有没有关于在kubernetes上做一件事需要给予什么权利的文档

Question

这里是我的第一个ServiceAccount、ClusterRole和ClusterRoleBinding

---
# Create namespace
apiVersion: v1
kind: Namespace
metadata:
name: devops-tools
---
# Create Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: devops-tools
name: bino
---
# Set Secrets for SA
# k8s >= 1.24 need to manualy created
# https://stackoverflow.com/a/72258300
apiVersion: v1
kind: Secret
metadata:
name: bino-token
namespace: devops-tools
annotations:
kubernetes.io/service-account.name: bino
type: kubernetes.io/service-account-token
---
# Create Cluster Role
# Beware !!! This is Cluster wide FULL RIGHTS
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: devops-tools-role
namespace: devops-tools
rules:
- apiGroups:
- ""
- apps
- autoscaling
- batch
- extensions
- policy
- networking.k8s.io
- rbac.authorization.k8s.io
resources:
- pods
- componentstatuses
- configmaps
- daemonsets
- deployments
- events
- endpoints
- horizontalpodautoscalers
- ingress
- jobs
- limitranges
- namespaces
- nodes
- pods
- persistentvolumes
- persistentvolumeclaims
- resourcequotas
- replicasets
- replicationcontrollers
- serviceaccounts
- services
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
# Bind the SA to Cluster Role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: devops-tools-role-binding
subjects:
- namespace: devops-tools
kind: ServiceAccount
name: bino
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: devops-tools-role
---

当我使用它来创建NameSpace、Deployment和Service时，它就起作用了。但当我试图创造一种：Ingress时，它失败了(抱怨"没有权利"(。

然后我尝试添加

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: devops-tools-role-binding-admin
subjects:
- namespace: devops-tools
kind: ServiceAccount
name: bino
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin

现在"比诺"可以做所有的事情。

我的问题是：是否有关于需要分配哪些"apiGroups"one_answers"resources"的文档，以便一个服务帐户可以做一些事情(而不是所有事情(？

真诚的

-bino-

Answer 1

您可以运行此命令来确定资源的apiGroup：

kubectl api-resources

你会看到这样的东西：

NAME        SHORTNAMES    APIVERSION              NAMESPACED   KIND
ingresses   ing           networking.k8s.io/v1    true         Ingress

因此，您需要将其添加到ClusterRole:的rules中

- apiGroups:
- "networking.k8s.io/v1"
resources:
- "ingresses"
verbs:
- "get"