4.5.2.2. 手动配置身份验证

当以下选项被设置为 true 时，将针对报告 REST API 启用使用 bearer 令牌的身份验证。bearer 令牌可由服务帐户或用户提供。

启用身份验证后，必须通过以下任一角色向用于查询该用户或服务帐户报告 API 的 bearer 令牌授予访问权限：

Metering Operator 能够为您创建角色绑定，通过在 spec.permissions 部分中指定主体列表来授予这些权限。例如，请参阅以下 advanced-auth.yaml 示例配置。

apiVersion: metering.openshift.io/v1
kind: MeteringConfig
metadata:
  name: "operator-metering"
spec:
  permissions:
    # anyone in the "metering-admins" group can create, update, delete, etc any
    # metering.openshift.io resources in the namespace.
    # This also grants permissions to get query report results from the reporting REST API.
    meteringAdmins:
    - kind: Group
      name: metering-admins
    # Same as above except read only access and for the metering-viewers group.
    meteringViewers:
    - kind: Group
      name: metering-viewers
    # the default serviceaccount in the namespace "my-custom-ns" can:
    # create, update, delete, etc reports.
    # This also gives permissions query the results from the reporting REST API.
    reportingAdmins:
    - kind: ServiceAccount
      name: default
      namespace: my-custom-ns
    # anyone in the group reporting-readers can get, list, watch reports, and
    # query report results from the reporting REST API.
    reportingViewers:
    - kind: Group
      name: reporting-readers
    # anyone in the group cluster-admins can query report results
    # from the reporting REST API. So can the user bob-from-accounting.
    reportExporters:
    - kind: Group
      name: cluster-admins
    - kind: User
      name: bob-from-accounting

  reporting-operator:
    spec:
      authProxy:
        # htpasswd.data can contain htpasswd file contents for allowing auth
        # using a static list of usernames and their password hashes.
        #
        # username is 'testuser' password is 'password123'
        # generated htpasswdData using: `htpasswd -nb -s testuser password123`
        # htpasswd:
        #   data: |
        #     testuser:{SHA}y/2sYAj5yrQIN4TL0YdPdmGNKpc=
        #
        # change REPLACEME to the output of your htpasswd command
        htpasswd:
          data: |
            REPLACEME

另外，您还可使用任何具有授予 reports/export get 权限规则的角色。这代表，get 访问 Reporting Operator 命名空间中的 Report 资源的 export 子资源。例如：admin 和 cluster-admin。

默认情况下，Reporting Operator 和 Metering Operator 服务帐户均具有这些权限，其令牌可用于身份验证。