K8S的认证授权是基于插件的，目前用得最多的是RBAC,也就是基于角色的访问控制

实操一；User-role-rolebinding

1、创建role角色，赋予角色相关权限
2、将用户与角色进行绑定
3、测试

（1）创建角色pod-reader，赋予角色对pods进行list,get,watch操作

查看帮助信息 kubectl create role -h
[root@master pki]# kubectl create role pod-reader --verb=list,get,watch --resource=pods --dry-run -o yaml               # --dry-run指不真正运行，输出为yaml格式的文件并保存下来，这样就用模板可以给你写yaml，省时
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: null
  name: pod-reader
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - list
  - get
  - watch
[root@master pki]# kubectl create role pod-reader --verb=list,get,watch --resource=pods --dry-run -o yaml > ~/pos/role-demo.yaml   #保存yaml文件

[root@master pki]# cd ~/pos/
[root@master pos]# cat role-demo.yaml  #查看yaml文件
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: null
  name: pod-reader
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - list
  - get
  - watch
[root@master pos]# kubectl apply -f role-demo.yaml    #应用yaml文件，创建role
role.rbac.authorization.k8s.io/pod-reader created
[root@master pos]# kubectl get role    #查看role
NAME         AGE
pod-reader   26s

（2）将角色与之前的sunny用户绑定

[root@master pos]# kubectl create rolebinding sunny-read-pods --user=sunny --role=pod-reader --dry-run -o yaml   #将sunny用户与pod-reader角色进行绑定
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  name: sunny-read-pods
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: sunny

[root@master pos]# kubectl create rolebinding sunny-read-pods --user=sunny --role=pod-reader --dry-run -o yaml > ./rolebinding-demo.yaml    #将文件输出为yaml保存
[root@master pos]# ls
deploy-myapp.yaml  ingress            pod-myapp.yaml         role-demo.yaml  svc-myapp.yaml
ds-myapp.yaml      pod-jhipster.yaml  rolebinding-demo.yaml  rs-myapp.yaml   volumes
[root@master pos]# kubectl apply -f rolebinding-demo.yaml    #创建rolebinding
rolebinding.rbac.authorization.k8s.io/sunny-read-pods created
[root@master pos]# kubectl get rolebinding  #查看新建的rolebinding
NAME              AGE
sunny-read-pods   13s

（3）测试
切换至sunny用户，请求查看pods资源与请求查看service资源，预期pods应该可以看到，而service资源应该看不到

[root@master pos]# kubectl config use-context sunny@kubernetes  #切换sunny用户
Switched to context "sunny@kubernetes".
[root@master pos]# kubectl get pods  #请求pods资源，可看到
NAME                            READY   STATUS    RESTARTS   AGE
sunny-deploy-654cd9c85c-d4xc4   1/1     Running   0          44h
sunny-deploy-654cd9c85c-lhsfl   1/1     Running   0          44h
[root@master pos]# kubectl get svc   #请求svc资源，被拒绝
Error from server (Forbidden): services is forbidden: User "sunny" cannot list resource "services" in API group "" in the namespace "default"

以上role默认的namespace是default
如果要指定某个namespace，则在role及rolebinding的metadata中定义namespace

实操二：user-clusterrole-clusterrolebinding

1、创建clusterrole
[root@master pos]# kubectl create clusterrole clusterrole-reader-pods --verb=get,list,watch --resource=pods --dry-run -o yaml > clusterrole-demo.yaml
[root@master pos]# kubectl apply -f clusterrole-demo.yaml
clusterrole.rbac.authorization.k8s.io/clusterrole-reader-pods created

2、创建clusterrolebinding
[root@master pos]# kubectl create clusterrolebinding cluster-reader --clusterrole=clusterrole-reader-pods --user=sunny --dry-run -o yaml > clusterrolebinding-demo.yaml
[root@master pos]# kubectl apply -f clusterrolebinding-demo.yaml
clusterrolebinding.rbac.authorization.k8s.io/cluster-reader created

