Role-model#

Role-model - это набор ролей, которые администратор может использовать для сопоставления пользователей в LDAP/AD и т.п.

Этот инструмент не приносит никаких рабочих нагрузок, только кластерные роли и role binding на группы пользователей.

№	Роль	Имя role binding в DropApp	Имя группы в LDAP	Компонент доступа	Объект доступа	Права
1	`Admins`	`dapp-k8s-admins`	`k8s-admins`	kube-apiserver	`leases`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
					`rolebindings`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
					`roles`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
					`clusterrolebindings`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
					`clusterroles`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
					`configmaps`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`events`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`persistentvolumeclaims`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`pods`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`replicationcontrollers`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`services`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`daemonsets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`deployments`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`replicasets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`statefulsets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`horizontalpodautoscalers`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`cronjobs`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`jobs`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`networkpolicies`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`ingresses`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`poddisruptionbudgets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`serviceaccounts`	`create`
					`localsubjectaccessreviews`	`create`
					`selfsubjectaccessreviews`	`create`
					`selfsubjectrulesreviews`	`create`
					`pods`/`attach`	`get`, `list`, `watch`
					`pods`/`exec`	`get`, `list`, `watch`
					`secrets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`endpoints`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`limitranges`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`namespaces`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`pods`/`log`	`get`, `list`, `watch`
					`resourcequotas`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`endpointslices`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
2	`Developers`	`dapp-k8s-developers`	`k8s-developers`	kube-apiserver	`leases`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
				в рамках пространства имен `default`	`rolebindings`	-
					`roles`	-
					`clusterrolebindings`	-
					`clusterroles`	-
					`configmaps`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`events`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`persistentvolumeclaims`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`pods`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`replicationcontrollers`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`services`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`daemonsets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`deployments`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`replicasets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`statefulsets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`horizontalpodautoscalers`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`cronjobs`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`jobs`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`networkpolicies`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`ingresses`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`poddisruptionbudgets`	`create`, `delete`, `deletecollection`, `patch`, `update`, `get`, `list`, `watch`
					`serviceaccounts`
					`localsubjectaccessreviews`	`create`,
					`selfsubjectaccessreviews`	`create`,
					`selfsubjectrulesreviews`	`create`,
					`pods`/`attach`	`get`, `list`, `watch`, `create`, `delete`, `deletecollection`, `patch`, `update`
					`pods`/`exec`	`get`, `list`, `watch`, `create`, `delete`, `deletecollection`, `patch`, `update`
					`secrets`	`get`, `list`, `watch`, `create`, `delete`, `deletecollection`, `patch`, `update`
					`endpoints`	`get`, `list`, `watch`
					`limitranges`	`get`, `list`, `watch`
					`namespaces`	`get`, `list`, `watch`
					`pods`/`log`	`get`, `list`, `watch`
					`resourcequotas`	`get`, `list`, `watch`
					`endpointslices`	`get`, `list`, `watch`
3	`Auditors`	`dapp-k8s-auditor`	`k8s-auditors`	kube-apiserver	`leases`	-
					`rolebindings`	-
					`roles`	-
					`clusterrolebindings`	-
					`clusterroles`	-
					`configmaps`	`get`, `list`, `watch`
					`events`	`get`, `list`, `watch`
					`persistentvolumeclaims`	`get`, `list`, `watch`
					`pods`	`get`, `list`, `watch`
					`replicationcontrollers`	`get`, `list`, `watch`
					`services`	`get`, `list`, `watch`
					`daemonsets`	`get`, `list`, `watch`
					`deployments`	`get`, `list`, `watch`
					`replicasets`	`get`, `list`, `watch`
					`statefulsets`	`get`, `list`, `watch`
					`horizontalpodautoscalers`	`get`, `list`, `watch`
					`cronjobs`	`get`, `list`, `watch`
					`jobs`	`get`, `list`, `watch`
					`networkpolicies`	`get`, `list`, `watch`
					`ingresses`	`get`, `list`, `watch`
					`poddisruptionbudgets`	`get`, `list`, `watch`
					`serviceaccounts`	`get`, `list`, `watch`
					`localsubjectaccessreviews`	-
					`selfsubjectaccessreviews`	`create`
					`selfsubjectrulesreviews`	`create`
					`pods`/`attach`	-
					`pods`/`exec`	-
					`secrets`	-
					`endpoints`	`get`, `list`, `watch`
					`limitranges`	`get`, `list`, `watch`
					`namespaces`	`get`, `list`, `watch`
					`pods`/`log`	`get`, `list`, `watch`
					`resourcequotas`	`get`, `list`, `watch`
					`endpointslices`	`get`, `list`, `watch`