当前位置：网站首页>kubernetes创建一个dashboard只读权限的用户（具有exec权限）

kubernetes创建一个dashboard只读权限的用户（具有exec权限）

2022-07-20 12:23:00 【51CTO】

1.下面我们来手动创建一个对cluster级别的资源也有只读权限的用户

       
       kubectl create  sa dashboard-real-readonly  
       
       -n  kube-system
      
1.

2.创建一个叫作cluster-readonly的clusterrole

       
       cat cluster-readonly-clusterrole.yaml
       
apiVersion: rbac.authorization.k8s.io/v1
       
kind: ClusterRole
       
metadata:
       
  name: cluster-readonly
       
rules:
       
       - apiGroups:
       
       - 
       
       ""
       
  resources:
       
       - pods/exec
       
  verbs:
       
       - create
       
       - apiGroups:
       
       - 
       
       ""
       
  resources:
       
       - configmaps
       
       - endpoints
       
       - persistentvolumeclaims
       
       - persistentvolumeclaims/status
       
       - pods
       
       - replicationcontrollers
       
       - replicationcontrollers/scale
       
       - serviceaccounts
       
       - services
       
       - services/status
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - 
       
       ""
       
  resources:
       
       - bindings
       
       - events
       
       - limitranges
       
       - namespaces/status
       
       - pods/log
       
       - pods/status
       
       - replicationcontrollers/status
       
       - resourcequotas
       
       - resourcequotas/status
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - 
       
       ""
       
  resources:
       
       - pods/exec
       
  verbs:
       
       - create
       
       - apiGroups:
       
       - 
       
       ""
       
  resources:
       
       - namespaces
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - apps
       
  resources:
       
       - controllerrevisions
       
       - daemonsets
       
       - daemonsets/status
       
       - deployments
       
       - deployments/scale
       
       - deployments/status
       
       - replicasets
       
       - replicasets/scale
       
       - replicasets/status
       
       - statefulsets
       
       - statefulsets/scale
       
       - statefulsets/status
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - autoscaling
       
  resources:
       
       - horizontalpodautoscalers
       
       - horizontalpodautoscalers/status
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - batch
       
  resources:
       
       - cronjobs
       
       - cronjobs/status
       
       - jobs
       
       - jobs/status
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - extensions
       
  resources:
       
       - daemonsets
       
       - daemonsets/status
       
       - deployments
       
       - deployments/scale
       
       - deployments/status
       
       - ingresses
       
       - ingresses/status
       
       - networkpolicies
       
       - replicasets
       
       - replicasets/scale
       
       - replicasets/status
       
       - replicationcontrollers/scale
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - policy
       
  resources:
       
       - poddisruptionbudgets
       
       - poddisruptionbudgets/status
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - networking.k8s.io
       
  resources:
       
       - ingresses
       
       - ingresses/status
       
       - networkpolicies
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
       
       - apiGroups:
       
       - metrics.k8s.io
       
  resources:
       
       - pods
       
  verbs:
       
       - 
       
       get
       
       - list
       
       - watch
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
136.
137.
138.
139.
140.
141.
142.
143.
144.

3.创建一个叫作cluster-readonly的clusterrolebinding

       
       apiVersion: rbac.authorization.k8s.io/v1
       
kind: ClusterRoleBinding
       
metadata:
       
  creationTimestamp: null
       
  name: cluster-readonly
       
roleRef:
       
  apiGroup: rbac.authorization.k8s.io
       
  kind: ClusterRole
       
  name: cluster-readonly
       
subjects:
       
       - kind: ServiceAccount
       
  name: dashboard-readonly
       
  namespace: kube-system
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.