16.3.2. 创建集群角色
配置 descheduler 在 pod 中正常工作所需的权限：
使用以下规则创建 集群角色 ：
kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: descheduler-cluster-role rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get", "watch", "list"] 1 - apiGroups: [""] resources: ["pods"] verbs: ["get", "watch", "list", "delete"] 2 - apiGroups: [""] resources: ["pods/eviction"] 3 verbs: ["create"]
创建用于运行作业的服务帐户 ：
# oc create sa <file-name>.yaml -n kube-system
例如：
# oc create sa descheduler-sa.yaml -n kube-system
将集群角色绑定到服务帐户：
# oc create clusterrolebinding descheduler-cluster-role-binding \ --clusterrole=<cluster-role-name> \ --serviceaccount=kube-system:<service-account-name>例如：
# oc create clusterrolebinding descheduler-cluster-role-binding \ --clusterrole=descheduler-cluster-role \ --serviceaccount=kube-system:descheduler-sa
