12-kubernetes RBAC 角色访问控制

授权插件，常用Node认证,ABAC,RBAC（Role-based AC）,Webhook

• 角色(role)

• operations

• objects

• 角色绑定（rolebinding）

• user account OR service acount

• role

• 许可（permission)

• 集群角色（cluster role）

• 集群角色绑定（cluster rolebinding）

  API：Request path

格式：/apis/<GROUP>/<VERSION>/namespaces/<NAMESPACE_NAME>/<KIND>[/OBJECT_ID]

kubectl api-version
http://localhost:8080/apis/apps/v1/namespaces/default/deployments/myapp-deploy/

/apis/apps/v1
/apis/apps/b1beta1
/apis/apps/b1beta2

role创建方法

kubectl create role pods-reader -h
kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml >/tmp/role-demo.yaml

#查看
kubectl get role
kubectl describe role pods-reader

绑定帐号到对应许可权限

kubectl create rolebinding leiyan-read-pods --role=pods-reader --user=leiyan --dry-run -o yaml

kubectl describe rolebinding magedu-read-pods

Cluster role 创建方法

kubectl create clusterrole pods-reader -h
kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods --dry-run -o yaml >/tmp/clusterrole-demo.yaml

#查看
kubectl get clusterrole
kubectl describe clusterrole cluster-reader

绑定帐号到集群级许可权限

kubectl create clusterrolebinding leiyan-test --clusterrole=cluster-reader --user=leiyan --dry-run -o yaml

kubectl describe clusterrolebinding leiyan-test

• 赞0
• 
• 踩0