kubernetes - 授予 Kubernetes 服务帐户 Secrets 权限？

Question

我有一个服务帐户，我想授予它在特定命名空间内读/写/更新/删除 Secret 的权限。我不清楚服务帐户、角色、绑定(bind)等究竟如何协同工作来授予正确的权限。

我需要执行哪些 kubectl 调用或 YAML 才能向服务帐户授予这些权限？

这是我迄今为止拥有的服务帐户的 YAML:

apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2018-10-09T17:45:20Z
  name: testaccount
  namespace: test
  resourceVersion: "369702913"
  selfLink: /api/v1/namespaces/test/serviceaccounts/testaccount
  uid: f742ed5c-c1b3-11e8-8a69-0ade4132ab56
secrets:
- name: testaccount-token-brjxq

Answer 1

您需要创建角色和角色绑定(bind)。

创建角色:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 namespace: test
 name: role-test-account
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

创建角色绑定(bind):

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: role-test-account-binding
 namespace: test
subjects:
- kind: ServiceAccount
  name: test-account
  namespace: test
roleRef:
 kind: Role
 name: role-test-account
 apiGroup: rbac.authorization.k8s.io

您可以阅读有关 using RBAC Authorization 的更多信息