| ServiceAccount | Pod 的集群内身份；默认 SA 权限应最小 |
|---|---|
| Role | 命名空间内权限：apiGroups/resources/verbs |
| ClusterRole | 集群级权限（节点、PV、CRD 等）或跨命名空间复用 |
| 绑定 | RoleBinding 授权到主体；ClusterRoleBinding 全集群生效 |
| 审计 | kubectl auth can-i --as=system:serviceaccount:<ns>:<sa> |
最小权限示例
最小权限示例
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: dev
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ci-read
namespace: dev
subjects:
- kind: ServiceAccount
name: ci-bot
namespace: dev
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
别用 cluster-admin 给 CI/机器人：一个凭据泄露等于整个集群沦陷；按命名空间+动词最小授权。