OpenShift 文档正在迁移，很快将仅在 docs.redhat.com（所有 Red Hat 产品文档的所在地）提供。立即体验 新的文档体验。
  1. 文档
    2. history bug_report picture_as_pdf
×

使用RBAC定义和应用权限

RBAC 概述

基于角色的访问控制 (RBAC) 对象决定用户是否允许在项目中执行给定操作。

拥有 `dedicated-admin` 角色的管理员可以使用集群角色和绑定来控制谁拥有对 OpenShift Dedicated 平台本身和所有项目的各种访问级别。

开发人员可以使用本地角色和绑定来控制谁可以访问他们的项目。请注意，授权与身份验证是分开的步骤，身份验证更多的是关于确定执行操作者的身份。

授权使用以下方式管理

授权对象 描述

规则

对一组对象允许的一组动词。例如，用户或服务帐户是否可以 `创建` Pod。

角色

规则集合。您可以将用户和组关联或绑定到多个角色。

绑定

用户和/或组与角色之间的关联。

有两个级别的 RBAC 角色和绑定来控制授权

RBAC级别 描述

集群 RBAC

适用于所有项目的角色和绑定。集群角色存在于集群范围内，而集群角色绑定只能引用集群角色。

本地 RBAC

作用域限定为给定项目的角色和绑定。虽然本地角色仅存在于单个项目中，但本地角色绑定可以同时引用集群角色和本地角色。

集群角色绑定是在集群级别存在的绑定。角色绑定存在于项目级别。用户必须通过本地角色绑定绑定集群角色“查看”，才能查看该项目。只有在集群角色未提供特定情况所需的权限集时，才创建本地角色。

这种两级层次结构允许通过集群角色在多个项目中重用，同时允许通过本地角色在单个项目内进行自定义。

在评估过程中，将同时使用集群角色绑定和本地角色绑定。例如

  1. 检查集群范围的“允许”规则。

  2. 检查本地绑定的“允许”规则。

  3. 默认拒绝。

默认集群角色

OpenShift Dedicated 包含一组默认集群角色，您可以将其绑定到集群范围或本地范围的用户和组。

不建议手动修改默认集群角色。对这些系统角色的修改可能会阻止集群正常运行。
默认集群角色 描述

admin

项目管理员。如果在本地绑定中使用，则 `admin` 具有查看项目中任何资源和修改项目中除配额外的任何资源的权限。

basic-user

可以获取有关项目和用户的基本信息的使用者。

cluster-admin

超级用户，可以在任何项目中执行任何操作。当与本地绑定一起绑定到用户时，他们可以完全控制配额以及项目中每个资源上的所有操作。

cluster-status

可以获取基本集群状态信息的使用者。

cluster-reader

可以获取或查看大多数对象但不能修改它们的使用者。

edit

可以修改项目中大多数对象但无权查看或修改角色或绑定的使用者。

self-provisioner

可以创建自己的项目的使用者。

view

无法进行任何修改，但可以查看项目中大多数对象的使用者。他们无法查看或修改角色或绑定。

请注意本地绑定和集群绑定之间的区别。例如，如果您使用本地角色绑定将 `cluster-admin` 角色绑定到用户，则该用户似乎具有集群管理员的权限。事实并非如此。在项目中将 `cluster-admin` 绑定到用户仅向该用户授予该项目的超级管理员权限。该用户拥有集群角色 `admin` 的权限，以及一些其他权限，例如能够编辑速率限制，适用于该项目。此绑定在 Web 控制台 UI 中可能令人困惑，后者未列出绑定到真正的集群管理员的集群角色绑定。但是，它确实列出了您可以用来在本地绑定 `cluster-admin` 的本地角色绑定。

下图说明了集群角色、本地角色、集群角色绑定、本地角色绑定、用户、组和服务帐户之间的关系。

OpenShift Dedicated RBAC

get pods/exec、get pods/*和get *规则在应用于角色时授予执行权限。请遵循最小权限原则，仅为用户和代理分配所需的最小RBAC权限。更多信息，请参见RBAC规则允许执行权限。

