RBAC 指南
Role 与 ClusterRole
| 资源 | 作用范围 | 绑定方式 |
|---|---|---|
| Role | 单命名空间 | RoleBinding |
| ClusterRole | 集群级别或命名空间 | ClusterRoleBinding 或 RoleBinding |
| RoleBinding | 在命名空间内授予权限 | 用户/组/SA |
| ClusterRoleBinding | 集群范围授予权限 | 用户/组/SA |
Role 与 RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: production
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: alice-pod-reader
namespace: production
subjects:
- kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
name: myapp-sa
namespace: production
annotations:
# AWS IRSA
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/MyAppRole
---
# Pod 使用 ServiceAccount
spec:
serviceAccountName: myapp-sa
automountServiceAccountToken: false
# 测试权限（模拟身份）
kubectl auth can-i list pods \
--as=system:serviceaccount:production:myapp-sa
聚合 ClusterRole
# 创建自动聚合到 view 的角色
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: aggregate-to-view
labels:
rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups: ["custom.example.com"]
resources: ["myresources"]
verbs: ["get", "list", "watch"]