20.3. 为自定义资源定义创建集群角色

apiVersion: rbac.authorization.k8s.io/v1 
kind: ClusterRole
items:
  - metadata:
      name: aggregate-cron-tabs-admin-edit 
      labels:
        rbac.authorization.k8s.io/aggregate-to-admin: "true" 
        rbac.authorization.k8s.io/aggregate-to-edit: "true" 
    rules:
      - apiGroups: ["stable.example.com"] 
        resources: ["crontabs"] 
        verbs: ["get", "list", "watch", "create",
                "update", "patch", "delete", "deletecollection"] 
  - metadata:
      name: aggregate-cron-tabs-view 
      labels:
        # Add these permissions to the "view" default role.
        rbac.authorization.k8s.io/aggregate-to-view: "true" 
        rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" 
    rules:
      - apiGroups: ["stable.example.com"] 
        resources: ["crontabs"] 
        verbs: ["get", "list", "watch"] 

apiVersion: rbac.authorization.k8s.io/v1 

kind: ClusterRole
items:
  - metadata:
      name: aggregate-cron-tabs-admin-edit 

      labels:
        rbac.authorization.k8s.io/aggregate-to-admin: "true" 

        rbac.authorization.k8s.io/aggregate-to-edit: "true" 

    rules:
      - apiGroups: ["stable.example.com"] 

        resources: ["crontabs"] 

        verbs: ["get", "list", "watch", "create",
                "update", "patch", "delete", "deletecollection"] 

  - metadata:
      name: aggregate-cron-tabs-view 

      labels:
        # Add these permissions to the "view" default role.
        rbac.authorization.k8s.io/aggregate-to-view: "true" 

        rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" 

    rules:
      - apiGroups: ["stable.example.com"] 

        resources: ["crontabs"] 

        verbs: ["get", "list", "watch"]