评估授权

OpenShift Dedicated 使用以下方法评估授权

身份

用户名和用户所属的组列表。

操作

您执行的操作。在大多数情况下，这包括

  • 项目：您访问的项目。项目是一个 Kubernetes 命名空间，带有额外的注释，允许用户社区隔离其他社区组织和管理其内容。

  • 动词：操作本身：get、list、create、update、delete、deletecollection或watch。

  • 资源名称：您访问的API端点。

绑定

完整的绑定列表，用户或组与角色之间的关联。

OpenShift Dedicated 使用以下步骤评估授权

  1. 使用身份和项目范围的操作来查找适用于用户或其组的所有绑定。

  2. 使用绑定来查找所有适用的角色。

  3. 使用角色来查找所有适用的规则。

  4. 将操作与每个规则进行比较以查找匹配项。

  5. 如果找不到匹配规则，则默认情况下拒绝该操作。

请记住，用户和组可以同时与多个角色关联或绑定。

项目管理员可以使用CLI查看本地角色和绑定，包括每个角色关联的动词和资源矩阵。

绑定到项目管理员的集群角色通过本地绑定在项目中受到限制。它不像授予cluster-admin或system:admin的集群角色那样在集群范围内绑定。

集群角色是在集群级别定义的角色，但可以在集群级别或项目级别绑定。

集群角色聚合

默认的管理员、编辑、查看和集群读取器集群角色支持集群角色聚合，其中每个角色的集群规则会在创建新规则时动态更新。此功能仅在您通过创建自定义资源扩展 Kubernetes API 时才相关。

项目和命名空间

Kubernetes *命名空间*提供了一种在集群中限定资源范围的机制。Kubernetes 文档包含有关命名空间的更多信息。

命名空间为以下内容提供唯一的范围：

  • 命名资源，以避免基本的命名冲突。

  • 向受信任用户委派管理权限。

  • 限制社区资源消耗的能力。

系统中的大多数对象都由命名空间限定范围，但某些对象除外，并且没有命名空间，包括节点和用户。

一个*项目*是一个带有附加注释的 Kubernetes 命名空间，是管理常规用户访问资源的中心工具。项目允许用户社区隔离其他社区组织和管理其内容。用户必须由管理员授予对项目的访问权限，或者如果允许创建项目，则自动拥有对其自己项目的访问权限。

项目可以拥有单独的name、displayName和description。

  • 强制性name是项目的唯一标识符，在使用CLI工具或API时最明显。最大名称长度为63个字符。

  • 可选的displayName是在 Web 控制台中显示项目的方式（默认为name）。

  • 可选的description可以是对项目的更详细描述，也显示在 Web 控制台中。

每个项目限定其自身的一组：

对象 描述

对象

Pod、服务、复制控制器等。

策略

用户可以或不可以对对象执行操作的规则。

约束

可以限制的每种对象类型的配额。

服务帐户

服务帐户自动使用指定的访问权限来访问项目中的对象。

具有dedicated-admin角色的管理员可以创建项目并将项目的管理权限委派给用户社区的任何成员。具有dedicated-admin角色的管理员还可以允许开发人员创建他们自己的项目。

开发人员和管理员可以使用CLI或Web控制台与项目交互。

默认项目

OpenShift Dedicated 带有一些默认项目，以openshift-开头的项目对用户来说最为重要。这些项目托管作为 Pod 运行的主组件和其他基础设施组件。在这些命名空间中创建的具有关键 Pod 批注的 Pod 被认为是关键的，并且 kubelet 会保证其准入。为这些命名空间中的主组件创建的 Pod 已被标记为关键。

不要在默认项目中运行工作负载或共享对默认项目的访问权限。默认项目保留用于运行核心集群组件。

以下默认项目被认为是高度特权的：default、kube-public、kube-system、openshift、openshift-infra、openshift-node以及其他具有openshift.io/run-level标签设置为0或1的系统创建的项目。依赖于准入插件的功能（例如 Pod 安全准入、安全上下文约束、集群资源配额和镜像引用解析）在高度特权的项目中不起作用。

