docker - 如何将 RBAC 权限分配给系统：Kubernetes 中的匿名服务帐户？

Question

如何将 RBAC 权限分配给系统：Kubernetes 中的匿名服务帐户？

要了解 Kubernetes，我想为system:anonymous服务帐户分配权限以使用kubectl auth can-i --list.

我创建了以下角色和角色绑定：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole 
metadata:
  name: anonymous-review-access
rules:
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
   name: anonymous-review-access
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: anonymous-review-access
subjects:
- kind: ServiceAccount
  name: anonymous
  namespace: default

在kubectl apply -f ...上述之后，我仍然不允许匿名查看访问权限：

$ kubectl auth can-i --list --as=system:anonymous -n default
Error from server (Forbidden): selfsubjectrulesreviews.authorization.k8s.io is forbidden: User "system:anonymous" cannot create resource "selfsubjectrulesreviews" in API group "authorization.k8s.io" at the cluster scope

如何创建正确的角色和角色绑定以将权限视为system:anonymous服务帐户？

标签： dockerkubernetescloud

Answer 1

system:anonymous不是服务帐户。未被其他配置的身份验证方法拒绝的请求被视为匿名请求，并赋予用户名system:anonymous和一组system:unauthenticated

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anonymous-review-access
rules:
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
   name: anonymous-review-access
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: anonymous-review-access
subjects:
- kind: User
  name: system:anonymous
  namespace: default

---

    kubectl auth can-i --list --as=system:anonymous -n default
Resources                                       Non-Resource URLs   Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]