{"id":35921,"date":"2022-11-23T10:57:13","date_gmt":"2023-03-03T21:29:05","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/"},"modified":"2024-04-29T02:06:39","modified_gmt":"2024-04-28T18:06:39","slug":"%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/","title":{"rendered":"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a – 15. \u5b89\u5168\u6027 –"},"content":{"rendered":"

\u30b9\u30c8\u30fc\u30ea\u30fc<\/h1>\n
    \n
  1. \n
      \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 01. \u74b0\u5883\u9078\u629e\u7de8 –<\/ol>\n<\/li>\n<\/ol>\n

       <\/p>\n

        \n
      1. \n
          \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 02. Docker For Mac –<\/ol>\n<\/li>\n<\/ol>\n

           <\/p>\n

            \n
          1. \n
              \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 03. Raspberry Pi –<\/ol>\n<\/li>\n<\/ol>\n

               <\/p>\n

                \n
              1. \n
                  \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 04. kubectl –<\/ol>\n<\/li>\n<\/ol>\n

                   <\/p>\n

                    \n
                  1. \n
                      \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 05. workloads \u305d\u306e1 –<\/ol>\n<\/li>\n<\/ol>\n

                       <\/p>\n

                        \n
                      1. \n
                          \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 06. workloads \u305d\u306e2 –<\/ol>\n<\/li>\n<\/ol>\n

                           <\/p>\n

                            \n
                          1. \n
                              \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 07. workloads \u305d\u306e3 –<\/ol>\n<\/li>\n<\/ol>\n

                               <\/p>\n

                                \n
                              1. \n
                                  \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 08. discovery&LB \u305d\u306e1 –<\/ol>\n<\/li>\n<\/ol>\n

                                   <\/p>\n

                                    \n
                                  1. \n
                                      \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 09. discovery&LB \u305d\u306e2 –<\/ol>\n<\/li>\n<\/ol>\n

                                       <\/p>\n

                                        \n
                                      1. \n
                                          \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 10. config&storage \u305d\u306e1 –<\/ol>\n<\/li>\n<\/ol>\n

                                           <\/p>\n

                                            \n
                                          1. \n
                                              \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 11. config&storage \u305d\u306e2 –<\/ol>\n<\/li>\n<\/ol>\n

                                               <\/p>\n

                                                \n
                                              1. \n
                                                  \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 12. \u30ea\u30bd\u30fc\u30b9\u5236\u9650 –<\/ol>\n<\/li>\n<\/ol>\n

                                                   <\/p>\n

                                                    \n
                                                  1. \n
                                                      \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 13. \u30d8\u30eb\u30b9\u30c1\u30a7\u30c3\u30af\u3068\u30b3\u30f3\u30c6\u30ca\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb –<\/ol>\n<\/li>\n<\/ol>\n

                                                       <\/p>\n

                                                        \n
                                                      1. \n
                                                          \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 14. \u30b9\u30b1\u30b8\u30e5\u30fc\u30ea\u30f3\u30b0 –<\/ol>\n<\/li>\n<\/ol>\n

                                                           <\/p>\n

                                                            \n
                                                          1. \n
                                                              \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 15. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 –<\/ol>\n<\/li>\n<\/ol>\n

                                                               <\/p>\n

                                                                \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 16. \u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8 –<\/ol>\n

                                                                \u4e0a\u6b21<\/h1>\n

                                                                \u5f00\u59cb\u5b66\u4e60Kubernetes\u65f6\u843d\u540e\u4e86\u4e00\u6b65 – \u5728\u7b2c14\u7ae0\u8c03\u5ea6\u4e2d\uff0c\u6211\u4eec\u5b66\u4e60\u4e86\u6709\u5173\u4f7f\u7528\u4eb2\u548c\u6027\u7b49\u8fdb\u884cPod\u8c03\u5ea6\u7684\u5185\u5bb9\u3002\u73b0\u5728\uff0c\u6211\u4eec\u5c06\u5b66\u4e60\u6709\u5173\u5b89\u5168\u6027\u7684\u5185\u5bb9\u3002<\/p>\n

