kubernetes daahboard權限限制

dashboard在多人使用的時候常常遇到誤操做的狀況，爲了對dashboard進行限制，對dashboard進行了權限控制， 這裏主要限制只容許pod被刪除。
1：建立對應權限的ClusterRole（這裏主要值容許pods被刪除）

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: dashboard
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "watch", "list", "create","proxy","update"]
- apiGroups: ["*"]
  resources: ["pods"]
  verbs: ["delete"]

 

注意的一點是爲了讓dashboard顯示heapster的監控數據，必須還得開放resources中server的proxy方式

2：建立 ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard
  namespace: kube-system

 

3：將ClusterRole和ServiceAccount互相綁定

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: dashboard-extended
subjects:
  - kind: ServiceAccount
    name: dashboard
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: dashboard
  #name: cluster-admin #默認cluster-admin表明開放所有權限
  apiGroup: rbac.authorization.k8s.io

 

4：deployment加入ServiceAccount權限
spec.template.spec.serviceAccountName：dashboard

5：爲了讓heapster也得到權限，用一樣的方式讓heapster得到system:heapster的權限

apiVersion: v1
kind: ServiceAccount
metadata:
  name: heapster
  namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: heapster-extended
subjects:
  - kind: ServiceAccount
    namespace: kube-system
    name: heapster
roleRef:
  kind: ClusterRole
  name: system:heapster
  apiGroup: rbac.authorization.k8s.io