hivesec_rbac.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hivesec-central-sa
  labels:
    name: hivesec-central-sa
    role: security
  namespace: hivesec
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: hivesec-central-cr
  labels:
    name: hivesec-central-cr
    role: security
rules:
  - apiGroups: ["", "extensions", "apps", "batch"]  #支持api组的列表，" ":表示核心api群
    resources: ["namespaces", "nodes", "pods", "services", "endpoints", "daemonsets", "configmaps", "deployments", "replicationcontrollers", "replicasets", "statefulsets", "jobs", "cronjobs"]  #支持的资源对象列表
    verbs: ["get", "list", "watch"]  # 允许对资源对象操作方法列表
    【上面的意思结合起来就是，security用户对apiGroups的resources有verbs的操作权限】
  - apiGroups: [""]
    resources: ["services/proxy"]
    resourceNames: ["heapster", "http:heapster", "https:heapster"]
    verbs: ["get"]
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes", "configmaps", "nodes/stats"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: hivesec-central-crb
  labels:
    name: hivesec-central-crb
    role: security
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: hivesec-central-cr
subjects:
- kind: ServiceAccount
  name: hivesec-central-sa
  namespace: hivesec
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: hivesec
  name: hivesec-central-role
  labels:
    name: hivesec-central-role
rules:
  - apiGroups: ["", "extensions", "apps"]
    resources: ["pods", "services", "endpoints", "daemonsets", "configmaps", "deployments"]
    verbs: ["get", "list", "create", "delete", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding  #角色绑定，将同一个namespace中的subject绑定到某个Role下
metadata:
  namespace: hivesec
  name: hivesec-central-rob
  labels:
    name: hivesec-central-rob
roleRef: #指向的角色
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: hivesec-central-role
subjects: #定义用户
- kind: ServiceAccount
  name: hivesec-central-sa  
  namespace: hivesec
 【将hivesec-central-role角色绑定到ServiceAccount用户上，用户就拥有了角色的权限。】

https://zhuanlan.zhihu.com/p/121736064

ServiceAccount

kubernetes管理的账号，用于为Pod中的服务进程在访问Kubernetes时提供身份标识。

ClusterRole：在集群中的角色
Role：在命名空间中的角色

kubectl create secret docker-registry hivesec-secret --namespace=hivesec \
    --docker-server=192.168.222.140/hivesec \
    --docker-username='admin' \
    --docker-password='Harbor12345'

k8s secrets用于存储和管理一些敏感数据，比如密码，token，密钥等敏感信息。它把 Pod 想要访问的加密数据存放到 Etcd 中。然后用户就可以通过在 Pod 的容器里挂载 Volume 的方式或者环境变量的方式访问到这些 Secret 里保存的信息了。