- user 和 service account对应
user是外部用户, service account是pod调用k8s的api权限,可以分为单namespace的和cluster 的和cluster级别的service account.
2.创建role就是赋予权限,又apigroup,resources, verbs
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: haimaxy-role
namespace: kube-system
rules:
- apiGroups: ["", "extensions", "apps"]
resources: ["deployments", "replicasets", "pods"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # 也可以使用['*']
3.然后就是bind
kind: RoleBinding
kind: ClusterRoleBinding
参考了Kubernetes RBAC 详解-阳明的博客|Kubernetes|Istio|Prometheus|Python|Golang|云原生