                                                                \u670d\u52a1\u8d26\u6237<\/h1>\n

                                                                \u636e\u8bf4\u4e3a\u4e86\u63a7\u5236\u5728Pod\u4e2d\u6267\u884c\u7684\u8fdb\u7a0b\uff0c\u88ab\u5206\u914d\u7684\u5e10\u6237\u88ab\u79f0\u4e3a\u670d\u52a1\u5e10\u6237\u3002<\/p>\n

                                                                apiVersion<\/span>:<\/span> v1<\/span>\r\nkind<\/span>:<\/span> ServiceAccount<\/span>\r\nmetadata<\/span>:<\/span>\r\n  name<\/span>:<\/span> sample-serviceaccount<\/span>\r\n  namespace<\/span>:<\/span> default<\/span>\r\nimagePullSecrets<\/span>:<\/span>\r\n  -<\/span> name<\/span>:<\/span> hogehoge<\/span>\r\n<\/code><\/pre>\n
                                                                \u6211\u4f1a\u8bd5\u7740\u7533\u8bf7\u8fd9\u4e2a\u3002<\/p>\n
                                                                pi@raspi001:~\/tmp $<\/span> k apply -f<\/span> sample-serviceaccount.yaml\r\npi@raspi001:~\/tmp $<\/span> k get serviceaccounts sample-serviceaccount -o<\/span> yaml\r\n...\r\n<\/span>secrets:\r\n- name: sample-serviceaccount-token-4xhgm\r\n<\/span><\/code><\/pre>\n
                                                                \u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u304c\u4f5c\u6210\u3055\u308c\u307e\u3057\u305f\u3002\u307e\u305f\u3001imagePullSecrets\u306e\u5185\u5bb9\u304csecrets\u306b\u767b\u9332\u3055\u308c\u307e\u3057\u305f\u3002(sample-serviceaccount-token-4xhgm)
                                                                \nimagePullSecrets\u306fprivate\u306adocker\u30ec\u30b8\u30b9\u30c8\u30ea\u306b\u4f7f\u3044\u307e\u3059\u3002<\/p>\n
                                                                pi@raspi001:~\/tmp $<\/span> k get secrets sample-serviceaccount-token-4xhgm -o<\/span> yaml\r\napiVersion: v1\r\ndata:\r\n  ca.crt: ...\r\n  namespace: ZGVmYXVsdA==\r\n  token: ...\r\nkind: Secret\r\nmetadata:\r\n  annotations:\r\n    kubernetes.io\/service-account.name: sample-serviceaccount\r\n    kubernetes.io\/service-account.uid: 4bd076da-8854-11e9-af26-b827eb8ccd80\r\n  creationTimestamp: \"2019-06-06T12:12:04Z\"\r\n  name: sample-serviceaccount-token-4xhgm\r\n  namespace: default\r\n  resourceVersion: \"584634\"\r\n  selfLink: \/api\/v1\/namespaces\/default\/secrets\/sample-serviceaccount-token-4xhgm\r\n  uid: 4bfbe8bb-8854-11e9-af26-b827eb8ccd80\r\ntype: kubernetes.io\/service-account-token\r\n<\/span><\/code><\/pre>\n
                                                                \u4f60\u5df2\u7ecf\u6ce8\u518c\u4e86\u5fc5\u8981\u7684\u8ba4\u8bc1\u4ee4\u724c\u3002<\/p>\n
                                                                \u57fa\u4e8e\u89d2\u8272\u7684\u8bbf\u95ee\u63a7\u5236\uff08RBAC\uff09<\/h1>\n
                                                                RBAC\u5c06\u521b\u5efa\u7684\u670d\u52a1\u8d26\u6237\u4e0e\u6240\u5141\u8bb8\u7684\u64cd\u4f5c\u76f8\u5173\u8054\uff0c\u901a\u8fc7\u89d2\u8272\u7ed1\u5b9a(RoleBinding)\u6765\u8fdb\u884c\u6743\u9650\u7ba1\u7406\u3002\u53ef\u4ee5\u901a\u8fc7\u89d2\u8272\u7ed1\u5b9a\u5c06\u591a\u4e2a\u670d\u52a1\u8d26\u6237\u7ed1\u5b9a\u5230\u4e00\u4e2a\u89d2\u8272\u4e0a\u3002<\/p>\n
                                                                RBAC\u6709\u4e24\u4e2a\u5c42\u7ea7\uff0c\u4e00\u4e2a\u662f\u547d\u540d\u7a7a\u95f4\u7ea7\u522b\uff0c\u53e6\u4e00\u4e2a\u662f\u96c6\u7fa4\u7ea7\u522b\u3002
