ServiceAccount auditor in namespace finance may get, list and watch Pods and read pod logs, but may not modify workloads.
Simulateur déterministe — tape une commande (kubectl get pods -A) pour commencer.
student@kubelab:~$
Objectifs
- Create ServiceAccount auditor
- Create Role pod-auditor for pods and pods/log
- Create RoleBinding in finance
- Verify allowed and denied actions
Étapes suggérées
- pods/log is a subresource.
- Keep the binding namespaced.
- Use --as to test.
Indices
Voir la solution
kubectl create serviceaccount auditor -n finance kubectl create role pod-auditor -n finance --verb=get,list,watch --resource=pods,pods/log kubectl create rolebinding auditor -n finance --role=pod-auditor --serviceaccount=finance:auditor kubectl auth can-i delete pod -n finance --as=system:serviceaccount:finance:auditor