常用的clusterrole

1、用于存储类的clusterrole

#用于对存储类的增上改查登操作
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: openebs-storage-class-role
rules:
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
#

[root@master efk]# kubectl get ClusterRole -n kube-system |grep view
cluster-viewer      2023-11-27T17:26:00Z   #此cluster-view用于列出集群级别的

2、一般用于pod和svc的clusterrole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-role-zn
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list", "create", "update", "delete"]

使用：

role、clusterrole的角色在使用时，需要先创建一个sa，然后再做role、clusterrole的（role|clusterrole[binding]）角色绑定，一个sa可以绑定多个role，或者多个clusterrole。