                                                                \n\u96c6\u7fa4\u7ea7\u522b\u7684\u8bbe\u7f6e\u8303\u56f4\u66f4\u5927\u4e00\u4e9b\u3002\uff08\u5982\u679c\u8981\u8de8\u547d\u540d\u7a7a\u95f4\u8fdb\u884c\u8bbe\u7f6e\uff0c\u5219\u5e94\u9009\u62e9\u96c6\u7fa4\u7ea7\u522b\u3002\uff09<\/p>\n
                                                                  \n
                                                                • \n
                                                                    Role\u3068ClusterRole<\/ul>\n<\/li>\n<\/ul>\n
                                                                     <\/p>\n
                                                                      RoleBinding\u3068ClusterRoleBinding<\/ul>\n
                                                                      \u64cd\u4f5c\u306e\u7a2e\u985e\u3067\u3059\u304c\u3001\u3069\u306eDeployment\u3084DaemonSet\u306e\u3088\u3046\u306a\u30ea\u30bd\u30fc\u30b9\u306b\u5bfe\u3057\u3066\u4e0b\u8a18\u306e\u3082\u306e\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
                                                                      \n
                                                                      *\u5168\u3066\u306e\u51e6\u7406create\u4f5c\u6210delete\u524a\u9664get\u53d6\u5f97list\u4e00\u89a7\u53d6\u5f97update\u66f4\u65b0patch\u4e00\u90e8\u5909\u66f4watch\u5909\u66f4\u306e\u8ffd\u5f93<\/div>\n<\/div>\n
                                                                      \u5173\u4e8eKubernetes\u7684RBAC<\/p>\n
                                                                      \u6b64\u6b21\u5c06\u53c2\u8003 Kubernetes \u9053\u573a\u7b2c20\u5929\u7684\u5185\u5bb9 – \u89d2\u8272\/\u89d2\u8272\u7ed1\u5b9a\/\u96c6\u7fa4\u89d2\u8272\/\u96c6\u7fa4\u89d2\u8272\u7ed1\u5b9a\u3002<\/p>\n
                                                                      \u6211\u5c06\u4f7f\u7528\u65b0\u521b\u5efa\u7684\u670d\u52a1\u8d26\u6237\u521b\u5efa\u4e00\u4e2a\u4e0a\u4e0b\u6587\uff0c\u5e76\u5c1d\u8bd5\u4ece\u8be5\u8d26\u6237\u4e2d\u83b7\u53d6Pod\u4fe1\u606f\u3002
                                                                      \n\u4e3a\u6b64\uff0c\u9700\u8981\u901a\u8fc7\u670d\u52a1\u8d26\u6237\u7684\u8ba4\u8bc1\u4fe1\u606f\u8fdb\u884c\u9884\u5148\u914d\u7f6e\u3002
                                                                      \n\u203b \u7531\u4e8e”Role”\u548c”ClusterRole”\u4e4b\u95f4\u6ca1\u6709\u592a\u5927\u533a\u522b\uff0c\u56e0\u6b64\u6211\u5c06\u5c1d\u8bd5\u4f7f\u7528”Role”\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> TOKEN<\/span>=<\/span>$(<\/span>k get secret\/sample-serviceaccount-token-jd279 -o<\/span> json | jq -r<\/span> .data.token)<\/span>\r\npi@raspi001:~\/tmp $<\/span> DECODE_TOKEN<\/span>=<\/span>$(<\/span>echo<\/span> -n<\/span> $TOKEN<\/span> | base64<\/span> -d<\/span>)<\/span>\r\npi@raspi001:~\/tmp $<\/span> k config set-credentials sample-serviceaccount --token<\/span> $DECODE_TOKEN<\/span>\r\n<\/code><\/pre>\n
                                                                      \u7136\u540e\uff0c\u521b\u5efa\u4e00\u4e2a\u4e0a\u4e0b\u6587\uff08sample-sa-context\uff09\u5e76\u4f7f\u7528\u5b83\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k config set-context sample-sa-context --user<\/span> sample-serviceaccount --cluster<\/span> kubernetes\r\npi@raspi001:~\/tmp $<\/span> k config use-context sample-sa-context\r\npi@raspi001:~\/tmp $<\/span> k config get-contexts\r\nCURRENT   NAME                          CLUSTER      AUTHINFO                NAMESPACE\r\n          kubernetes-admin@kubernetes   kubernetes   kubernetes-admin\r\n*         sample-sa-context             kubernetes   sample-serviceaccount\r\n<\/span><\/code><\/pre>\n
