无需gcloud SDK：GCP K8s集群创建VSTS部署认证用户方法

Hey there! Since you're looking to set up VSTS automation without relying on the gcloud SDK, the right approach is to create a Kubernetes ServiceAccount (the standard way for automated workloads) and generate a standalone kubeconfig file for it. Here's a step-by-step breakdown tailored to your needs:

Step 1: Create a Dedicated ServiceAccount for VSTS #

First, make a ServiceAccount specifically for your VSTS deployment tasks. We'll use the kube-system namespace here, but you can pick any namespace that makes sense for your workflow:

kubectl create serviceaccount vsts-deployer -n kube-system

Step 2: Bind Necessary Permissions #

Next, grant the ServiceAccount the permissions it needs to deploy resources. Follow the principle of least privilege—only give access to what VSTS actually requires:

• Full cluster access (use only if you need it for cross-namespace deployments):

  kubectl create clusterrolebinding vsts-deployer-binding \
    --clusterrole=cluster-admin \
    --serviceaccount=kube-system:vsts-deployer
  

• Namespace-specific access (e.g., for a production namespace):

  kubectl create rolebinding vsts-deployer-namespace-binding \
    --role=admin \
    --serviceaccount=kube-system:vsts-deployer \
    --namespace=production
  

Step 3: Retrieve the ServiceAccount Token #

Kubernetes automatically creates a secret to store the ServiceAccount's authentication token. Fetch it with these commands:

# Get the secret name linked to your ServiceAccount
SECRET_NAME=$(kubectl get serviceaccount vsts-deployer -n kube-system -o jsonpath='{.secrets[0].name}')

# Decode the token from the secret
TOKEN=$(kubectl get secret $SECRET_NAME -n kube-system -o jsonpath='{.data.token}' | base64 --decode)

Step 4: Build the Standalone kubeconfig File #

Now create a kubeconfig file that VSTS can use directly. First, grab your cluster's core details:

# Get your cluster's API server endpoint
CLUSTER_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')

# Get the cluster's CA certificate (encoded)
CLUSTER_CA=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')

Create a file (e.g., vsts-kubeconfig.yaml) with this content, replacing the placeholders with the values you just fetched:

apiVersion: v1
kind: Config
clusters:
- name: gcp-k8s-cluster
  cluster:
    certificate-authority-data: ${CLUSTER_CA}
    server: ${CLUSTER_SERVER}
users:
- name: vsts-deployer
  user:
    token: ${TOKEN}
contexts:
- name: vsts-deployer-context
  context:
    cluster: gcp-k8s-cluster
    user: vsts-deployer
current-context: vsts-deployer-context

Step 5: Verify the kubeconfig #

Test that the config works by pointing kubectl to it:

kubectl --kubeconfig=./vsts-kubeconfig.yaml get pods -n kube-system

Quick Notes #

• Security: Keep this kubeconfig file safe—it contains a sensitive token with cluster access. In VSTS, store it as a secure variable rather than plain text.
• Token Expiry: By default, these tokens don't expire. If you need short-lived credentials, you'd need to use Kubernetes' TokenRequest API, but that's a more advanced setup.
• GCP Console Limitation: There's no way to generate a standalone kubeconfig for a Kubernetes user directly via the GCP Console. You still need to use kubectl to create the ServiceAccount and token, which is exactly what we covered here.

内容的提问来源于stack exchange，提问作者dczychon