62 lines
1.7 KiB
Python
62 lines
1.7 KiB
Python
import paramiko
|
|
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect('140.44.4.41', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
|
|
|
|
def run(cmd):
|
|
print(f"\n>>> {cmd}")
|
|
_, o, e = c.exec_command(cmd)
|
|
out = o.read().decode().strip()
|
|
err = e.read().decode().strip()
|
|
if out:
|
|
print(out)
|
|
if err:
|
|
print("[stderr]", err)
|
|
return out
|
|
|
|
rbac = """apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: homepage-reader
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["nodes", "namespaces", "pods", "services", "endpoints"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["metrics.k8s.io"]
|
|
resources: ["nodes", "pods"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
|
resources: ["customresourcedefinitions"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: ["traefik.containo.us", "traefik.io"]
|
|
resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares", "traefikservices"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: homepage-reader-binding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: homepage-reader
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: default
|
|
namespace: infrastructure
|
|
"""
|
|
|
|
stdin, stdout, stderr = c.exec_command('cat > /tmp/homepage_rbac.yaml')
|
|
stdin.write(rbac)
|
|
stdin.close()
|
|
stdout.read()
|
|
|
|
run("kubectl apply -f /tmp/homepage_rbac.yaml")
|
|
run("kubectl auth can-i list ingresses.networking.k8s.io --as=system:serviceaccount:infrastructure:default")
|
|
|
|
c.close()
|