使用ArgoCD RBAC与Kubernetes集群角色可以在Kubernetes集群中基于角色的访问控制(RBAC)方案实现对ArgoCD的访问控制。
以下是一个使用Kubernetes集群角色授权ArgoCD的示例。
1.创建一个名为"argocd-manager"的ServiceAccount:
$ kubectl create sa argocd-manager
2.创建一个名为"argocd-manager-cluster-role"的ClusterRole:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: argocd-manager-cluster-role
rules:
- apiGroups:
- ""
resources:
- secrets
- configmaps
- pods
- pods/exec
- pods/log
- events
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- deployments
- replicasets
verbs:
- get
- list
- watch
3.为Kubernetes ServiceAccount和ClusterRole创建一个ClusterRoleBinding:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: argocd-manager-cluster-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: argocd-manager-cluster-role
subjects:
- kind: ServiceAccount
name: argocd-manager
namespace: argocd
通过以上步骤,我们可以将ClusterRole绑定到ServiceAccount上,从而向我们授权了提供所需ArgoCD操作的权限。