2.openshift受權策略和scc理解

policy管理概念

查看policy的方式能夠經過cli進行查看

Roles grant various levels of access in the system-wide cluster policy as well as project-scoped local policies. Users and groups can be associated with, or bound to, multiple roles at the same time. You can view details about the roles and their bindings using the oc describe command.

擁有cluster-admin 角色的用戶能夠在集羣範圍內查看  擁有admin角色的用戶只能在單個project來查看。

Users with the cluster-admin default role in the cluster policy can view cluster policy and all local policies. Users with the admin default role in a given local policy can view that project-scoped policy.

經常使用命令

policy 是一些列 roles的集合

     能夠查看出 集羣中roles  和 rolebind

 oc describe clusterPolicy default

 oc describe clusterPolicyBindings :default

查看本空間內  role  和  rolebind

oc describe policyBindings :defaultoadm  policy 命令來管理 policy