Kubernetes RBAC 实例讲解

Kubernetes 1.6 以上可以使用。

经常在配置Kubernetes时会卡在权限问题上面，在这里，我们通过一个实例来说明如何配置 RBAC。这里没有专业的术语，只有指指点点，应该更容易理解。

为了把问题说明白，这里使用注释的方式进行说明

类型为ServiceAccount

---
apiVersion: v1
kind: ServiceAccount
# 类型为ServiceAccount, 基本样式，不需要修改。
metadata:
  name: fluentd-daemon
  # （I）
  # 定义ServiceAccount的名子。这个会在后面我们创建pod的时候调用。
  namespace: kube-system
  # （II）
  # 设置命令空间为kube-system。
  labels:
    component: fluentd-daemon
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: fluentd-daemon
labels:
component: fluentd-daemon
kubernetes.io/cluster-service: “true”
addonmanager.kubernetes.io/mode: Reconcile
rules:
- apiGroups: [“”]
resources: [“namespaces”, “pods”]
verbs: [“get”, “watch”, “list”]

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: fluentd-daemon
labels:
component: fluentd-daemon
kubernetes.io/cluster-service: “true”
addonmanager.kubernetes.io/mode: Reconcile
subjects:
- kind: ServiceAccount
name: fluentd-daemon
namespace: kube-system
apiGroup: “”
roleRef:
kind: ClusterRole
name: fluentd-daemon
apiGroup: “”

---

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: fluentd-daemon
namespace: kube-system
labels:
app: log-app
component: fluentd-daemon
version: v1
kubernetes.io/cluster-service: “true”
spec:
template:
metadata:
labels:
component: fluentd-daemon
version: v1
kubernetes.io/cluster-service: “true”
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ”
spec:
serviceAccountName: fluentd-daemon
containers:
- name: fluentd-daemon
image: quay.io/samsung_cnct/fluentd_daemonset
resources:
limits:
memory: 200Mi
requests:
cpu: 100m
memory: 200Mi
volumeMounts:
- name: varlog
mountPath: /var/log
- name: varlibdockercontainers
mountPath: /var/lib/docker/containers
readOnly: true
terminationGracePeriodSeconds: 30
volumes:
- name: varlog
hostPath:
path: /var/log
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers

~~~