Configuring RBAC Authorization

kubectl create serviceaccount deployer -n ci

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { namespace: prod, name: pod-reader }
rules:
- apiGroups: [""]
  resources: [pods, pods/log]
  verbs: [get, list, watch]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata: { name: node-viewer }
rules:
- apiGroups: [""]
  resources: [nodes]
  verbs: [get, list, watch]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { namespace: prod, name: deployer-can-read }
subjects:
- { kind: ServiceAccount, name: deployer, namespace: ci }
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader

kubectl create clusterrolebinding admin-bind \
  --clusterrole=cluster-admin --user=alice@example.com

kubectl get rolebindings,clusterrolebindings -A -o wide
kubectl describe clusterrole view

kubectl auth can-i create deployments -n prod
kubectl auth can-i list pods --as=system:serviceaccount:ci:deployer -n prod
kubectl auth can-i --list --as=alice

rules:
- apiGroups: [""]
  resources: [configmaps]
  resourceNames: [app-config]
  verbs: [get, update]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups: [monitoring.coreos.com]
  resources: [prometheuses, alertmanagers]
  verbs: [get, list, watch]