k8s 基于角色的权限控制 RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""] # "" 标明 core API 组
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # "namespace" 被忽略，因为 ClusterRoles 不受名字空间限制
  name: secret-reader
rules:
- apiGroups: [""]
  # 在 HTTP 层面，用来访问 Secret 对象的资源的名称为 "secrets"
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

apiVersion: rbac.authorization.k8s.io/v1
# 此角色绑定允许 "jane" 读取 "default" 名字空间中的 Pods
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
# 你可以指定不止一个“subject（主体）”
- kind: User
  name: jane # "name" 是区分大小写的
  apiGroup: rbac.authorization.k8s.io
roleRef:
  # "roleRef" 指定与某 Role 或 ClusterRole 的绑定关系
  kind: Role # 此字段必须是 Role 或 ClusterRole
  name: pod-reader     # 此字段必须与你要绑定的 Role 或 ClusterRole 的名称匹配
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
# 此集群角色绑定允许 “manager” 组中的任何人访问任何名字空间中的 secrets
kind: ClusterRoleBinding
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: manager # 'name' 是区分大小写的
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: mynamespace
  name: example-sa

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: example-rolebinding
  namespace: mynamespace
subjects:
- kind: ServiceAccount
  name: example-sa
  namespace: mynamespace
roleRef:
  kind: Role
  name: example-role
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: Pod
metadata:
  namespace: mynamespace
  name: sa-token-test
spec:
  containers:
  - name: nginx
    image: nginx:1.7.9
  serviceAccountName: example-sa

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: admin
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: admin
  namespace: my-namespace
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: my-namespace
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile

package main

import (
   "context"
   "fmt"

   metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
   "k8s.io/client-go/kubernetes"
   "k8s.io/client-go/rest"
   //
   // Uncomment to load all auth plugins
   // _ "k8s.io/client-go/plugin/pkg/client/auth"
   //
   // Or uncomment to load specific auth plugins
   // _ "k8s.io/client-go/plugin/pkg/client/auth/azure"
   // _ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
   // _ "k8s.io/client-go/plugin/pkg/client/auth/oidc"
   // _ "k8s.io/client-go/plugin/pkg/client/auth/openstack"
)

func main() {
   config, err := rest.InClusterConfig()
   if err != nil {
      panic(err.Error())
   }

   clientset, err := kubernetes.NewForConfig(config)
   if err != nil {
      panic(err.Error())
   }

   fmt.Printf("all namespaces: ")
   nsList, err := clientset.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{})
   if err != nil {
      panic(err.Error())
   }
   for _, item := range nsList.Items {
      fmt.Printf("%s ", item.Name)
   }

   fmt.Println()
   fmt.Printf("all deployments in default namespace: ")
   deployments, err := clientset.AppsV1().Deployments("default").List(context.TODO(), metav1.ListOptions{})
   if err != nil {
      panic(err.Error())
   }
   for _, item := range deployments.Items {
      fmt.Printf("%s ", item.Name)
   }

   select {}
}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: rabc-test
  namespace: my-namespace
  labels:
    app: rabc-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rabc-test
  template:
    metadata:
      labels:
        app: rabc-test
    spec:
      containers:
      - name: rabc-test
        image: linkinstars.com/rabc-test:latest
      serviceAccountName: admin