Role-model#

Role-model - это набор ролей, которые администратор может использовать для сопоставления пользователей в LDAP/AD и т.п.

Этот инструмент не приносит никаких рабочих нагрузок, только кластерные роли и role binding на группы пользователей.

№

Роль

Имя role binding в DropApp

Имя группы в LDAP

Компонент доступа

Объект доступа

Права

1

Admins

dapp-k8s-admins

k8s-admins

kube-apiserver

leases

create, delete, deletecollection, get, list, patch, update, watch

rolebindings

create, delete, deletecollection, get, list, patch, update, watch

roles

create, delete, deletecollection, get, list, patch, update, watch

clusterrolebindings

create, delete, deletecollection, get, list, patch, update, watch

clusterroles

create, delete, deletecollection, get, list, patch, update, watch

configmaps

create, delete, deletecollection, patch, update, get, list, watch

events

create, delete, deletecollection, patch, update, get, list, watch

persistentvolumeclaims

create, delete, deletecollection, patch, update, get, list, watch

pods

create, delete, deletecollection, patch, update, get, list, watch

replicationcontrollers

create, delete, deletecollection, patch, update, get, list, watch

services

create, delete, deletecollection, patch, update, get, list, watch

daemonsets

create, delete, deletecollection, patch, update, get, list, watch

deployments

create, delete, deletecollection, patch, update, get, list, watch

replicasets

create, delete, deletecollection, patch, update, get, list, watch

statefulsets

create, delete, deletecollection, patch, update, get, list, watch

horizontalpodautoscalers

create, delete, deletecollection, patch, update, get, list, watch

cronjobs

create, delete, deletecollection, patch, update, get, list, watch

jobs

create, delete, deletecollection, patch, update, get, list, watch

networkpolicies

create, delete, deletecollection, patch, update, get, list, watch

ingresses

create, delete, deletecollection, patch, update, get, list, watch

poddisruptionbudgets

create, delete, deletecollection, patch, update, get, list, watch

serviceaccounts

create

localsubjectaccessreviews

create

selfsubjectaccessreviews

create

selfsubjectrulesreviews

create

pods/attach

get, list, watch

pods/exec

get, list, watch

secrets

create, delete, deletecollection, patch, update, get, list, watch

endpoints

create, delete, deletecollection, patch, update, get, list, watch

limitranges

create, delete, deletecollection, patch, update, get, list, watch

namespaces

create, delete, deletecollection, patch, update, get, list, watch

pods/log

get, list, watch

resourcequotas

create, delete, deletecollection, patch, update, get, list, watch

endpointslices

create, delete, deletecollection, patch, update, get, list, watch

2

Developers

dapp-k8s-developers

k8s-developers

kube-apiserver

leases

create, delete, deletecollection, get, list, patch, update, watch

в рамках namespace default

rolebindings

-

roles

-

clusterrolebindings

-

clusterroles

-

configmaps

create, delete, deletecollection, patch, update, get, list, watch

events

create, delete, deletecollection, patch, update, get, list, watch

persistentvolumeclaims

create, delete, deletecollection, patch, update, get, list, watch

pods

create, delete, deletecollection, patch, update, get, list, watch

replicationcontrollers

create, delete, deletecollection, patch, update, get, list, watch

services

create, delete, deletecollection, patch, update, get, list, watch

daemonsets

create, delete, deletecollection, patch, update, get, list, watch

deployments

create, delete, deletecollection, patch, update, get, list, watch

replicasets

create, delete, deletecollection, patch, update, get, list, watch

statefulsets

create, delete, deletecollection, patch, update, get, list, watch

horizontalpodautoscalers

create, delete, deletecollection, patch, update, get, list, watch

cronjobs

create, delete, deletecollection, patch, update, get, list, watch

jobs

create, delete, deletecollection, patch, update, get, list, watch

networkpolicies

create, delete, deletecollection, patch, update, get, list, watch

ingresses

create, delete, deletecollection, patch, update, get, list, watch

poddisruptionbudgets

create, delete, deletecollection, patch, update, get, list, watch

serviceaccounts

localsubjectaccessreviews

create,

selfsubjectaccessreviews

create,

selfsubjectrulesreviews

create,

pods/attach

get, list, watch, create, delete, deletecollection, patch, update

pods/exec

get, list, watch, create, delete, deletecollection, patch, update

secrets

get, list, watch, create, delete, deletecollection, patch, update

endpoints

get, list, watch

limitranges

get, list, watch

namespaces

get, list, watch

pods/log

get, list, watch

resourcequotas

get, list, watch

endpointslices

get, list, watch

3

Auditors

dapp-k8s-auditor

k8s-auditors

kube-apiserver

leases

-

rolebindings

-

roles

-

clusterrolebindings

-

clusterroles

-

configmaps

get, list, watch

events

get, list, watch

persistentvolumeclaims

get, list, watch

pods

get, list, watch

replicationcontrollers

get, list, watch

services

get, list, watch

daemonsets

get, list, watch

deployments

get, list, watch

replicasets

get, list, watch

statefulsets

get, list, watch

horizontalpodautoscalers

get, list, watch

cronjobs

get, list, watch

jobs

get, list, watch

networkpolicies

get, list, watch

ingresses

get, list, watch

poddisruptionbudgets

get, list, watch

serviceaccounts

get, list, watch

localsubjectaccessreviews

-

selfsubjectaccessreviews

create

selfsubjectrulesreviews

create

pods/attach

-

pods/exec

-

secrets

-

endpoints

get, list, watch

limitranges

get, list, watch

namespaces

get, list, watch

pods/log

get, list, watch

resourcequotas

get, list, watch

endpointslices

get, list, watch