1
apiVersion: v1
2
kind: ServiceAccount
3
metadata:
4
  name: sa-web
5
  namespace: default
6
  labels:
7
    sa: sa-web

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: sa-web-pod
5
  namespace: default
6
  labels:
7
    app: sa-web-pod
8
spec:
9
  serviceAccountName: sa-web
10
  containers:
11
  - name: nginx
12
    ports:
13
    - containerPort: 80
14
    image: nginx:latest
15
    imagePullPolicy: IfNotPresent

1
{
2
  "kind": "APIVersions",
3
  "versions": [
4
    "v1"
5
  ],
6
  "serverAddressByClientCIDRs": [
7
    {
8
      "clientCIDR": "0.0.0.0/0",
9
      "serverAddress": "10.0.0.85:16443"
10
    }
11
  ]
12
}

1
{
2
  "kind": "Status",
3
  "apiVersion": "v1",
4
  "metadata": {},
5
  "status": "Failure",
6
  "message": "namespaces \"kube-system\" is forbidden: User \"system:serviceaccount:default:sa-web\" cannot get resource \"namespaces\" in API group \"\" in the namespace \"kube-system\"",
7
  "reason": "Forbidden",
8
  "details": {
9
    "name": "kube-system",
10
    "kind": "namespaces"
11
  },
12
  "code": 403
13
}

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRoleBinding
3
metadata:
4
  name: sa-web-admin
5
subjects:
6
- kind: ServiceAccount
7
  name: sa-web
8
  namespace: default
9
roleRef: # roleRef - 将已存在的Role或ClusterRole角色作为模板，让新角色使用这个模板获得模板的全部权限
10
  kind: ClusterRole
11
  name: cluster-admin # cluster-admin 拥有对所有资源的权限。
12
  apiGroup: rbac.authorization.k8s.io

1
{
2
  "kind": "Namespace",
3
  "apiVersion": "v1",
4
  "metadata": {
5
    "name": "kube-system",
6
    "uid": "660650c8-a91b-467e-bd45-4f981f61b325",
7
    "resourceVersion": "6",
8
    "creationTimestamp": "2025-05-26T05:52:15Z",
9
    "labels": {
10
      "kubernetes.io/metadata.name": "kube-system"
11
    },
12
    "managedFields": [
13
      {
14
        "manager": "kubelite",
15
        "operation": "Update",
16
        "apiVersion": "v1",
17
        "time": "2025-05-26T05:52:15Z",
18
        "fieldsType": "FieldsV1",
19
        "fieldsV1": {
20
          "f:metadata": {
21
            "f:labels": {
22
              ".": {},
23
              "f:kubernetes.io/metadata.name": {}
24
            }
25
          }
26
        }
27
      }
28
    ]
29
  },
30
  "spec": {
31
    "finalizers": [
32
      "kubernetes"
33
    ]
34
  },
35
  "status": {
36
    "phase": "Active"
37
  }
38
}

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: Role
3
metadata:
4
  name: default-read-role
5
  namespace: default
6
rules:
7
- apiGroups: [""]
8
  resources: ["pods"]
9
  resourceNames: []
10
  verbs: ["get","watch","list"]

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRole
3
metadata:
4
  name: secrets-read-clusterrole
5
rules:
6
- apiGroups: [""]
7
  resources: ["secrets"]
8
  verbs: ["get","watch","list"]

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRole
3
metadata:
4
  name: node-read-clusterrole
5
rules:
6
- apiGroups: [""]
7
  resources: ["nodes"]
8
  verbs: ["get","watch","list"]
9
- apiGroups: ["metrics.k8s.io"]
10
  resources: ["nodes"]
11
  verbs: ["get","watch","list"]

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRole
3
metadata:
4
  name: health-url-clusterrole
5
rules:
6
- nonResourceURLs: ["/healthz", "/healthz/*"]
7
  verbs: ["get","post"]

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: RoleBinding
3
metadata:
4
  name: default-pod-read-bind
5
subjects:
6
- kind: User
7
  name: rbactest1
8
roleRef:
9
  kind: Role
10
  name: default-read-role
11
  apiGroup: rbac.authorization.k8s.io

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: RoleBinding
3
metadata:
4
  name: view-sa-binding
5
subjects:
6
- kind: ServiceAccount
7
  name: dev
8
  namespace: default
9
roleRef:
10
  kind: ClusterRole
11
  name: view
12
  apiGroup: rbac.authorization.k8s.io

1
# [root@microk8s-85 /certs/rbactest1]#kubectl config view
2
apiVersion: v1
3
clusters:
4
- cluster:
5
    certificate-authority-data: DATA+OMITTED
6
    server: https://127.0.0.1:16443
7
  name: microk8s-cluster
8
contexts:
9
- context:
10
    cluster: microk8s-cluster
11
    user: admin
12
  name: microk8s
13
current-context: microk8s
14
kind: Config
15
preferences: {}
16
users:
17
- name: admin
18
  user:
19
    client-certificate-data: DATA+OMITTED
20
    client-key-data: DATA+OMITTED
21
- name: rbactest1
22
  user:
23
    client-certificate-data: DATA+OMITTED
24
    client-key-data: DATA+OMITTED

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: Role
3
metadata:
4
  name: test-ns-full
5
  namespace: test
6
rules:
7
- apiGroups: [""]
8
  resources: ["*"]
9
  resourceNames: []
10
  verbs: ["*"]

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: RoleBinding
3
metadata:
4
  name: test-ns-full-binding
5
  namespace: test
6
subjects:
7
- kind: User
8
  name: rbactest1
9
  apiGroup: rbac.authorization.k8s.io
10
roleRef:
11
  kind: Role
12
  name: test-ns-full
13
  apiGroup: rbac.authorization.k8s.io