                                                                      \u6211\u4f1a\u5c1d\u8bd5\u4f7f\u7528\u65b0\u521b\u5efa\u7684\u670d\u52a1\u5e10\u6237\u6765\u83b7\u53d6Pod\u7684\u4fe1\u606f\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k get po\r\nError from server (Forbidden): pods is forbidden: User \"system:serviceaccount:default:sample-serviceaccount\" cannot list resource \"pods\" in API group \"\" in the namespace \"default\"\r\n<\/span><\/code><\/pre>\n
                                                                      \u53d1\u751f\u9519\u8bef\u4e86\u3002\u8fd9\u662f\u56e0\u4e3a”sample-serviceaccount”\u6ca1\u6709\u7ed1\u5b9a\u4efb\u4f55\u89d2\u8272\u3002
                                                                      \n\u597d\u7684\uff0c\u6211\u4eec\u6765\u505aRole\u7ed1\u5b9a\u3002<\/p>\n
                                                                      \u6211\u5c06\u56de\u5230\u539f\u6765\u7684\u72b6\u6001\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k config use-context kubernetes-admin@kubernetes\r\n<\/code><\/pre>\n
                                                                      apiVersion<\/span>:<\/span> rbac.authorization.k8s.io\/v1<\/span>\r\nkind<\/span>:<\/span> Role<\/span>\r\nmetadata<\/span>:<\/span>\r\n  name<\/span>:<\/span> sample-role<\/span>\r\nrules<\/span>:<\/span>\r\n-<\/span> apiGroups<\/span>:<\/span> [<\/span>\"<\/span>\"<\/span>]<\/span>\r\n  resources<\/span>:<\/span> [<\/span>\"<\/span>pods\"<\/span>]<\/span>\r\n  verbs<\/span>:<\/span> [<\/span>\"<\/span>get\"<\/span>,<\/span> \"<\/span>watch\"<\/span>,<\/span> \"<\/span>list\"<\/span>]<\/span>\r\n<\/code><\/pre>\n
                                                                      apiVersion<\/span>:<\/span> rbac.authorization.k8s.io\/v1<\/span>\r\nkind<\/span>:<\/span> RoleBinding<\/span>\r\nmetadata<\/span>:<\/span>\r\n  name<\/span>:<\/span> sample-rolebinding<\/span>\r\n  namespace<\/span>:<\/span> default<\/span>\r\nroleRef<\/span>:<\/span>\r\n  apiGroup<\/span>:<\/span> rbac.authorization.k8s.io<\/span>\r\n  kind<\/span>:<\/span> Role<\/span>\r\n  name<\/span>:<\/span> sample-role<\/span>\r\nsubjects<\/span>:<\/span>\r\n-<\/span> kind<\/span>:<\/span> ServiceAccount<\/span>\r\n  name<\/span>:<\/span> sample-serviceaccount<\/span>\r\n  namespace<\/span>:<\/span> default<\/span>\r\n<\/code><\/pre>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k apply -f<\/span> sample-role.yaml\r\npi@raspi001:~\/tmp $<\/span> k apply -f<\/span> sample-rolebinding.yaml\r\n<\/code><\/pre>\n
                                                                      \u90a3\u4e48\uff0c\u6211\u4f1a\u518d\u8bd5\u4e00\u6b21\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k config use-context sample-sa-context\r\npi@raspi001:~\/tmp $<\/span> k get po\r\nNAME                                      READY   STATUS    RESTARTS   AGE\r\n<\/span>...\r\n<\/span><\/code><\/pre>\n
                                                                      \u54e6\uff0c\u6211\u6210\u529f\u83b7\u53d6\u4e86\uff01\u6211\u4f1a\u6062\u590d\u539f\u72b6\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k config use-context kubernetes-admin@kubernetes\r\n<\/code><\/pre>\n
                                                                      \u5b89\u5168\u73af\u5883<\/h1>\n
