我希望 kubernetes 中的部署具有从集群内自行重启的权限。
我知道我可以创建一个 serviceaccount 并将其绑定(bind)到 pod,但我缺少最具体权限的名称(即不只是允许 '*'
)以允许命令
kubectl rollout restart deploy <deployment>
这就是我所拥有的,以及 ???正是我所缺少的
apiVersion: v1
kind: ServiceAccount
metadata:
name: restart-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: default
name: restarter
rules:
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["list", "???"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: testrolebinding
namespace: default
subjects:
- kind: ServiceAccount
name: restart-sa
namespace: default
roleRef:
kind: Role
name: restarter
apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Pod
metadata:
name: example
spec:
containers:
- image: nginx
name: nginx
serviceAccountName: restart-sa
最佳答案
我相信以下是重新启动部署所需的最低权限:
rules:
- apiGroups: ["apps", "extensions"]
resources: ["deployments"]
resourceNames: [$DEPLOYMENT]
verbs: ["get", "patch"]
关于kubernetes - 是否有允许命令 `kubectl rollout restart deploy <deployment>` 的 kubernetes 角色定义?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/68973803/