如何授予所有 Kubernetes 服务帐户访问特定命名空间的权限？

Question

我在 GCP 中有一个启用了 RBAC 的 Kubernetes 集群

有一个命名空间用于Tiller和多个用于服务

现在，我可以根据全名为特定服务帐户分配 reader 角色

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  name: tiller-reader
  namespace: tiller
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - "get"
    - "watch"
    - "list"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tiller-reader-role-binding
  namespace: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tiller-reader
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: system:serviceaccount:my-namespace-1:my-namespace-1-service-account

服务命名空间和帐户是动态创建的。我如何自动将所有服务帐户访问权限授予Tiller命名空间，例如：获取pods?

Answer 1

要向所有服务帐户授予角色，您必须使用组 system:serviceaccounts。

您可以尝试以下配置：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  name: tiller-reader
  namespace: tiller
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - "get"
    - "watch"
    - "list"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tiller-reader-role-binding
  namespace: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tiller-reader
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:serviceaccounts

如何授予所有 Kubernetes 服务帐户访问特定命名空间的权限？

How to give all Kubernetes service accounts access to a specific namespace?

rbac

kubernetes

kubernetes-helm