时间戳

首页 > 解决方案 > allow access to all resources on kubernetes cluster except get nodes

kubernetes - allow access to all resources on kubernetes cluster except get nodes

问题描述

Team, I have below cluster role on kubernetes that allows access to everything but I wan't to restrict node level commands and allow all rest.

What to modify below? Basically, user should be able to run 

kubectl get all --all-namespaces

but not nodes info should NOT display

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin-test
rules: 
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
- nonResourceURLs:
- '*'
verbs:
- '*'

标签： kuberneteskubectlrbac

解决方案

规则纯粹是附加的，意味着你不能限制规则。

因此，您需要列出所有可访问的资源，但需要列出具有适当操作的“节点”

例如：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin
rules: 
- apiGroups: [""] 
  resources: ["pods","services","namespaces","deployments","jobs"] 
  verbs: ["get", "watch", "list"]

此外，强烈建议不要更改集群管理员角色。值得创建一个新角色并将用户分配给它。

推荐阅读