16.kubernetes的RBAC

[root@master ~]# kubectl create role pod-read --verb=get,list,watch --resource=pods --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: null
  name: pod-read
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
[root@master ~]# kubectl create rolebinding song-pod-read --role=pod-read --user=song --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  name: song-pod-read
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-read
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: song
[root@master ~]# kubectl create role pod-read --verb=get,list,watch --resource=pods 
role.rbac.authorization.k8s.io/pod-read created
[root@master ~]# kubectl create rolebinding song-pod-read --role=pod-read --user=song 
rolebinding.rbac.authorization.k8s.io/song-pod-read created
再次切换我们的song用户，发现他可以再default  命名空间中来查看pod了
[root@master ~]# kubectl config use-context song@kubernetes 
Switched to context "song@kubernetes".
[root@master ~]# kubectl get pods
NAME                                        READY   STATUS             RESTARTS   AGE
debian-869994669d-226qq                     1/1     Running            186        21d
filebeat-ds-msmst                           1/1     Running            0          23d
filebeat-ds-qkpd9                           1/1     Running            0          23d
haproxy-598b6697db-d7h6w                    1/1     Running            1          22d
myapp-deploy-7769f49474-c7w49               1/1     Running            0          21d
myapp-deploy-7769f49474-r6xjr               1/1     Running            0          21d
myapp-deploy-7769f49474-rwhfc               1/1     Running            0          24d
myapp-deploy-7769f49474-vgshx               1/1     Running            0          24d
myapp-deploy-7769f49474-xcf9m               1/1     Running            0          24d
mysqlxx-784fdd7b55-x9czr-69b97d59d4-slspx   1/1     Running            0          21d
pod-demo                                    2/2     Running            0          19d
pod-sa                                      1/1     Running            0          37h
redis-85b846ff9c-h7j72                      1/1     Running            0          23d
redis-state-0                               0/1     CrashLoopBackOff   3283       11d
redis-state-1                               0/1     CrashLoopBackOff   3073       10d
tomcat-test-76789745c5-42c5d                1/1     Running            0          30d
tomcat-test-76789745c5-5wzl7                1/1     Running    

  在全局还是没有权限。
  [root@master ~]# kubectl get pod --all-namespaces
  Error from server (Forbidden): pods is forbidden: User "song" cannot list resource "pods" in API group "" at the cluster scope