
```
将输出的令牌粘贴到登录页面，即可登录。