现状：
    目前集群使用nfs 使用了StorageClass pvc动态申请pv

    需求限制用户动态申请pv

    1. [root@UR-20210425NAMA d]# kubectl get clusterrole kubesphere-nfs-client-nfs-client-provisioner-runner
    2. NAME                                                  CREATED AT
    3. kubesphere-nfs-client-nfs-client-provisioner-runner   2021-05-20T08:52:47Z
    4. [root@UR-20210425NAMA d]# kubectl describe clusterrole kubesphere-nfs-client-nfs-client-provisioner-runner
    5. Name:         kubesphere-nfs-client-nfs-client-provisioner-runner
    6. Labels:       app=nfs-client-provisioner
    7.               app.kubernetes.io/managed-by=Helm
    8.               chart=nfs-client-provisioner-1.2.11
    9.               heritage=Helm
    10.               release=kubesphere-nfs-client
    11. Annotations:  meta.helm.sh/release-name: kubesphere-nfs-client
    12.               meta.helm.sh/release-namespace: kube-system
    13. PolicyRule:
    14.   Resources                      Non-Resource URLs  Resource Names  Verbs
    15.   ---------                      -----------------  --------------  -----
    16.   events                         []                 []              [create update patch]
    17.   persistentvolumes              []                 []              [get list watch create delete]
    18.   persistentvolumeclaims         []                 []              [get list watch update]
    19.   storageclasses.storage.k8s.io  []                 []              [get list watch]
    20. [root@UR-20210425NAMA d]#
    1. [root@UR-20210425NAMA d]# kubectl get globalrolebindings liweiming-platform-admin
    2. NAME                       AGE
    3. liweiming-platform-admin   41d
    4. [root@UR-20210425NAMA d]# kubectl describe globalrolebindings liweiming-platform-admin
    5. Name:         liweiming-platform-admin
    6. Namespace:
    7. Labels:       iam.kubesphere.io/user-ref=liweiming
    8.               kubefed.io/managed=true
    9. Annotations:  <none>
    10. API Version:  iam.kubesphere.io/v1alpha2
    11. Kind:         GlobalRoleBinding
    12. Metadata:
    13.   Creation Timestamp:  2021-06-21T02:59:30Z
    14.   Generation:          1
    15.   Managed Fields:
    16.     API Version:  iam.kubesphere.io/v1alpha2
    17.     Fields Type:  FieldsV1
    18.     fieldsV1:
    19.       f:metadata:
    20.         f:labels:
    21.           .:
    22.           f:iam.kubesphere.io/user-ref:
    23.           f:kubefed.io/managed:
    24.       f:roleRef:
    25.         .:
    26.         f:apiGroup:
    27.         f:kind:
    28.         f:name:
    29.       f:subjects:
    30.     Manager:         controller-manager
    31.     Operation:       Update
    32.     Time:            2021-06-21T02:59:30Z
    33.   Resource Version:  14058743
    34.   Self Link:         /apis/iam.kubesphere.io/v1alpha2/globalrolebindings/liweiming-platform-admin
    35.   UID:               508d1607-5861-434f-84ed-a076d78db631
    36. Role Ref:
    37.   API Group:  iam.kubesphere.io
    38.   Kind:       GlobalRole
    39.   Name:       platform-admin
    40. Subjects:
    41.   API Group:  rbac.authorization.k8s.io
    42.   Kind:       User
    43.   Name:       liweiming
    44. Events:
    45.   Type    Reason  Age                    From                          Message
    46.   ----    ------  ----                   ----                          -------
    47.   Normal  Synced  8m34s (x140 over 23h)  globalrolebinding-controller  GlobalRoleBinding synced successfully
    48. [root@UR-20210425NAMA d]#
    1. [root@UR-20210425NAMA d]# kubectl config view
    2. apiVersion: v1
    3. clusters:
    4. - cluster:
    5.     certificate-authority-data: DATA+OMITTED
    6.     server: https://192.168.13.177:6443
    7.   name: local
    8. contexts:
    9. - context:
    10.     cluster: local
    11.     namespace: default
    12.     user: liweiming
    13.   name: liweiming@local
    14. current-context: liweiming@local
    15. kind: Config
    16. preferences: {}
    17. users:
    18. - name: liweiming
    19.   user:
    20.     client-certificate-data: REDACTED
    21.     client-key-data: REDACTED
