kubenetes里面的RBAC使用

1. user 和 service account对应

user是外部用户, service account是pod调用k8s的api权限,可以分为单namespace的和cluster 的和cluster级别的service account.

2.创建role就是赋予权限,又apigroup,resources, verbs

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: haimaxy-role
  namespace: kube-system
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # 也可以使用['*']

3.然后就是bind

kind: RoleBinding

kind: ClusterRoleBinding

参考了Kubernetes RBAC 详解-阳明的博客|Kubernetes|Istio|Prometheus|Python|Golang|云原生