3、测试
[root@master pos]# kubectl config use-context sunny@kubernetes
Switched to context "sunny@kubernetes".
[root@master pos]# kubectl get pods -A   #获取集群的pods
NAMESPACE       NAME                                        READY   STATUS    RESTARTS   AGE
default         sunny-deploy-654cd9c85c-d4xc4               1/1     Running   0          45h
default         sunny-deploy-654cd9c85c-lhsfl               1/1     Running   0          45h
ingress-nginx   nginx-ingress-controller-75d5587cb9-98b6t   1/1     Running   0          44h
kube-system     coredns-fb8b8dccf-2khbc                     1/1     Running   1          4d23h
kube-system     coredns-fb8b8dccf-628mc                     1/1     Running   1          4d23h
kube-system     etcd-master                                 1/1     Running   1          4d23h
kube-system     kube-apiserver-master                       1/1     Running   1          4d23h
kube-system     kube-controller-manager-master              1/1     Running   1          4d23h
kube-system     kube-flannel-ds-amd64-67h64                 1/1     Running   1          4d22h
kube-system     kube-flannel-ds-amd64-cq7tp                 1/1     Running   0          3d5h
kube-system     kube-flannel-ds-amd64-zq9qf                 1/1     Running   0          4d21h
kube-system     kube-proxy-9lqk6                            1/1     Running   1          4d23h
kube-system     kube-proxy-nrvp6                            1/1     Running   0          3d5h
kube-system     kube-proxy-zv2rl                            1/1     Running   0          4d21h
kube-system     kube-scheduler-master                       1/1     Running   1          4d23h
kube-system     kubernetes-dashboard-76f6bf8c57-9gp6c       1/1     Running   0          45h

实操三：user-rolebinding-clusterrole

将之前建立的role、clusterrolebinding都删除

新建

[root@master pos]# kubectl create rolebinding role-to-clusterrole --clusterrole=clusterrole-reader-pods --user=sunny --dry-run -o yaml > role-to-clusterrole-demo.yaml
[root@master pos]# cat role-to-clusterrole-demo.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  name: role-to-clusterrole
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: clusterrole-reader-pods
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: sunny
[root@master pos]# kubectl apply -f role-to-clusterrole-demo.yaml
rolebinding.rbac.authorization.k8s.io/role-to-clusterrole created

测试：虽然rolebinding绑定了clusterrole，但是用户只能获取default空间内的pods资源，因为rolebinding限制在default名称空间内

[root@master pos]# kubectl config use-context sunny@kubernetes
Switched to context "sunny@kubernetes".
[root@master pos]# kubectl get pods
NAME                            READY   STATUS    RESTARTS   AGE
sunny-deploy-654cd9c85c-d4xc4   1/1     Running   0          45h
sunny-deploy-654cd9c85c-lhsfl   1/1     Running   0          45h
[root@master pos]# kubectl get pods -n kube-system
Error from server (Forbidden): pods is forbidden: User "sunny" cannot list resource "pods" in API group "" in the namespace "kube-system": RBAC: role.rbac.authorization.k8s.io "pod-reader" not found

附录：

k8s中有角色和角色绑定，因为K8S有两种资源，一种是集群资源，也就是cluster；一种是namespace资源；所以分别有role,rolebinding,clusterrole,clusterrolebinding.他们的区别在于作用域不同，cluster是针对整个集群资源的，而role则是限制在namespace中的。

这里有个特例就是role可以绑定clusterrole，这是很便捷的一个操作，假设你有十个namespace，每个namespace要建立一个只读权限的角色，那么你需要在10个namespace中分别建立rolebinding为get；但是如果role可以绑定clusterrolebinding，那么只需要建立一个clusterrolebinding为get，然后使用role去绑定这个clusterrolebinding即可，而不需要去建10次。