                                                                      \u53ef\u4ee5\u5bf9\u5bb9\u5668\u8fdb\u884c\u5b89\u5168\u8bbe\u7f6e\u3002\u4f8b\u5982\uff0c\u53ef\u4ee5\u6dfb\u52a0\u6216\u5220\u9664\u529f\u80fd\uff0c\u66f4\u6539\u8fd0\u884c\u7528\u6237\u6216\u7ec4\uff0c\u5c06\u6587\u4ef6\u8bbe\u4e3a\u53ea\u8bfb\u7b49\u3002<\/p>\n
                                                                      apiVersion<\/span>:<\/span> v1<\/span>\r\nkind<\/span>:<\/span> Pod<\/span>\r\nmetadata<\/span>:<\/span>\r\n  name<\/span>:<\/span> sample-capabilities<\/span>\r\nspec<\/span>:<\/span>\r\n  containers<\/span>:<\/span>\r\n    -<\/span> name<\/span>:<\/span> nginx-container<\/span>\r\n      image<\/span>:<\/span> nginx:1.12<\/span>\r\n      securityContext<\/span>:<\/span>\r\n        capabilities<\/span>:<\/span>\r\n          add<\/span>:<\/span> [<\/span>\"<\/span>SYS_ADMIN\"<\/span>]<\/span>\r\n          drop<\/span>:<\/span> [<\/span>\"<\/span>AUDIT_WRITE\"<\/span>]<\/span>\r\n<\/code><\/pre>\n
                                                                      \u6211\u4f1a\u7533\u8bf7\u5e76\u67e5\u770b\u5176\u4e2d\u5185\u5bb9\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k apply -f<\/span> sample-capabilities.yaml\r\npi@raspi001:~\/tmp $<\/span> k exec<\/span> -it<\/span> sample-capabilities \/bin\/bash\r\nroot@sample-capabilities:\/#<\/span> apt update &&<\/span> apt install <\/span>libcap2-bin\r\nroot@sample-capabilities:\/#<\/span> capsh --print<\/span> | grep <\/span>Current\r\nCurrent: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_admin,cap_mknod,cap_setfcap+eip\r\n<\/span>root@sample-capabilities:\/#<\/span> exit<\/span>\r\n<\/code><\/pre>\n
                                                                      \u6700\u8fd1cap_sys_admin\u7684\u4f7f\u7528\u4f3c\u4e4e\u5728\u589e\u52a0\uff0c\u4f46\u662f\u627e\u4e0d\u5230audit_write\u6743\u9650\u3002
                                                                      \n\u8bf4\u5b9e\u8bdd\uff0c\u6211\u4e4b\u524d\u5e76\u4e0d\u77e5\u9053\u6709\u54ea\u4e9b\u6743\u9650\uff0c\u6240\u4ee5\u53c2\u8003\u4e86\u8fd9\u4e2a\u8d44\u6599\u3002<\/p>\n
                                                                      PodSecurityContext:<\/h1>\n
                                                                      Pod \u5b89\u5168\u4e0a\u4e0b\u6587<\/p>\n
                                                                      \u60a8\u53ef\u4ee5\u4e3a\u6bcf\u4e2aPod\uff08\u5bb9\u5668\uff09\u8bbe\u7f6e\u5b89\u5168\u914d\u7f6e\u3002
                                                                      \n\u4f8b\u5982\uff0c\u60a8\u53ef\u4ee5\u63a7\u5236\u8981\u6267\u884c\u7684\u7528\u6237\u6216\u7ec4\uff0c\u62d2\u7eddroot\u6267\u884c\uff0c\u5e76\u8986\u76d6\u5185\u6838\u53c2\u6570\u3002<\/p>\n
                                                                      apiVersion<\/span>:<\/span> v1<\/span>\r\nkind<\/span>:<\/span> Pod<\/span>\r\nmetadata<\/span>:<\/span>\r\n  name<\/span>:<\/span> sample-runuser<\/span>\r\nspec<\/span>:<\/span>\r\n  securityContext<\/span>:<\/span>\r\n    runAsUser<\/span>:<\/span> 99<\/span>\r\n    # runAsGroup: 99<\/span>\r\n    supplementalGroups<\/span>:<\/span>\r\n    -<\/span> 1001<\/span>\r\n    -<\/span> 1002<\/span>\r\n  containers<\/span>:<\/span>\r\n    -<\/span> name<\/span>:<\/span> centos-container<\/span>\r\n      image<\/span>:<\/span> centos:7<\/span>\r\n      command<\/span>:<\/span> [<\/span>\"<\/span>\/bin\/sleep\"<\/span>,<\/span> \"<\/span>3600\"<\/span>]<\/span>\r\n<\/code><\/pre>\n
