---
# System prepended metadata

title: D1C2 Auth & RBAC
tags: [CKS Day1]

---

# D1C2 Auth & RBAC
###### tags: `CKS Day1`

## RBAC
创建SA在Default ns中
```
kubectl create sa kangming
```
创建Role, 在default ns中
```
kubectl create role ns:default:pod --verb=get,list --resource=pods
```
关联权限到default ns下的SA: kangming
```
kubectl create rolebinding kangming-rb --role=ns:default:pod --serviceaccount=default:kangming
```
验证权限
```
kubectl auth can-i create pods --as=system:serviceaccount:default:kangming
```

```
kubectl auth can-i get pvc --as bob
```

授权某NS下所有的SA
```
kubectl create clusterrolebinding kangming-crb --clusterrole=view --group=system:serviceaccounts:default
```