K8s RBAC 超清晰教程ClusterRole、ClusterRoleBinding 实战1、四者关系一句话Role命名空间内权限ClusterRole全局集群权限RoleBinding绑定命名空间权限ClusterRoleBinding绑定全局集群权限坑点把集群权限赋给某个 ns 下的 SA不能用 RoleBinding只能用 ClusterRoleBinding2、题目场景给指定 SA 授予创建控制器权限ClusterRole 定义apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: deployment-clusterrole rules: - apiGroups: [apps] resources: [deployments,daemonsets,statefulsets] verbs: [create]绑定 SAapiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: deployment-cicd-binding subjects: - kind: ServiceAccount name: cicd-token namespace: app-team1 roleRef: kind: ClusterRole name: deployment-clusterrole apiGroup: rbac.authorization.k8s.io3、权限验证命令kubectl auth can-i create deployments --assystem:serviceaccount:app-team1:cicd-token返回 yes权限配置成功。