查看集群角色和绑定

您可以使用oc CLI 通过使用oc describe命令来查看集群角色和绑定。

先决条件

  • 安装oc CLI。

  • 获得查看集群角色和绑定的权限。

步骤

  1. 要查看集群角色及其关联的规则集

    $ oc describe clusterrole.rbac
    示例输出
    Name:         admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources                                                  Non-Resource URLs  Resource Names  Verbs
  ---------                                                  -----------------  --------------  -----
  .packages.apps.redhat.com                                  []                 []              [* create update patch delete get list watch]
  imagestreams                                               []                 []              [create delete deletecollection get list patch update watch create get list watch]
  imagestreams.image.openshift.io                            []                 []              [create delete deletecollection get list patch update watch create get list watch]
  secrets                                                    []                 []              [create delete deletecollection get list patch update watch get list watch create delete deletecollection patch update]
  buildconfigs/webhooks                                      []                 []              [create delete deletecollection get list patch update watch get list watch]
  buildconfigs                                               []                 []              [create delete deletecollection get list patch update watch get list watch]
  buildlogs                                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
  deploymentconfigs/scale                                    []                 []              [create delete deletecollection get list patch update watch get list watch]
  deploymentconfigs                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
  imagestreamimages                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
  imagestreammappings                                        []                 []              [create delete deletecollection get list patch update watch get list watch]
  imagestreamtags                                            []                 []              [create delete deletecollection get list patch update watch get list watch]
  processedtemplates                                         []                 []              [create delete deletecollection get list patch update watch get list watch]
  routes                                                     []                 []              [create delete deletecollection get list patch update watch get list watch]
  templateconfigs                                            []                 []              [create delete deletecollection get list patch update watch get list watch]
  templateinstances                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
  templates                                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
  deploymentconfigs.apps.openshift.io/scale                  []                 []              [create delete deletecollection get list patch update watch get list watch]
  deploymentconfigs.apps.openshift.io                        []                 []              [create delete deletecollection get list patch update watch get list watch]
  buildconfigs.build.openshift.io/webhooks                   []                 []              [create delete deletecollection get list patch update watch get list watch]
  buildconfigs.build.openshift.io                            []                 []              [create delete deletecollection get list patch update watch get list watch]
  buildlogs.build.openshift.io                               []                 []              [create delete deletecollection get list patch update watch get list watch]
  imagestreamimages.image.openshift.io                       []                 []              [create delete deletecollection get list patch update watch get list watch]
  imagestreammappings.image.openshift.io                     []                 []              [create delete deletecollection get list patch update watch get list watch]
  imagestreamtags.image.openshift.io                         []                 []              [create delete deletecollection get list patch update watch get list watch]
  routes.route.openshift.io                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
  processedtemplates.template.openshift.io                   []                 []              [create delete deletecollection get list patch update watch get list watch]
  templateconfigs.template.openshift.io                      []                 []              [create delete deletecollection get list patch update watch get list watch]
  templateinstances.template.openshift.io                    []                 []              [create delete deletecollection get list patch update watch get list watch]
  templates.template.openshift.io                            []                 []              [create delete deletecollection get list patch update watch get list watch]
  serviceaccounts                                            []                 []              [create delete deletecollection get list patch update watch impersonate create delete deletecollection patch update get list watch]
  imagestreams/secrets                                       []                 []              [create delete deletecollection get list patch update watch]
  rolebindings                                               []                 []              [create delete deletecollection get list patch update watch]
  roles                                                      []                 []              [create delete deletecollection get list patch update watch]
  rolebindings.authorization.openshift.io                    []                 []              [create delete deletecollection get list patch update watch]
  roles.authorization.openshift.io                           []                 []              [create delete deletecollection get list patch update watch]
  imagestreams.image.openshift.io/secrets                    []                 []              [create delete deletecollection get list patch update watch]
  rolebindings.rbac.authorization.k8s.io                     []                 []              [create delete deletecollection get list patch update watch]
  roles.rbac.authorization.k8s.io                            []                 []              [create delete deletecollection get list patch update watch]
  networkpolicies.extensions                                 []                 []              [create delete deletecollection patch update create delete deletecollection get list patch update watch get list watch]
