如何在Kubernetes中为系统分配RBAC权限:匿名服务帐户

Question

如何在Kubernetes中为系统：匿名服务帐户分配RBAC权限？

为了理解Kubernetes，我想为system:anonymous服务帐户分配权限，以便使用kubectl auth can-i --list查看权限。

我创建了以下角色和角色绑定：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole 
metadata:
name: anonymous-review-access
rules:
- apiGroups:
- authorization.k8s.io
resources:
- selfsubjectaccessreviews
- selfsubjectrulesreviews
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: anonymous-review-access
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: anonymous-review-access
subjects:
- kind: ServiceAccount
name: anonymous
namespace: default

在kubectl apply -f ...以上之后，我仍然不允许匿名审查访问权限：

$ kubectl auth can-i --list --as=system:anonymous -n default
Error from server (Forbidden): selfsubjectrulesreviews.authorization.k8s.io is forbidden: User "system:anonymous" cannot create resource "selfsubjectrulesreviews" in API group "authorization.k8s.io" at the cluster scope

如何创建适当的角色和角色绑定以查看system:anonymous服务帐户的权限？

Answer 1

system:anonymous不是服务帐户。未被其他配置的身份验证方法拒绝的请求被视为匿名请求，并给定用户名system:anonymous和一组system:unauthenticated

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: anonymous-review-access
rules:
- apiGroups:
- authorization.k8s.io
resources:
- selfsubjectaccessreviews
- selfsubjectrulesreviews
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: anonymous-review-access
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: anonymous-review-access
subjects:
- kind: User
name: system:anonymous
namespace: default

---

kubectl auth can-i --list --as=system:anonymous -n default
Resources                                       Non-Resource URLs   Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]