时间戳

首页 > 解决方案 > Authorization: Bearer 与 kubectl --token 不同吗？

kubernetes - Authorization: Bearer 与 kubectl --token 不同吗？

问题描述

使用--tokenflag 会导致查询成功，但使用 curl 会导致 401。

kubectl --token=eyJhbGciOiJSUzI1NiIsInR... get ns
NAME              STATUS   AGE
default           Active   3m47s
kube-node-lease   Active   3m48s
kube-public       Active   3m48s
kube-system       Active   3m48s

curl -XGET -H "Authorization: Bearer $TOKEN" -k https://192.168.64.13:8443/apis
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Unauthorized",
  "code": 401
}%

这两个选项有什么区别？我的理解是它们是相同的。

我的令牌是 keycloak 提供的 JWT。

编辑：下面每个回复的更多信息......

以高详细度运行会产生 curl 请求。

 k --v=9 --token=$TOKEN get po
I0204 09:10:08.439084   26734 loader.go:375] Config loaded from file:  /Users/me/.kube/config
I0204 09:10:08.445696   26734 round_trippers.go:423] curl -k -v -XGET  -H "Accept: application/json;as=Table;v=v1beta1;g=meta.k8s.io, application/json" -H "User-Agent: kubectl/v1.17.1 (darwin/amd64) kubernetes/d224476" -H "Authorization: Bearer eyJhbGciOiJSUzI1...." 'https://192.168.64.13:8443/api/v1/namespaces/default/pods?limit=500'
I0204 09:10:08.464046   26734 round_trippers.go:443] GET https://192.168.64.13:8443/api/v1/namespaces/default/pods?limit=500 200 OK in 18 milliseconds
I0204 09:10:08.464070   26734 round_trippers.go:449] Response Headers:
I0204 09:10:08.464074   26734 round_trippers.go:452]     Date: Tue, 04 Feb 2020 17:10:08 GMT
I0204 09:10:08.464078   26734 round_trippers.go:452]     Cache-Control: no-cache, private
I0204 09:10:08.464082   26734 round_trippers.go:452]     Content-Type: application/json
I0204 09:10:08.464086   26734 round_trippers.go:452]     Content-Length: 2931
I0204 09:10:08.464127   26734 request.go:1017] Response Body: {"kind":"Table",..... VALID RESPONSE.

但是粘贴相同的 curl 返回 401

curl -k -v -XGET  -H "Accept: application/json;as=Table;v=v1beta1;g=meta.k8s.io, application/json" -H "User-Agent: kubectl/v1.17.1 (darwin/amd64) kubernetes/d224476" -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cC..." 'https://192.168.64.13:8443/api/v1/namespaces/default/pods?limit=500'

{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
* Connection #0 to host 192.168.64.13 left intact
* Closing connection 0

如何通过 curl 执行相同的查询并获得结果？

标签： kuberneteskubectl

解决方案

是的，它们与 kubectl 相同，内部将对 API 服务器端点执行 curl。您可以通过运行设置详细程度的 kubectl 命令查看发送到 Kubernetes API 服务器的 curl 请求，然后将其与您正在使用的 curl 命令进行比较.

kubectl --v=9 --token=eyJhbGciOiJSUzI1NiIsInR... get ns | grep curl

推荐阅读