  networkpolicies.networking.k8s.io                          []                 []              [create delete deletecollection patch update create delete deletecollection get list patch update watch get list watch]
  configmaps                                                 []                 []              [create delete deletecollection patch update get list watch]
  endpoints                                                  []                 []              [create delete deletecollection patch update get list watch]
  persistentvolumeclaims                                     []                 []              [create delete deletecollection patch update get list watch]
  pods                                                       []                 []              [create delete deletecollection patch update get list watch]
  replicationcontrollers/scale                               []                 []              [create delete deletecollection patch update get list watch]
  replicationcontrollers                                     []                 []              [create delete deletecollection patch update get list watch]
  services                                                   []                 []              [create delete deletecollection patch update get list watch]
  daemonsets.apps                                            []                 []              [create delete deletecollection patch update get list watch]
  deployments.apps/scale                                     []                 []              [create delete deletecollection patch update get list watch]
  deployments.apps                                           []                 []              [create delete deletecollection patch update get list watch]
  replicasets.apps/scale                                     []                 []              [create delete deletecollection patch update get list watch]
  replicasets.apps                                           []                 []              [create delete deletecollection patch update get list watch]
  statefulsets.apps/scale                                    []                 []              [create delete deletecollection patch update get list watch]
  statefulsets.apps                                          []                 []              [create delete deletecollection patch update get list watch]
  horizontalpodautoscalers.autoscaling                       []                 []              [create delete deletecollection patch update get list watch]
  cronjobs.batch                                             []                 []              [create delete deletecollection patch update get list watch]
  jobs.batch                                                 []                 []              [create delete deletecollection patch update get list watch]
  daemonsets.extensions                                      []                 []              [create delete deletecollection patch update get list watch]
  deployments.extensions/scale                               []                 []              [create delete deletecollection patch update get list watch]
  deployments.extensions                                     []                 []              [create delete deletecollection patch update get list watch]
  ingresses.extensions                                       []                 []              [create delete deletecollection patch update get list watch]
  replicasets.extensions/scale                               []                 []              [create delete deletecollection patch update get list watch]
  replicasets.extensions                                     []                 []              [create delete deletecollection patch update get list watch]
  replicationcontrollers.extensions/scale                    []                 []              [create delete deletecollection patch update get list watch]
  poddisruptionbudgets.policy                                []                 []              [create delete deletecollection patch update get list watch]
  deployments.apps/rollback                                  []                 []              [create delete deletecollection patch update]
  deployments.extensions/rollback                            []                 []              [create delete deletecollection patch update]
  catalogsources.operators.coreos.com                        []                 []              [create update patch delete get list watch]
  clusterserviceversions.operators.coreos.com                []                 []              [create update patch delete get list watch]
  installplans.operators.coreos.com                          []                 []              [create update patch delete get list watch]
  packagemanifests.operators.coreos.com                      []                 []              [create update patch delete get list watch]
  subscriptions.operators.coreos.com                         []                 []              [create update patch delete get list watch]
  buildconfigs/instantiate                                   []                 []              [create]
  buildconfigs/instantiatebinary                             []                 []              [create]
  builds/clone                                               []                 []              [create]
  deploymentconfigrollbacks                                  []                 []              [create]
  deploymentconfigs/instantiate                              []                 []              [create]
  deploymentconfigs/rollback                                 []                 []              [create]
  imagestreamimports                                         []                 []              [create]
  localresourceaccessreviews                                 []                 []              [create]
  localsubjectaccessreviews                                  []                 []              [create]
  podsecuritypolicyreviews                                   []                 []              [create]
  podsecuritypolicyselfsubjectreviews                        []                 []              [create]
  podsecuritypolicysubjectreviews                            []                 []              [create]
  resourceaccessreviews                                      []                 []              [create]
  routes/custom-host                                         []                 []              [create]
  subjectaccessreviews                                       []                 []              [create]
