记录写过的K8Syaml文件之RBAC---Roles&Rolebindings&Clusterroles&ClusterRoleBinding

RBAC简单理解为权限与角色关联，用户通过成为角色的成员来得到角色的权限.
K8S的RBAC使用rbac.authorization.k8s.io/v1 API组驱动认证决策，准许管理员通过API动态配置策略。为了启用RBAC，需要在apiserver启动参数添加–authorization-mode=RBAC。

vim clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: read-secrets-global
    namespace: default
roleRef:
   name: read-cluster
   kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io
subjects:
   name: manager
   kind: Group
   apiGroup: rbac.authorization.k8s.io

vim role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
    name: pod-reader
rules:
- apiGroup: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

vim rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: read-pods
subjects:
   - name: exam
     kind: User
     apiGroup: rbac.authorization.k8s.io
roleRef:
     name: pod-reader # 这里的名称必须与你想要绑定的 Role 或 ClusterRole 名称一致
     kind: Role #这里必须是Role或者ClusterRole
     apiGroup: rbac.authorization.k8s.io

vim clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

vim serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
    name: exam
    namespace: default

-----来自河南经贸19级计算机工程学院的一名普通学生，通过博客来分享自己日常收获到的新知识，会持续坚持，感谢大家的阅读，希望可以帮到你！
PS：理解不到位之处多谢包涵！
转载的希望可以放上本文章的链接，谢谢！