一、配置文件说明
### --- Role example:角色权限示例
~~~ 注:就是在default命名空间下下创建一个role,
~~~ 这个role是对pods具有get,watch和list权限
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default // default的namepspace下
name: pod-reader
rules:
- apiGroups: [""] # "" indicates the core API group
resources: ["pods"] // 管理的资源是pod
verbs: ["get", "watch", "list"] // 它的权限是get,watch,list
二、ClusterRole example:整个集群的权限示例
### --- 创建了一个secret-reader的ClusterRole,
~~~ 它的权限是对secrets具有get、watch、list的权限
~~~ 针对于所有的namespace下的权限
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
# "namespace" omitted since ClusterRoles are not namespaced
name: secret-reader // 创建了一个secret-reader的一个ClusterRole
rules:
- apiGroups: [""]
#
# at the HTTP level, the name of the resource for accessing Secret
# objects is "secrets"
resources: ["secrets"]
verbs: ["get", "watch", "list"]
三、RoleBinding examples
### --- 案例一:
~~~ 注:创建了一个pod-reader
~~~ 之前创建了一个pod-reader的一个role,它的权限是对pod的查看权限,
~~~ 然后使用RoleBinding把它到一个Jane的user用户上
apiVersion: rbac.authorization.k8s.io/v1
# This ro