  subjectrulesreviews                                        []                 []              [create]
  deploymentconfigrollbacks.apps.openshift.io                []                 []              [create]
  deploymentconfigs.apps.openshift.io/instantiate            []                 []              [create]
  deploymentconfigs.apps.openshift.io/rollback               []                 []              [create]
  localsubjectaccessreviews.authorization.k8s.io             []                 []              [create]
  localresourceaccessreviews.authorization.openshift.io      []                 []              [create]
  localsubjectaccessreviews.authorization.openshift.io       []                 []              [create]
  resourceaccessreviews.authorization.openshift.io           []                 []              [create]
  subjectaccessreviews.authorization.openshift.io            []                 []              [create]
  subjectrulesreviews.authorization.openshift.io             []                 []              [create]
  buildconfigs.build.openshift.io/instantiate                []                 []              [create]
  buildconfigs.build.openshift.io/instantiatebinary          []                 []              [create]
  builds.build.openshift.io/clone                            []                 []              [create]
  imagestreamimports.image.openshift.io                      []                 []              [create]
  routes.route.openshift.io/custom-host                      []                 []              [create]
  podsecuritypolicyreviews.security.openshift.io             []                 []              [create]
  podsecuritypolicyselfsubjectreviews.security.openshift.io  []                 []              [create]
  podsecuritypolicysubjectreviews.security.openshift.io      []                 []              [create]
  jenkins.build.openshift.io                                 []                 []              [edit view view admin edit view]
  builds                                                     []                 []              [get create delete deletecollection get list patch update watch get list watch]
  builds.build.openshift.io                                  []                 []              [get create delete deletecollection get list patch update watch get list watch]
  projects                                                   []                 []              [get delete get delete get patch update]
  projects.project.openshift.io                              []                 []              [get delete get delete get patch update]
  namespaces                                                 []                 []              [get get list watch]
  pods/attach                                                []                 []              [get list watch create delete deletecollection patch update]
  pods/exec                                                  []                 []              [get list watch create delete deletecollection patch update]
  pods/portforward                                           []                 []              [get list watch create delete deletecollection patch update]
  pods/proxy                                                 []                 []              [get list watch create delete deletecollection patch update]
  services/proxy                                             []                 []              [get list watch create delete deletecollection patch update]
  routes/status                                              []                 []              [get list watch update]
  routes.route.openshift.io/status                           []                 []              [get list watch update]
  appliedclusterresourcequotas                               []                 []              [get list watch]
  bindings                                                   []                 []              [get list watch]
  builds/log                                                 []                 []              [get list watch]
  deploymentconfigs/log                                      []                 []              [get list watch]
  deploymentconfigs/status                                   []                 []              [get list watch]
  events                                                     []                 []              [get list watch]
  imagestreams/status                                        []                 []              [get list watch]
  limitranges                                                []                 []              [get list watch]
  namespaces/status                                          []                 []              [get list watch]
  pods/log                                                   []                 []              [get list watch]
  pods/status                                                []                 []              [get list watch]
  replicationcontrollers/status                              []                 []              [get list watch]
  resourcequotas/status                                      []                 []              [get list watch]
  resourcequotas                                             []                 []              [get list watch]
  resourcequotausages                                        []                 []              [get list watch]
  rolebindingrestrictions                                    []                 []              [get list watch]
  deploymentconfigs.apps.openshift.io/log                    []                 []              [get list watch]
  deploymentconfigs.apps.openshift.io/status                 []                 []              [get list watch]
  controllerrevisions.apps                                   []                 []              [get list watch]
  rolebindingrestrictions.authorization.openshift.io         []                 []              [get list watch]
  builds.build.openshift.io/log                              []                 []              [get list watch]
  imagestreams.image.openshift.io/status                     []                 []              [get list watch]
  appliedclusterresourcequotas.quota.openshift.io            []                 []              [get list watch]
  imagestreams/layers                                        []                 []              [get update get]
  imagestreams.image.openshift.io/layers                     []                 []              [get update get]
  builds/details                                             []                 []              [update]
  builds.build.openshift.io/details                          []                 []              [update]