                                                                      \u6211\u6b63\u5728\u7533\u8bf7\u3002<\/p>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k apply -f<\/span> sample-runuser.yaml\r\npi@raspi001:~\/tmp $<\/span> k exec<\/span> -it<\/span> sample-runuser --<\/span> id<\/span>\r\nuid=99(nobody) gid=99(nobody) groups=99(nobody),1001,1002\r\n<\/span>pi@raspi001:~\/tmp $<\/span> k exec<\/span> -it<\/span> sample-runuser --<\/span> ps aux | grep sleep<\/span>\r\nnobody       1  0.0  0.0   2032   372 ?        Ss   14:02   0:00 \/bin\/sleep 3600\r\n<\/span><\/code><\/pre>\n
                                                                      \u7528\u6237\u5df2\u88ab\u66f4\u6539\u4e3anobody(99)\u3002\u6b64\u5916\uff0c\u5728supplementalGroups\u4e2d\uff0c\u53ef\u4ee5\u5c06\u6307\u5b9a\u7684GID\u6dfb\u52a0\u5230\u4e3b\u8981\u7684GID\u4e2d\u3002<\/p>\n
                                                                      \u5176\u4ed6\uff08\u5176\u4e2d\u7684\u5176\u4ed6\uff09<\/h1>\n
                                                                      \u636e\u8bf4\u8fd8\u6709PodSecurityPolicy\u3001NetworkPolicy\u4ee5\u53ca\u8ba4\u8bc1\u548c\u6388\u6743\u7684AdmissionControl\u3002<\/p>\n
                                                                      \u6574\u7406\u6536\u62fe<\/h1>\n
                                                                      pi@raspi001:~\/tmp $<\/span> k delete -f<\/span> sample-serviceaccount.yaml -f<\/span> sample-role.yaml -f<\/span> sample-rolebinding.yaml -f<\/span> sample-capabilities.yaml -f<\/span> sample-runuser.yaml\r\npi@raspi001:~\/tmp $<\/span> k config delete-context sample-sa-context\r\n<\/code><\/pre>\n
                                                                      \u6700\u7ec8<\/h1>\n
                                                                      \u6211\u4e3b\u8981\u5b66\u4e60\u4e86RBAC\u3002
                                                                      \n\u5f53\u591a\u4eba\u534f\u4f5c\u5f00\u53d1\u65f6\uff0c\u6700\u597d\u662f\u6839\u636e\u4e0d\u540c\u7684\u4e0a\u4e0b\u6587\u8fdb\u884c\u5f00\u53d1\u3002
                                                                      \n\u5c31\u50cf\u6211\u4eec\u8fd9\u6b21\u6240\u505a\u7684\u90a3\u6837\uff0c\u901a\u8fc7RBAC\u53ef\u4ee5\u7ba1\u7406\u8c01\u5177\u6709\u54ea\u4e9b\u6743\u9650\uff0c
                                                                      \n\u8fd9\u6837\u5c31\u4e0d\u592a\u53ef\u80fd\u56e0\u4e3a\u7ed9\u4e88\u4e86\u8fc7\u591a\u7684\u6743\u9650\u800c\u5bfc\u81f4\u4e8b\u6545\u3002
                                                                      \n\uff08\u867d\u7136\u8bf4\uff0c\u6211\u53ea\u662f\u4e2a\u4eba\u4f7f\u7528\uff0c\u5e76\u4e0d\u6e05\u695a\u60c5\u51b5…\uff09
                                                                      \n\u4e0b\u6b21\u662f\u6700\u540e\u4e00\u6b21\u4e86\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