    22. [root@UR-20210425NAMA d]#
    1. [root@UR-20210425NAMA d]# kubectl get role
    2. NAME                                     CREATED AT
    3. admin                                    2021-05-20T10:29:23Z
    4. operator                                 2021-05-20T10:29:22Z
    5. role-template-manage-alerting-messages   2021-05-20T10:29:23Z
    6. role-template-manage-alerting-policies   2021-05-20T10:29:22Z
    7. role-template-manage-app-workloads       2021-05-20T10:29:23Z
    8. role-template-manage-configmaps          2021-05-20T10:29:22Z
    9. role-template-manage-custom-monitoring   2021-05-20T10:29:21Z
    10. role-template-manage-members             2021-05-20T10:29:22Z
    11. role-template-manage-project-settings    2021-05-20T10:29:23Z
    12. role-template-manage-roles               2021-05-20T10:29:20Z
    13. role-template-manage-secrets             2021-05-20T10:29:22Z
    14. role-template-manage-serviceaccount      2021-06-18T14:55:11Z
    15. role-template-manage-snapshots           2021-05-20T10:29:23Z
    16. role-template-manage-volumes             2021-05-20T10:29:23Z
    17. role-template-view-alerting-messages     2021-05-20T10:29:20Z
    18. role-template-view-alerting-policies     2021-05-20T10:29:23Z
    19. role-template-view-app-workloads         2021-05-20T10:29:21Z
    20. role-template-view-basic                 2021-05-20T10:29:23Z
    21. role-template-view-configmaps            2021-05-20T10:29:23Z
    22. role-template-view-custom-monitoring     2021-05-20T10:29:20Z
    23. role-template-view-members               2021-05-20T10:29:23Z
    24. role-template-view-roles                 2021-05-20T10:29:23Z
    25. role-template-view-secrets               2021-05-20T10:29:21Z
    26. role-template-view-serviceaccount        2021-06-18T14:55:11Z
    27. role-template-view-snapshots             2021-05-20T10:29:22Z
    28. role-template-view-volumes               2021-05-20T10:29:23Z
    29. viewer                                   2021-05-20T10:29:23Z
    30. [root@UR-20210425NAMA d]#
    1. [root@UR-20210425NAMA d]# kubectl get role admin
    2. NAME    CREATED AT
    3. admin   2021-05-20T10:29:23Z
    4. [root@UR-20210425NAMA d]# kubectl describe role admin
    5. Name:         admin
    6. Labels:       <none>
    7. Annotations:  iam.kubesphere.io/aggregation-roles:
    8.                 ["role-template-view-members","role-template-manage-members", "role-template-view-roles","role-template-manage-roles", "role-template-view...
    9.               kubesphere.io/creator: system
    10. PolicyRule:
    11.   Resources  Non-Resource URLs  Resource Names  Verbs
    12.   ---------  -----------------  --------------  -----
    13.   *.*        []                 []              [*]
    14. [root@UR-20210425NAMA d]# kubectl describe role viewer
    15. Name:         viewer
    16. Labels:       <none>
    17. Annotations:  iam.kubesphere.io/aggregation-roles:
    18.                 ["role-template-view-members","role-template-view-roles", "role-template-view-app-workloads","role-template-view-custom-monitoring", "role...
    19.               kubesphere.io/creator: system
    20. PolicyRule:
    21.   Resources  Non-Resource URLs  Resource Names  Verbs
    22.   ---------  -----------------  --------------  -----
    23.   *.*        []                 []              [get list watch]
    24. [root@UR-20210425NAMA d]#
    1. [root@UR-20210425NAMA d]# kubectl -n scp-dev  get rolebindings.rbac.authorization.k8s.io
    2. NAME                     ROLE            AGE
    3. liweiming-admin          Role/admin      18d
    4. pipeline-user-operator   Role/operator   12d
    5. wuxinghua-admin          Role/admin      9d
    6. [root@UR-20210425NAMA d]# kubectl -n scp-dev  describe rolebindings.rbac.authorization.k8s.io  liweiming-admin
    7. Name:         liweiming-admin
    8. Labels:       iam.kubesphere.io/user-ref=liweiming
    9. Annotations:  <none>
    10. Role:
    11.   Kind:  Role
    12.   Name:  admin
    13. Subjects:
    14.   Kind  Name       Namespace
    15.   ----  ----       ---------
    16.   User  liweiming
    17. [root@UR-20210425NAMA d]#