Name:         basic-user
Labels:       <none>
Annotations:  openshift.io/description: A user that can get basic information about projects.
	              rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
	Resources                                           Non-Resource URLs  Resource Names  Verbs
	  ---------                                           -----------------  --------------  -----
	  selfsubjectrulesreviews                             []                 []              [create]
	  selfsubjectaccessreviews.authorization.k8s.io       []                 []              [create]
	  selfsubjectrulesreviews.authorization.openshift.io  []                 []              [create]
	  clusterroles.rbac.authorization.k8s.io              []                 []              [get list watch]
	  clusterroles                                        []                 []              [get list]
	  clusterroles.authorization.openshift.io             []                 []              [get list]
	  storageclasses.storage.k8s.io                       []                 []              [get list]
	  users                                               []                 [~]             [get]
	  users.user.openshift.io                             []                 [~]             [get]
	  projects                                            []                 []              [list watch]
	  projects.project.openshift.io                       []                 []              [list watch]
	  projectrequests                                     []                 []              [list]
	  projectrequests.project.openshift.io                []                 []              [list]

Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
Resources  Non-Resource URLs  Resource Names  Verbs
---------  -----------------  --------------  -----
*.*        []                 []              [*]
           [*]                []              [*]

...

  2. 要查看当前的集群角色绑定集，该集合显示绑定到各种角色的用户和组

    $ oc describe clusterrolebinding.rbac
    示例输出
    Name:         alertmanager-main
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  alertmanager-main
Subjects:
  Kind            Name               Namespace
  ----            ----               ---------
  ServiceAccount  alertmanager-main  openshift-monitoring


Name:         basic-users
Labels:       <none>
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  basic-user
Subjects:
  Kind   Name                  Namespace
  ----   ----                  ---------
  Group  system:authenticated


Name:         cloud-credential-operator-rolebinding
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  cloud-credential-operator-role
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  default  openshift-cloud-credential-operator


Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind   Name            Namespace
  ----   ----            ---------
  Group  system:masters


Name:         cluster-admins
Labels:       <none>
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind   Name                   Namespace
  ----   ----                   ---------
  Group  system:cluster-admins
  User   system:admin


Name:         cluster-api-manager-rolebinding
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  cluster-api-manager-role
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  default  openshift-machine-api

...

查看本地角色和绑定

您可以使用oc CLI 通过使用oc describe命令来查看本地角色和绑定。

先决条件

  • 安装oc CLI。

  • 获得查看本地角色和绑定的权限

    • 在本地绑定了admin默认集群角色的用户可以查看和管理该项目中的角色和绑定。

步骤

  1. 要查看当前的本地角色绑定集，该集合显示绑定到当前项目中各种角色的用户和组

    $ oc describe rolebinding.rbac

  2. 要查看不同项目的本地角色绑定，请在命令中添加-n标志。

    $ oc describe rolebinding.rbac -n joe-project
    示例输出
    Name:         admin
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  admin
Subjects:
  Kind  Name        Namespace
  ----  ----        ---------
  User  kube:admin


Name:         system:deployers
Labels:       <none>
Annotations:  openshift.io/description:
                Allows deploymentconfigs in this namespace to rollout pods in
                this namespace.  It is auto-managed by a controller; remove
                subjects to disa...
Role:
  Kind:  ClusterRole
  Name:  system:deployer
Subjects:
  Kind            Name      Namespace
  ----            ----      ---------
  ServiceAccount  deployer  joe-project


Name:         system:image-builders
Labels:       <none>
Annotations:  openshift.io/description:
                Allows builds in this namespace to push images to this
                namespace.  It is auto-managed by a controller; remove subjects
                to disable.
Role:
  Kind:  ClusterRole
  Name:  system:image-builder
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  builder  joe-project


Name:         system:image-pullers
Labels:       <none>
Annotations:  openshift.io/description:
                Allows all pods in this namespace to pull images from this
                namespace.  It is auto-managed by a controller; remove subjects
                to disable.
Role:
  Kind:  ClusterRole
  Name:  system:image-puller
Subjects:
  Kind   Name                                Namespace
  ----   ----                                ---------
  Group  system:serviceaccounts:joe-project

向用户添加角色

您可以使用oc adm管理员CLI来管理角色和绑定。

将角色绑定或添加到用户或组，会赋予该用户或组角色授予的访问权限。您可以使用oc adm policy命令向用户和组添加和删除角色。

您可以将任何默认集群角色绑定到项目中的本地用户或组。

步骤

  1. 向特定项目中的用户添加角色

    $ oc adm policy add-role-to-user <role> <user> -n <project>

    例如，您可以通过运行以下命令，将admin角色添加到joe项目中的alice用户：

    $ oc adm policy add-role-to-user admin alice -n joe

    或者，您可以应用以下YAML来将角色添加到用户：

    apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: admin-0
  namespace: joe
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: alice

  2. 查看本地角色绑定并验证输出中的添加结果。

    $ oc describe rolebinding.rbac -n <project>

    例如，要查看joe项目的本地角色绑定：

    $ oc describe rolebinding.rbac -n joe
    示例输出
    
Name:         admin
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  admin
Subjects:
  Kind  Name        Namespace
  ----  ----        ---------
  User  kube:admin


Name:         admin-0
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  admin
Subjects:
  Kind  Name   Namespace
  ----  ----   ---------
  User  alice (1)


Name:         system:deployers
Labels:       <none>
Annotations:  openshift.io/description:
                Allows deploymentconfigs in this namespace to rollout pods in
                this namespace.  It is auto-managed by a controller; remove
                subjects to disa...
Role:
  Kind:  ClusterRole
  Name:  system:deployer
Subjects:
  Kind            Name      Namespace
  ----            ----      ---------
  ServiceAccount  deployer  joe


Name:         system:image-builders
Labels:       <none>
Annotations:  openshift.io/description:
                Allows builds in this namespace to push images to this
                namespace.  It is auto-managed by a controller; remove subjects
                to disable.
Role:
  Kind:  ClusterRole
  Name:  system:image-builder
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  builder  joe


