RBAC，基于角色的访问控制(Role-Based Access Control)

RBAC有四种资源：

1.Role

nampspace级别的角色，用来定义某角色可以访问的k8s资源（apiversion,resource,）以及verbs

  1. apiVersion: rbac.authorization.k8s.io/v1
  2. kind: Role                                                                        #kind类型为role
  3. metadata:
  4.   namespace: default
  5.   name: pod-reader
  6. rules:
  7. - apiGroups: [""]         # "" indicates the core API group
  8.   resources: ["pods"]
  9.   verbs: ["get", "watch", "list"]

2.ClustrtRole

集群级别的角色

  1. apiVersion: rbac.authorization.k8s.io/v1
  2. kind: ClusterRole                                                                #kind类型为集群
  3. metadata:
  4.   # "namespace" omitted since ClusterRoles are not namespaced
  5.   name: secret-reader
  6. rules:
  7. - apiGroups: [""]
  8.   # at the HTTP level, the name of the resource for accessing Secret
  9.   # objects is "secrets"
  10.   resources: ["secrets"]
  11.   verbs: ["get", "watch", "list"]

3.RoleBinding

角色绑定,namespace级别的角色绑定，将角色赋予一个或一组用户（subjects）

  1. apiVersion: rbac.authorization.k8s.io/v1
  2. # This role binding allows "jane" to read pods in the "default" namespace.
  3. # You need to already have a Role named "pod-reader" in that namespace.
  4. kind: RoleBinding
  5. metadata:
  6.   name: read-pods
  7.   namespace: default
  8. subjects:
  9. # You can specify more than one "subject"
  10. - kind: User
  11.   name: jane # "name" is case sensitive
  12.   apiGroup: rbac.authorization.k8s.io
  13. roleRef:
  14.   # "roleRef" specifies the binding to a Role / ClusterRole
  15.   kind: Role #this must be Role or ClusterRole
  16.   name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
  17.   apiGroup: rbac.authorization.k8s.io

4.ClusterRoleBinding

集群级别的角色绑定，其中roleRef只能是ClusterRole

  1. apiVersion: rbac.authorization.k8s.io/v1
  2. # This role binding allows "dave" to read secrets in the "development" namespace.
  3. # You need to already have a ClusterRole named "secret-reader".
  4. kind: RoleBinding
  5. metadata:
  6.   name: read-secrets
  7.   #
  8.   # The namespace of the RoleBinding determines where the permissions are granted.
  9.   # This only grants permissions within the "development" namespace.
  10.   namespace: development
  11. subjects:
  12. - kind: User
  13.   name: dave # Name is case sensitive
  14.   apiGroup: rbac.authorization.k8s.io
  15. roleRef:
  16.   kind: ClusterRole
  17.   name: secret-reader
  18.   apiGroup: rbac.authorization.k8s.io