8.6. 사용자 역할 추가

절차

1. 특정 프로젝트의 사용자에게 역할을 추가합니다.

   $ oc adm policy add-role-to-user <role> <user> -n <project>

   예를 들면 다음을 실행하여 joe 프로젝트의 alice 사용자에게 admin 역할을 추가할 수 있습니다.

   $ oc adm policy add-role-to-user admin alice -n joe

   작은 정보

   다음 YAML을 적용하여 사용자에게 역할을 추가할 수도 있습니다.

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: admin-0
     namespace: joe
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: admin
   subjects:
   - apiGroup: rbac.authorization.k8s.io
     kind: User
     name: alice

2. 로컬 역할 바인딩을 보고 출력에 추가되었는지 확인합니다.

   $ oc describe rolebinding.rbac -n <project>

   예를 들어, joe 프로젝트의 로컬 역할 바인딩을 보려면 다음을 수행합니다.

   $ oc describe rolebinding.rbac -n joe

   출력 예

   Name:         admin
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name        Namespace
     ----  ----        ---------
     User  kube:admin
   
   
   Name:         admin-0
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name   Namespace
     ----  ----   ---------
     User  alice 1
   
   
   Name:         system:deployers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows deploymentconfigs in this namespace to rollout pods in
                   this namespace.  It is auto-managed by a controller; remove
                   subjects to disa...
   Role:
     Kind:  ClusterRole
     Name:  system:deployer
   Subjects:
     Kind            Name      Namespace
     ----            ----      ---------
     ServiceAccount  deployer  joe
   
   
   Name:         system:image-builders
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows builds in this namespace to push images to this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-builder
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  builder  joe
   
   
   Name:         system:image-pullers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows all pods in this namespace to pull images from this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-puller
   Subjects:
     Kind   Name                                Namespace
     ----   ----                                ---------
     Group  system:serviceaccounts:joe

   1

   alice 사용자가 admins RoleBinding에 추가되었습니다.