K8s细粒度权限控制RBAC

$ cat namespace-readonly.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  name: namespace-readonly

rules:

- apiGroups:

  - ""

  resources:

  - namespaces

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - metrics.k8s.io

  resources:

  - pods

  verbs:

  - get

  - list

  - watch

$ cat resource-readonly.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  name: resource-readonly

rules:

- apiGroups:

  - ""

  resources:

  - configmaps

  - endpoints

  - persistentvolumeclaims

  - pods

  - replicationcontrollers

  - replicationcontrollers/scale

  - serviceaccounts

  - services

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - ""

  resources:

  - bindings

  - events

  - limitranges

  - namespaces/status

  - pods/log

  - pods/status

  - replicationcontrollers/status

  - resourcequotas

  - resourcequotas/status

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - ""

  resources:

  - namespaces

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - apps

  resources:

  - controllerrevisions

  - daemonsets

  - deployments

  - deployments/scale

  - replicasets

  - replicasets/scale

  - statefulsets

  - statefulsets/scale

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - autoscaling

  resources:

  - horizontalpodautoscalers

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - batch

  resources:

  - cronjobs

  - jobs

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - extensions

  resources:

  - daemonsets

  - deployments

  - deployments/scale

  - ingresses

  - networkpolicies

  - replicasets

  - replicasets/scale

  - replicationcontrollers/scale

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - policy

  resources:

  - poddisruptionbudgets

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - networking.k8s.io

  resources:

  - networkpolicies

  verbs:

  - get

  - list

  - watch

- apiGroups:

  - metrics.k8s.io

  resources:

  - pods

  verbs:

  - get

  - list

  - watch

$ cat pod-log.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  name: pod-log

rules:

- apiGroups:

  - ""

  resources:

  - pods

  - pods/log

  verbs:

  - get

  - list

  - watch

$ cat pod-delete.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  name: pod-delete

rules:

- apiGroups:

  - ""

  resources:

  - pods

  verbs:

  - get

  - list

  - delete

$ cat pod-exec.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

  name: pod-exec

rules:

- apiGroups:

  - ""

  resources:

  - pods

  verbs:

  - get

  - list

- apiGroups:

  - ""

  resources:

  - pods/exec

  verbs:

  - create

[root@k8s-master01 rbac]# kubectl apply -f .

$ kubectl create ns kube-users

$ kubectl create sa test -n kube-users   

$ kubectl create sa dev -n kube-users    

$ kubectl create sa ops -n kube-users    

$ kubectl create token test -n kube-users

$ kubectl create token dev -n kube-users

$ kubectl create token ops -n kube-users

$ cat clusterrolebinding-namespace-readonly.yaml 

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: clusterrolebinding-namespace-readonly 

subjects:

- kind: Group

  name: system:serviceaccounts:kube-users

  apiGroup: rbac.authorization.k8s.io

roleRef:

  kind: ClusterRole

  name: namespace-readonly

  apiGroup: rbac.authorization.k8s.io

$ kubectl apply -f clusterrolebinding-namespace-readonly.yaml

$ kubectl create rolebinding ops-pod-log --clusterrole=pod-log --serviceaccount=kube-users:ops --namespace=projectA

$ kubectl create rolebinding ops-pod-log --clusterrole=pod-log --serviceaccount=kube-users:ops --namespace=projectB

$ kubectl create rolebinding ops-resource-readonly --clusterrole=resource-readonly --serviceaccount=kube-users:ops --namespace=projectA

$ kubectl create rolebinding ops-resource-readonly --clusterrole=resource-readonly --serviceaccount=kube-users:ops --namespace=projectB

$ kubectl create rolebinding ops-pod-exec --clusterrole=pod-exec --serviceaccount=kube-users:ops --namespace=projectA

$ kubectl create rolebinding ops-pod-exec --clusterrole=pod-exec --serviceaccount=kube-users:ops --namespace=projectB

$ kubectl create rolebinding ops-pod-delete --clusterrole=pod-delete --serviceaccount=kube-users:ops --namespace=projectA

$ kubectl create rolebinding ops-pod-delete --clusterrole=pod-delete --serviceaccount=kube-users:ops --namespace=projectB