Name:         system:image-pullers
Labels:       <none>
Annotations:  openshift.io/description:
                Allows all pods in this namespace to pull images from this
                namespace.  It is auto-managed by a controller; remove subjects
                to disable.
Role:
  Kind:  ClusterRole
  Name:  system:image-puller
Subjects:
  Kind   Name                                Namespace
  ----   ----                                ---------
  Group  system:serviceaccounts:joe
    1 alice用户已添加到admins RoleBinding中。

创建本地角色

您可以为项目创建本地角色，然后将其绑定到用户。

步骤

  1. 要为项目创建本地角色，请运行以下命令：

    $ oc create role <name> --verb=<verb> --resource=<resource> -n <project>

    在此命令中，请指定：

    • <name>，本地角色的名称

    • <verb>，应用于角色的动词的逗号分隔列表

    • <resource>，角色适用的资源

    • <project>，项目名称

    例如，要创建一个允许用户查看blue项目中 Pod 的本地角色，请运行以下命令：

    $ oc create role podview --verb=get --resource=pod -n blue

  2. 要将新角色绑定到用户，请运行以下命令：

    $ oc adm policy add-role-to-user podview user2 --role-namespace=blue -n blue

本地角色绑定命令

当您使用以下操作管理用户的关联角色（用于本地角色绑定）时，可以使用-n标志指定项目。如果没有指定，则使用当前项目。

您可以使用以下命令进行本地RBAC管理。

表1. 本地角色绑定操作
命令 描述

$ oc adm policy who-can <verb> <resource>

指示哪些用户可以对资源执行操作。

$ oc adm policy add-role-to-user <role> <username>

将指定的角色绑定到当前项目中的指定用户。

$ oc adm policy remove-role-from-user <role> <username>

从当前项目中的指定用户中删除给定的角色。

$ oc adm policy remove-user <username>

删除当前项目中的指定用户及其所有角色。

$ oc adm policy add-role-to-group <role> <groupname>

将给定的角色绑定到当前项目中的指定组。

$ oc adm policy remove-role-from-group <role> <groupname>

从当前项目中的指定组中删除给定的角色。

$ oc adm policy remove-group <groupname>

删除当前项目中的指定组及其所有角色。

集群角色绑定命令

您还可以使用以下操作管理集群角色绑定。这些操作不使用-n标志，因为集群角色绑定使用非命名空间资源。

表2. 集群角色绑定操作
命令 描述

$ oc adm policy add-cluster-role-to-user <role> <username>

将给定的角色绑定到集群中所有项目的指定用户。

$ oc adm policy remove-cluster-role-from-user <role> <username>

从集群中所有项目的指定用户中删除给定的角色。

$ oc adm policy add-cluster-role-to-group <role> <groupname>

将给定的角色绑定到集群中所有项目的指定组。

$ oc adm policy remove-cluster-role-from-group <role> <groupname>

从集群中所有项目的指定组中删除给定的角色。

授予用户管理员权限

为集群配置身份提供者并将用户添加到身份提供者后，您可以向用户授予dedicated-admin集群权限。

先决条件

  • 您已登录到OpenShift 集群管理器。

  • 您已创建了一个OpenShift Dedicated集群。

  • 您已为集群配置了身份提供者。

步骤

  1. 导航到OpenShift 集群管理器并选择您的集群。

  2. 点击“访问控制”选项卡。

  3. 在“集群角色和访问”选项卡中，点击“添加用户”。

  4. 输入身份提供者用户的用户 ID。

  5. 点击“添加用户”以向用户授予dedicated-admin集群权限。

验证

  • 授予权限后，用户将在集群的OpenShift 集群管理器页面上的“访问控制”→“集群角色和访问”下作为dedicated-admins组的一部分列出。

未经身份验证的组的集群角色绑定

在OpenShift Dedicated 4.17之前，未经身份验证的组被允许访问某些集群角色。从OpenShift Dedicated 4.17之前的版本更新的集群保留了未经身份验证的组对此访问权限。

出于安全原因，OpenShift Dedicated不允许未经身份验证的组默认访问集群角色。

在某些情况下，可能需要将system:unauthenticated添加到集群角色。

集群管理员可以将未经身份验证的用户添加到以下集群角色：

  • system:scope-impersonation

  • system:webhook

  • system:oauth-token-deleter

  • self-access-reviewer

修改未经身份验证的访问权限时，请务必验证是否符合您组织的安全标准。