<commit_before>---
layout:       post
title:        "理解kubernetes的角色控制"
subtitle:     "RBAC"
date:         2019-01-03
author:       "Zeusro"
header-img:   "img/oYYBAFHlDveICOlTAAWdBpjTP2sAAAvzgB9mBEABZ0e231.jpg"
header-mask:  0.3
catalog:      true
tags:
    - kubernetes
---


`kubernetes`内部容器通讯都需要通过`api-server`进行通讯.外部通过`kubectl`访问管理集群,本质上也是访问`api-server`,`api-server`就是整个集群的指挥中枢.


但是人在江湖漂,哪能不挨刀呢?要怎么防止集群内外瞎搞事的破坏分子呢?`RBAC`(Role-based access control )顺势而生.

一句话总结`ServiceAccount`,`Role`,`RoleBinding`,`ClusterRole`,`ClusterRoleBinding`的关系就是,

**`ClusterRoleBinding`,`RoleBinding`是一种任命,认命被授权的对象(users, groups, or service accounts)能够有什么样的权限(Role,ClusterRole)**

 

## ServiceAccount

```
apiVersion: v1
kind: ServiceAccount<commit_msg>理解kubernetes的角色控制<commit_after>---
layout:       post
title:        "理解kubernetes的角色控制"
subtitle:     "RBAC"
date:         2019-01-17
author:       "Zeusro"
header-img:   "img/oYYBAFHlDveICOlTAAWdBpjTP2sAAAvzgB9mBEABZ0e231.jpg"
header-mask:  0.3
catalog:      true
tags:
    - kubernetes
---


`kubernetes`内部容器通讯都需要通过`api-server`进行通讯.外部通过`kubectl`访问管理集群,本质上也是访问`api-server`,`api-server`就是整个集群的指挥中枢.


但是人在江湖漂,哪能不挨刀呢?要怎么防止集群内外瞎搞事的破坏分子呢?`RBAC`(Role-based access control )顺势而生.

一句话总结`ServiceAccount`,`Role`,`RoleBinding`,`ClusterRole`,`ClusterRoleBinding`的关系就是,

**`ClusterRoleBinding`,`RoleBinding`是一种任命,认命被授权的对象(users, groups, or service accounts)能够有什么样的权限(Role,ClusterRole)**

 

## ServiceAccount

```
apiVersion: v1
kind: ServiceAccount
{'fraction_non_alphanumeric': 0.13432835820895522, 'fraction_numerical': 0.023066485753052916, 'mean_word_length': 5.497797356828194, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6797770', 'n_tokens_mistral': 771, 'n_tokens_neox': 777, 'n_words': 69}