kuberentes-rbac

clusterrolebindings rbac.authorization.k8s.io
clusterroles        rbac.authorization.k8s.io
rolebindings        rbac.authorization.k8s.io
roles               rbac.authorization.k8s.io

#生成key
openssl genrsa -out devproject.key 1024
#生成签名请求
openssl req -new -key devproject.key -out devproject.csr -subj ‘/CN=devproject/O=kubeusers‘
#使用kubernetes CA对签名请求进行发证
openssl x509 -req -in devproject.csr -out devproject.crt -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -days 3650

# 设置kubeconfig集群配置信息
kubectl config set-cluster kubernetes --kubeconfig=./devproject.kubeconfig --server="https://192.168.240.142:6443" --embed-certs=true --certificate-authority=/etc/kubernetes/pki/ca.crt
# 设置用户认证所需要的key/cert
kubectl config set-credentials devproject --kubeconfig=./devproject.kubeconfig --user devproject --embed-certs=true --client-certificate ./devproject.crt --client-key ./devproject.key
# 设置context (关联用户与集群)
kubectl config set-context devproject@kubernetes --cluster=‘kubernetes‘ --user=‘devproject‘ --kubeconfig=./devproject.kubeconfig
# 设置devproject@kubernetes为当前context
kubectl config set current-context devproject@kubernetes --kubeconfig=./devproject.kubeconfig

kubectl get pods --kubeconfig=./devproject.kubeconfig

Error from server (Forbidden): pods is forbidden: User "devproject" cannot list resource "pods" in API group "" in the namespace "default"

apiVersion: rbac.authorization.k8s.io/v1
kind: Role

metadata:
  name: getpodRole
  namespace: default
rules:
- apiGroups: 
  - ""
  resources:
  - "pods"
  verbs:
  - "get"
  - "list"
  - "watch"

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding

metadata:
  name: devproject-getPodRoleBinding
  namespace: default
roleRef:
  kind: Role
  name: getpodRole
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: User
  name: devproject
  apiGroup: rbac.authorization.k8s.io

kubectl get pod --kubeconfig=./devproject.kubeconfig