◼ kubectl create role NAME --verb=verb --resource=resource.group/subresource [--resource-name=resourcename]
◆verb：允许在资源上使用的操作（verb）列表
◆resources.group/subresource：操作可施加的目标资源类型或子资源列表
◆resourcename：特定的资源对象列表，可选
role绑定UserAccount
~# kubectl create role pod-veiwer --verb="get,list,watch" --resource="pods" -n demo --dry-run=client -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
creationTimestamp: null
name: pod-veiwer
namespace: demo
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
~# kubectl apply -f demo-role.yaml
~# kubectl get role -n demo
NAME CREATED AT
pod-veiwer 2024-05-01T11:15:51Z
`绑定UserAccount`
~# kubectl create rolebinding stjson-pod-veiwer --role=pod-veiwer --user=stjson -n demo --dry-run=client -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
creationTimestamp: null
name: stjson-pod-veiwer
namespace: demo
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: pod-veiwer
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: stjson
~# kubectl apply -f stjsom-demo-role.yaml
-
验证
root@k8s-node01:~# kubectl config current-context
stjson@mykube
root@k8s-node01:~# kubectl get pods -n demo
NAME READY STATUS RESTARTS AGE
demodb-0 1/1 Running 1 (10h ago) 3d22h
demodb-1 1/1 Running 1 (10h ago) 3d22h
`但是没有查看service权限`
root@k8s-node01:~# kubectl get svc -n demo
Error from server (Forbidden): services is forbidden: User "stjson" cannot list resource "services" in API group "" in the namespace "demo"
及stjson用户可以访问demo这个名称空间的pod资源
-
增加权限
root@k8s-master01:~# cat demo-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
creationTimestamp: null
name: pod-veiwer
namespace: demo
rules:
- apiGroups:
- ""
resources:
- pods
- services
verbs:
- get
- list
- watch
- create
- delete
- apiGroups:
- "apps"
resources:
- deplyments
- daemonsets
verbs:
- get
- list
- watch
root@k8s-master01:~# kubectl apply -f demo-role.yaml
增加了services，pods 创建和删除权限，deplyments， daemonsets的查看权限
-
验证新增权限
root@k8s-node01:~# kubectl get svc -n demo
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
demodb ClusterIP None <none> 9907/TCP 3d22h
role绑定serviceAccount
root@k8s-master01:~# kubectl create serviceaccount kube-user -n demo --dry-run=client -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
creationTimestamp: null
name: kube-user
namespace: demo
`创建一个`
root@k8s-master01:~# kubectl create rolebinding kube-user-admin --clusterrole=admin --serviceaccount=demo:kube-user -n demo --dry-run=client -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
creationTimestamp: null
name: kube-user-admin
namespace: demo
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: admin
subjects:
- kind: ServiceAccount
name: kube-user
namespace: demo
`创建一个测试pod`
root@k8s-master01:~# cat serviceacconut-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubeclient
namespace: demo
spec:
containers:
- name: kubectl
image: bitnami/kubectl:latest
command:
- "/bin/sh"
- "-c"
- "sleep 99999"
serviceAccountName: kube-user
root@k8s-master01:~# kubectl apply -f serviceacconut-pod.yaml
root@k8s-master01:~# kubectl get pod -n demo
NAME READY STATUS RESTARTS AGE
demodb-0 1/1 Running 1 (10h ago) 3d23h
demodb-1 1/1 Running 1 (10h ago) 3d23h
kubeclient 1/1 Running 0 69s
root@k8s-master01:~# kubectl exec -it kubeclient -n demo /bin/bash
I have no name!@kubeclient:/$ kubectl get pod
NAME READY STATUS RESTARTS AGE
demodb-0 1/1 Running 1 (10h ago) 3d23h
demodb-1 1/1 Running 1 (10h ago) 3d23h
kubeclient 1/1 Running 0 106s
可以看到定义测试一个pod，里面有访问当前名称空间的权限，但是没有访问其他名称空间权限
文章评论