apiVersion:rbac.authorization.k8s.io/v1kind:ClusterRolemetadata:# "namespace" omitted since ClusterRoles are not namespacedname:secret-readerrules:- apiGroups: [""]resources: ["secrets"]verbs: ["get","watch","list"]
piVersion:rbac.authorization.k8s.io/v1# This role binding allows "jane" to read pods in the "default" namespace.# You need to already have a Role named "pod-reader" in that namespace.kind:RoleBindingmetadata:name:read-podsnamespace:defaultsubjects:# You can specify more than one "subject"- kind:Username:jane# "name" is case sensitiveapiGroup:rbac.authorization.k8s.ioroleRef:# "roleRef" specifies the binding to a Role / ClusterRolekind:Role#this must be Role or ClusterRolename:pod-reader# this must match the name of the Role or ClusterRole you wish to bind toapiGroup:rbac.authorization.k8s.io
ClusterRoleBinding
apiVersion:rbac.authorization.k8s.io/v1# This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.kind:ClusterRoleBindingmetadata:name:read-secrets-globalsubjects:- kind:Groupname:manager# Name is case sensitiveapiGroup:rbac.authorization.k8s.ioroleRef:kind:ClusterRolename:secret-readerapiGroup:rbac.authorization.k8s.io
权限是累加的,因此如果您有一个 clusterRole,具有“列出”和“删除”秘密的权限,您可以将其与具有“获取”权限的 Role 结合使用。因此,请务必注意并始终测试您的角色和权限,并指定允许的内容,因为默认情况下所有内容都是拒绝的。
枚举 RBAC
# Get current privilegeskubectlauthcan-i--list# use `--as=system:serviceaccount:<namespace>:<sa_name>` to impersonate a service account# List Cluster Roleskubectlgetclusterroleskubectldescribeclusterroles# List Cluster Roles Bindingskubectlgetclusterrolebindingskubectldescribeclusterrolebindings# List Roleskubectlgetroleskubectldescriberoles# List Roles Bindingskubectlgetrolebindingskubectldescriberolebindings