RoleBinding
学习目标
- 理解 RoleBinding 和 ClusterRoleBinding 的区别
- 掌握 RoleBinding 的创建方法
- 了解绑定主体的类型
核心概念
一句话解释
RoleBinding 将 Role 或 ClusterRole 绑定到用户、组或服务账户，授予其相应的权限。
RoleBinding 工作流程
Role (定义权限) Subject (绑定主体)
│ │
│ │
└───────┬────────────────┘
│
▼
RoleBinding
(将权限授予主体)
│
▼
授权结果
(主体获得权限)
RoleBinding vs ClusterRoleBinding
| 特性 | RoleBinding | ClusterRoleBinding |
|---|---|---|
| 作用范围 | 单个命名空间 | 整个集群 |
| 可绑定的 Role | Role 或 ClusterRole | 只能绑定 ClusterRole |
| 典型用途 | 命名空间权限 | 集群级权限 |
RoleBinding 示例
# 将 pod-reader Role 绑定到用户 alice
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
namespace: default
subjects:
- kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
ClusterRoleBinding 示例
# 将 cluster-admin ClusterRole 绑定到用户 bob
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: admin-binding
subjects:
- kind: User
name: bob
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
绑定主体类型
| 类型 | 说明 | 示例 |
|---|---|---|
| User | 用户 | alice, bob |
| Group | 用户组 | dev-team, ops-team |
| ServiceAccount | 服务账户 | default, my-app-sa |
多主体绑定
# 绑定多个用户和组
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
namespace: default
subjects:
- kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
- kind: User
name: bob
apiGroup: rbac.authorization.k8s.io
- kind: Group
name: dev-team
apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
name: my-app-sa
namespace: default
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
跨命名空间 ClusterRole 绑定
# 在 dev 命名空间使用 ClusterRole，但限制作用范围
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: deployment-viewer-dev
namespace: dev
subjects:
- kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: deployment-viewer
apiGroup: rbac.authorization.k8s.io
效果：alice 只能查看 dev 命名空间的 Deployment
不能查看其他命名空间的 Deployment
调试 RoleBinding
# 查看命名空间的所有 RoleBinding
kubectl get rolebindings -n default
# 查看 RoleBinding 详情
kubectl describe rolebinding read-pods -n default
# 检查用户权限
kubectl auth can-i list pods --as alice -n default
# 查看集群级 RoleBinding
kubectl get clusterrolebindings
实践练习
练习 1：创建 RoleBinding
# 创建 RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: configmap-editor
namespace: default
subjects:
- kind: User
name: developer
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: configmap-manager
apiGroup: rbac.authorization.k8s.io
# 应用 RoleBinding
kubectl apply -f configmap-editor-binding.yaml
# 验证权限
kubectl auth can-i list configmaps --as developer -n default
练习 2：跨命名空间绑定
# 在 prod 命名空间使用 ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: deployment-viewer-prod
namespace: prod
subjects:
- kind: Group
name: ops-team
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: deployment-viewer
apiGroup: rbac.authorization.k8s.io
常见误解
1. RoleBinding 只能绑定 Role
事实：RoleBinding 可以绑定 Role 或 ClusterRole
误解：RoleBinding 只能绑定 Role
解决：使用 RoleBinding 引用 ClusterRole 可以限制到命名空间
2. ClusterRoleBinding 可以绑定 Role
事实：ClusterRoleBinding 只能绑定 ClusterRole
误解：ClusterRoleBinding 可以绑定 Role
解决：集群级权限必须使用 ClusterRole
小结
| 要点 | 说明 |
|---|---|
| RoleBinding | 命名空间级权限绑定 |
| ClusterRoleBinding | 集群级权限绑定 |
| 绑定主体 | User、Group、ServiceAccount |
| 最佳实践 | 使用 RoleBinding 限制 ClusterRole 作用范围 |
| 调试命令 | kubectl auth can-i、kubectl describe rolebinding |
练习编辑器
bash
Loading...