限制ServiceAccount /角色来管理所有集群中的机密

Question

我试图限制ServiceAccount的RBAC权限来管理所有命名空间中的秘密：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitlab-secrets-manager
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  resourceNames:
  - gitlab-registry
  verbs:
  - get
  - list
  - create
  - update
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-service-account
  namespace: gitlab
secrets:
- name: gitlab-service-account-token-lllll
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-service-account-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gitlab-secrets-manager
subjects:
- kind: ServiceAccount
  name: gitlab-service-account
  namespace: gitlab

到目前为止，我已经创建了ServiceAccount和相关的CRB，但是，操作失败了：

secrets "gitlab-registry" is forbidden: User "system:serviceaccount:gitlab:default" cannot get resource "secrets" in API group "" in the namespace "shamil"

有人知道我错过了什么吗？

Answer 1

您可以执行以下步骤：

首先，需要确保集群中名为

• 的服务帐户gitlab-service-account存在。

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitlab-secrets-manager
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - gitlab-registry
    verbs:
      - get
      - list
      - create
      - update

然后，您还将创建一个在集群级别授予权限的

• .

。

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-secrets-manager-clusterrolebinding
subjects:
  - kind: ServiceAccount
    name: gitlab-service-account    
    namespace: gitlab
roleRef:
  kind: ClusterRole
  name: gitlab-secrets-manager
  apiGroup: rbac.authorization.k8s.io