关于OpenShift API认证、全命名空间只读Token及服务账号创建的咨询

Hey there! Since you're building a script to log project resources every 15 minutes, let's walk through your questions clearly and practically:

1. How to authenticate with the OpenShift API? #

OpenShift API supports a few straightforward authentication methods, ideal for scripting:

• Use a user token from the oc CLI:
  Log into your cluster with oc login, then run oc whoami -t to grab your user-specific token. You can include this in API requests via the Authorization header:

  curl -H "Authorization: Bearer $(oc whoami -t)" https://<your-openshift-api-url>/api/v1/namespaces
  

• Use a ServiceAccount token (recommended for automation):
  For long-running scripts, it’s better to use a dedicated ServiceAccount identity instead of tying to a user’s credentials. We’ll cover creating this in question 3—once set up, you can use its token the same way as above.
• Leverage your kubeconfig file:
  Your ~/.kube/config file stores all auth details. You can call oc or kubectl directly in your script with this config, or programmatically extract the token from it if you need to make raw API calls.

2. Is there a token with read-only access to all namespaces? #

There’s no default out-of-the-box token for this, but it’s easy to create one. OpenShift has a built-in cluster-view ClusterRole that grants read-only access to nearly all resources across every namespace. By binding this role to a ServiceAccount, you’ll get a token with exactly that cluster-wide read-only permission.

3. How to create a ServiceAccount with access to all namespaces? #

Follow these steps to set up a ServiceAccount with either read-only (perfect for your logging script) or full cluster access (use sparingly!):

Option 1: Read-only cluster access (recommended) #

1. Create a ServiceAccount (pick any namespace, e.g., default):

   oc create sa resource-logger -n default
   

2. Bind the cluster-view ClusterRole to this ServiceAccount via a ClusterRoleBinding:

   oc create clusterrolebinding resource-logger-view \
     --clusterrole=cluster-view \
     --serviceaccount=default:resource-logger
   

3. Retrieve the ServiceAccount’s token:
   First, get the secret linked to the ServiceAccount:

   SECRET_NAME=$(oc get sa resource-logger -n default -o jsonpath='{.secrets[0].name}')
   

   Then decode and extract the token:

   oc get secret $SECRET_NAME -n default -o jsonpath='{.data.token}' | base64 -d
   

Option 2: Full cluster access (use with extreme caution) #

If you absolutely need unrestricted access (not advised for logging scripts—stick to least privilege), swap the cluster-view role with cluster-admin:

oc create clusterrolebinding resource-logger-admin \
  --clusterrole=cluster-admin \
  --serviceaccount=default:resource-logger

Quick notes: #

• ServiceAccount tokens are long-lived by default, lasting until their associated secret is deleted.
• Always follow the principle of least privilege: give your script only the access it needs (read-only is more than enough for resource logging).

内容的提问来源于stack exchange，提问作者vatsal