Merge pull request #49688 from my-git9/np-11076
[zh-cn]sync rbac validating-admission-policypull/50351/head^2
Kubernetes Prow Robot
GitHub
commit
c1732d6843
|
|
@ -151,30 +151,7 @@ Here's an example Role in the "default" namespace that can be used to grant read
|
|||
下面是一个位于 "default" 名字空间的 Role 的示例，可用来授予对
|
||||
{{< glossary_tooltip text="Pod" term_id="pod" >}} 的读访问权限：
|
||||
|
||||
<!--
|
||||
```yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
namespace: default
|
||||
name: pod-reader
|
||||
rules:
|
||||
- apiGroups: [""] # "" indicates the core API group
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
```
|
||||
-->
|
||||
```yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
namespace: default
|
||||
name: pod-reader
|
||||
rules:
|
||||
- apiGroups: [""] # "" 标明 core API 组
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
```
|
||||
{{% code_sample file="access/simple-role.yaml" %}}
|
||||
|
||||
<!--
|
||||
#### ClusterRole example
|
||||
|
|
@ -209,35 +186,6 @@ or across all namespaces (depending on how it is [bound](#rolebinding-and-cluste
|
|||
{{< glossary_tooltip text="Secret" term_id="secret" >}} 授予读访问权限，
|
||||
或者跨名字空间的访问权限（取决于该角色是如何[绑定](#rolebinding-and-clusterrolebinding)的）：
|
||||
|
||||
<!--
|
||||
```yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
# "namespace" omitted since ClusterRoles are not namespaced
|
||||
name: secret-reader
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
#
|
||||
# at the HTTP level, the name of the resource for accessing Secret
|
||||
# objects is "secrets"
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
```
|
||||
-->
|
||||
```yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
# "namespace" 被忽略，因为 ClusterRoles 不受名字空间限制
|
||||
name: secret-reader
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
# 在 HTTP 层面，用来访问 Secret 资源的名称为 "secrets"
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
```
|
||||
|
||||
<!--
|
||||
The name of a Role or a ClusterRole object must be a valid
|
||||
[path segment name](/docs/concepts/overview/working-with-objects/names#path-segment-names).
|
||||
|
|
@ -270,7 +218,7 @@ RoleBinding 在指定的名字空间中执行授权，而 ClusterRoleBinding 在
|
|||
一个 RoleBinding 可以引用同一的名字空间中的任何 Role。
|
||||
或者，一个 RoleBinding 可以引用某 ClusterRole 并将该 ClusterRole 绑定到
|
||||
RoleBinding 所在的名字空间。
|
||||
如果你希望将某 ClusterRole 绑定到集群中所有名字空间，你要使用 ClusterRoleBinding。
|
||||
如果你希望将某 ClusterRole 绑定到集群中所有名字空间，你要使用 ClusterRoleBinding。
|
||||
|
||||
RoleBinding 或 ClusterRoleBinding 对象的名称必须是合法的
|
||||
[路径分段名称](/zh-cn/docs/concepts/overview/working-with-objects/names#path-segment-names)。
|
||||
|
|
|
|||
|
|
@ -496,7 +496,7 @@ variables as well as some other useful variables:
|
|||
|
||||
`spec.validations[i].expression` 代表将使用 CEL 来计算表达式。
|
||||
要了解更多信息，请参阅 [CEL 语言规范](https://github.com/google/cel-spec)。
|
||||
CEL 表达式可以访问按 CEL 变量来组织的 Admission 请求/响应的内容，以及其他一些有用的变量 :
|
||||
CEL 表达式可以访问按 CEL 变量来组织的 Admission 请求/响应的内容，以及其他一些有用的变量：
|
||||
|
||||
<!--
|
||||
- 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
|
|
@ -922,3 +922,26 @@ The error message is similar to this.
|
|||
```console
|
||||
error: failed to create deployment: deployments.apps "invalid" is forbidden: ValidatingAdmissionPolicy 'image-matches-namespace-environment.policy.example.com' with binding 'demo-binding-test.example.com' denied request: only prod images are allowed in namespace default
|
||||
```
|
||||
|
||||
<!--
|
||||
## API kinds exempt from admission validation
|
||||
|
||||
There are certain API kinds that are exempt from admission-time validation checks. For example, you can't create a ValidatingAdmissionPolicy that prevents changes to ValidatingAdmissionPolicyBindings.
|
||||
|
||||
The list of exempt API kinds is:
|
||||
-->
|
||||
## 免于准入验证的 API 类别
|
||||
|
||||
某些 API 类别可以豁免准入时验证检查。例如，你无法创建阻止更改 ValidatingAdmissionPolicyBindings
|
||||
的 ValidatingAdmissionPolicy。
|
||||
|
||||
豁免准入验证的 API 类别列表如下：
|
||||
|
||||
* [ValidatingAdmissionPolicies]({{< relref "/docs/reference/kubernetes-api/policy-resources/validating-admission-policy-v1/" >}})
|
||||
* [ValidatingAdmissionPolicyBindings]({{< relref "/docs/reference/kubernetes-api/policy-resources/validating-admission-policy-binding-v1/" >}})
|
||||
* MutatingAdmissionPolicies
|
||||
* MutatingAdmissionPolicyBindings
|
||||
* [TokenReviews]({{< relref "/docs/reference/kubernetes-api/authentication-resources/token-review-v1/" >}})
|
||||
* [LocalSubjectAccessReviews]({{< relref "/docs/reference/kubernetes-api/authorization-resources/local-subject-access-review-v1/" >}})
|
||||
* [SelfSubjectAccessReviews]({{< relref "/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1/" >}})
|
||||
* [SelfSubjectReviews]({{< relref "/docs/reference/kubernetes-api/authentication-resources/self-subject-review-v1/" >}})
|
||||
|
|
|
|||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
# "namespace" 被忽略，因为 ClusterRoles 不受名字空间限制
|
||||
name: secret-reader
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
# 在 HTTP 层面，用来访问 Secret 资源的名称为 "secrets"
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
namespace: default
|
||||
name: pod-reader
|
||||
rules:
|
||||
- apiGroups: [""] # "" 标明 core API 组
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
Loading…
Reference in New Issue