玩转K8S RBAC授权

3-14 DEVOPS,Golang Eric Winn 6 views

玩转K8S RBAC授权

3-14 6 views

定义角色

拥有查询pods、deployments的权限

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: itnotebooks
  name: fireye
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
  
- apiGroups: ["extensions", "apps"]
  resources: ["deployments"]
  verbs: ["get", "watch", "list"]

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

namespace: itnotebooks

rules:

- apiGroups: [""]

resources: ["pods"]

verbs: ["get", "list", "watch"]

- apiGroups: ["extensions", "apps"]

resources: ["deployments"]

verbs: ["get", "watch", "list"]

为itnotebooks命名空间创建用户fireye

apiVersion: v1
kind: ServiceAccount
metadata:
  name: fireye
  namespace: itnotebooks

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: itnotebooks

为fireye用户绑定角色

指定用户fireye及所属的命名空间

授权逻辑参照：https://v1-18.docs.kubernetes.io/zh/docs/reference/access-authn-authz/rbac/

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: fireye
  namespace: itnotebooks

subjects:
- kind: User
  name: fireye
  apiGroup: rbac.authorization.k8s.io

- kind: ServiceAccount
  name: fireye
  namespace: itnotebooks

roleRef:
  kind: Role
  name: fireye
  apiGroup: rbac.authorization.k8s.io