                                                                      \u30b9\u30c8\u30fc\u30ea\u30fc \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 01. \u74b0\u5883\u9078\u629e\u7de8 – […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-35921","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"\n\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a - 15. \u5b89\u5168\u6027 - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5bf9kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a-15-\u5b89\u5168\u6027\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a - 15. \u5b89\u5168\u6027 -\" \/>\n<meta property=\"og:description\" content=\"\u30b9\u30c8\u30fc\u30ea\u30fc \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 01. \u74b0\u5883\u9078\u629e\u7de8 – […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5bf9kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a-15-\u5b89\u5168\u6027\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-03T21:29:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-28T18:06:39+00:00\" \/>\n<meta name=\"author\" content=\"\u79d1, \u96c5\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u79d1, \u96c5\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/\",\"name\":\"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a - 15. \u5b89\u5168\u6027 - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-03-03T21:29:05+00:00\",\"dateModified\":\"2024-04-28T18:06:39+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a – 15. \u5b89\u5168\u6027 –\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a\",\"name\":\"\u79d1, \u96c5\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g\",\"caption\":\"\u79d1, \u96c5\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/keya\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a - 15. \u5b89\u5168\u6027 - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5bf9kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a-15-\u5b89\u5168\u6027\/","og_locale":"zh_CN","og_type":"article","og_title":"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a - 15. \u5b89\u5168\u6027 -","og_description":"\u30b9\u30c8\u30fc\u30ea\u30fc \u4e00\u8db3\u9045\u308c\u3066 Kubernetes \u3092\u5b66\u3073\u59cb\u3081\u308b – 01. \u74b0\u5883\u9078\u629e\u7de8 – […]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u5bf9kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a-15-\u5b89\u5168\u6027\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-03-03T21:29:05+00:00","article_modified_time":"2024-04-28T18:06:39+00:00","author":"\u79d1, \u96c5","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u79d1, \u96c5","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/","name":"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a - 15. \u5b89\u5168\u6027 - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-03-03T21:29:05+00:00","dateModified":"2024-04-28T18:06:39+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u6211\u5bf9Kubernetes\u7684\u5b66\u4e60\u6709\u4e9b\u665a – 15. \u5b89\u5168\u6027 –"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/41e222757cdd2a3365361328bd79970a","name":"\u79d1, \u96c5","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1b2d3e00a7df03689797ebd4af8c5827ba5af936849a71050ec331f4cf902c5d?s=96&d=mm&r=g","caption":"\u79d1, \u96c5"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/keya\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e5%af%b9kubernetes%e7%9a%84%e5%ad%a6%e4%b9%a0%e6%9c%89%e4%ba%9b%e6%99%9a-15-%e5%ae%89%e5%85%a8%e6%80%a7\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=35921"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35921\/revisions"}],"predecessor-version":[{"id":73829,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/35921\/revisions\/73829"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=35921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=35921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=35921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}