附006.Kubernetes RBAC授权

  1 apiVersion: rbac.authorization.k8s.io/v1
  2 kind: Role
  3 metadata:
  4   namespace: default
  5   name: pod-reader
  6 rules:
  7 - apiGroups: [""] # "" indicates the core API group
  8   resources: ["pods"]
  9   verbs: ["get", "watch", "list"]

  1 apiVersion: rbac.authorization.k8s.io/v1
  2 kind: ClusterRole
  3 metadata:
  4   # "namespace" omitted since ClusterRoles are not namespaced
  5   name: secret-reader
  6 rules:
  7 - apiGroups: [""]
  8   resources: ["secrets"]
  9   verbs: ["get", "watch", "list"]

  1 apiVersion: rbac.authorization.k8s.io/v1
  2 # This role binding allows "jane" to read pods in the "default" namespace.
  3 kind: RoleBinding
  4 metadata:
  5   name: read-pods
  6   namespace: default
  7 subjects:
  8 - kind: User
  9   name: jane # Name is case sensitive
 10   apiGroup: rbac.authorization.k8s.io
 11 roleRef:
 12   kind: Role #this must be Role or ClusterRole
 13   name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
 14   apiGroup: rbac.authorization.k8s.io

  1 [root@master ~]# kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods
  2 role.rbac.authorization.k8s.io/pod-reader created

  1 [root@master ~]# kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod

  1 [root@master ~]# kubectl create role foo --verb=get,list,watch --resource=replicasets.apps

  1 [root@master ~]# kubectl create role foo --verb=get,list,watch --resource=pods,pods/status

  1 [root@master ~]# kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods

  1 [root@master ~]# kubectl create clusterrole pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod

  1 [root@master ~]# kubectl create clusterrole foo --verb=get,list,watch --resource=replicasets.apps

  1 [root@master ~]# kubectl create clusterrole foo --verb=get,list,watch --resource=pods,pods/status

  1 [root@master ~]# kubectl create clusterrole "foo" --verb=get --non-resource-url=/logs/*

  1 [root@master ~]# kubectl create rolebinding bob-admin-binding --clusterrole=admin --user=bob --namespace=acme

  1 [root@master ~]# kubectl create rolebinding myapp-view-binding --clusterrole=view --serviceaccount=acme:myapp --namespace=acme

  1 [root@master ~]# kubectl create rolebinding myappnamespace-myapp-view-binding --clusterrole=view --serviceaccount=myappnamespace:myapp --namespace=acme

  1 [root@master ~]# kubectl create rolebinding myappnamespace-myapp-view-binding --clusterrole=view --serviceaccount=myappnamespace:myapp --namespace=acme

  1 [root@master ~]# kubectl create clusterrolebinding kube-proxy-binding --clusterrole=system:node-proxier --user=system:kube-proxy

  1 [root@master ~]# kubectl create clusterrolebinding myapp-view-binding --clusterrole=view --serviceaccount=acme:myapp

  1 [root@master ~]# kubectl get role -n kube-system

  1 [root@master ~]# kubectl describe role extension-apiserver-authentication-reader -n kube-system