kubenetes里面的RBAC使用"/>
kubenetes里面的RBAC使用
- user 和 service account对应
user是外部用户, service account是pod调用k8s的api权限,可以分为单namespace的和cluster 的和cluster级别的service account.
2.创建role就是赋予权限,又apigroup,resources, verbs
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:name: haimaxy-rolenamespace: kube-system
rules:
- apiGroups: ["", "extensions", "apps"]resources: ["deployments", "replicasets", "pods"]verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # 也可以使用['*']
3.然后就是bind
kind: RoleBinding
kind: ClusterRoleBinding
参考了Kubernetes RBAC 详解-阳明的博客|Kubernetes|Istio|Prometheus|Python|Golang|云原生
更多推荐
kubenetes里面的RBAC使用
发布评论