16.3.2. 创建集群角色

使用以下规则创建 集群角色 ：

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: descheduler-cluster-role
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "watch", "list"] 1
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list", "delete"] 2
- apiGroups: [""]
  resources: ["pods/eviction"] 3
  verbs: ["create"]

创建用于运行作业的服务帐户 ：

# oc create sa <file-name>.yaml -n kube-system

例如：

# oc create sa descheduler-sa.yaml -n kube-system

将集群角色绑定到服务帐户：

# oc create clusterrolebinding descheduler-cluster-role-binding \
    --clusterrole=<cluster-role-name> \
    --serviceaccount=kube-system:<service-account-name>

例如：

# oc create clusterrolebinding descheduler-cluster-role-binding \
    --clusterrole=descheduler-cluster-role \
    --serviceaccount=kube-system:descheduler-sa