k8s rbac
rbac基于角色的权限控制
针对namespace粒度，user-rolebinding-role或者user-group-rolebinding-role；针对cluster粒度，user-clusterrolebinding-clusterrole或者user-group-clusterrolebinding-clusterrole。
# 放通test namespace所有权限
apiVersion: v1
kind: ServiceAccount
metadata:
name: test-client
namespace: test
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: test-client
namespace: test
rules:
- apiGroups:
- "*"
resources:
- "*"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: test-client
namespace: test
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: test-client
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: test-client
namespace: testrole的apiGroups、resources、verbs可通过kubectl api-resources -owide查询得到。