kubernetes rbac授权

1、了解
role
rolebinding
clusterrole
clusterrolebinding

role rolebinding namespace级别权限
clusterrole clusterrolebinding 整个kubernetes集群级别权限
clusterrole rolebinding namespace级别权限

2、创建role rolebinding clusterrole clusterrolebinding进行测试
规划：
role :pods-reader
clusterrole :pods-reader-all
rolebinding :role-rolebinding clusterrole-rolebinding
clusterrolebinding:cluster-role-binding

kubectl create role pods-reader --verb=get,list,watch --resource=pods [-o yaml --dry-run]
kubectl create clusterrole pods-reader-all --verb=get,list,watch --resource=pods [-o yaml --dry-run]
kubectl create rolebinding role-rolebinding --role=pods-reader --user=wythe [-o yaml --dry-run]
kubectl create clusterrolebinding cluster-role-binding --clusterrole=pods-reader-all --user=wythe [-o yaml --dry-run]
kubectl create rolebinding clusterrole-rolebinding --clusterrole=pods-reader-all --user=wythe [-o yaml --dry-run]

 

 

2.1 role rolebinding
#kubectl create role
kubectl create role pods-reader --verb=get,list,watch --resource=pods

#kubectl create rolebinding
kubectl create rolebinding role-rolebinding --role=pods-reader --user=wythe

#kubectl config use-context wythe@kubernetes

#kubectl get pods 测试
[root@master rbac]# kubectl get pods
NAME READY STATUS RESTARTS AGE
myapp 1/1 Running 0 6h14m

#kubectl get pods -n kube-system
[root@master rbac]# kubectl get pods -n kube-system
Error from server (Forbidden): pods is forbidden: User "wythe" cannot list resource "pods" in API group "" in the namespace "kube-system"

2.2 clusterrole clusterrolebinding
#kubectl create clusterrole
kubectl create clusterrole pods-reader-all --verb=get,list,watch --resource=pods
#kubectl create clusterrolebinding
kubectl create clusterrolebinding cluster-role-binding --clusterrole=pods-reader-all --user=wythe
#测试
kubectl config use-context wythe@kubernetes
[root@master rbac]# kubectl get pods
NAME READY STATUS RESTARTS AGE
myapp 1/1 Running 0 6h34m
[root@master rbac]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-66bff467f8-f8bj8 1/1 Running 23 285d
coredns-66bff467f8-hnk4l 1/1 Running 37 299d
...

2.3 clusterrole rolebinding
#kubectl create clusterrole
kubectl create clusterrole pods-reader-all --verb=get,list,watch --resource=pods
#kubectl create rolebinding
kubectl create rolebinding clusterrole-rolebinding --clusterrole=pods-reader-all --user=wythe
#测试
kubectl config use-context wythe@kubernetes
[root@master rbac]# kubectl get pods
NAME READY STATUS RESTARTS AGE
myapp 1/1 Running 0 7h25m
[root@master rbac]# kubectl get pods -n kube-system
Error from server (Forbidden): pods is forbidden: User "wythe" cannot list resource "pods" in API group "" in the namespace "kube-system"

 

 

上下文切换
kubectl config use-context wythe@kubernetes
kubectl config use-context kubernetes-admin@kubernetes