实验环境

k8s环境参考： k8s-v.120.10 二进制部署指导文档

k8s之聚合ClusterRole

[root@k8s-master-1 kubectl]# cat aggregation.yaml 
# 创建一个聚合ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aggregation-selector
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.example.com/aggregation-pod: "true"
  - matchLabels:
      rbac.example.com/aggregation-service: "true"
rules: [] # 控制面自动填充这里的规则
# 创建另二个ClusterRole
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aggregation-pod
  labels:
    rbac.example.com/aggregation-pod: "true"
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aggregation-service
  labels:
    rbac.example.com/aggregation-service: "true"
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get","list","watch"]
# 创建clusterrolebind将aggregation-selector授权给kubectl-test用户
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: aggregation-bind
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: aggregation-selector
subjects:
- kind: User
  name: kubectl-test
  apiGroup: rbac.authorization.k8s.io

[root@k8s-node-1 ~]# kubectl get pods
No resources found in default namespace.
You have new mail in /var/spool/mail/root
[root@k8s-node-1 ~]# kubectl get pods -A
NAMESPACE     NAME                                       READY   STATUS    RESTARTS   AGE
kube-system   calico-kube-controllers-855445d444-n2c4m   1/1     Running   4          2d17h
kube-system   calico-node-6pkz6                          1/1     Running   5          8d
kube-system   calico-node-8nz7s                          1/1     Running   2          8d
kube-system   calico-node-z7pwc                          1/1     Running   9          8d
kube-system   coredns-6f4c9cb7c5-hj9bj                   1/1     Running   5          8d
kube-system   metrics-server-68bdbcc6b-gk6cq             1/1     Running   5          8d
[root@k8s-node-1 ~]# kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.0.0.1     <none>        443/TCP   9d
[root@k8s-node-1 ~]# kubectl get secret
Error from server (Forbidden): secrets is forbidden: User "kubectl-test" cannot list resource "secrets" in API group "" in the namespace "default"

总结：通过上述实验可以知道，聚合ClusterRole本来没有任何权限，而是通过clusterRoleSelectors选择了与标签匹配的ClusterRole，从而间接拥有了权限

参考文档
https://kubernetes.io/zh/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles