2.openshift授权策略和scc理解

policy管理概念

查看policy的方式可以通过cli进行查看

Roles grant various levels of access in the system-wide cluster policy as well as project-scoped local policies. Users and groups can be associated with, or bound to, multiple roles at the same time. You can view details about the roles and their bindings using the oc describe command.

拥有cluster-admin 角色的用户可以在集群范围内查看  拥有admin角色的用户只能在单个project来查看。

Users with the cluster-admin default role in the cluster policy can view cluster policy and all local policies. Users with the admin default role in a given local policy can view that project-scoped policy.

常用命令

policy 是一些列 roles的集合

可以查看出 集群中roles  和 rolebind

 oc describe clusterPolicy default

 oc describe clusterPolicyBindings :default

查看本空间内  role  和  rolebind

oc describe policyBindings :default

oadm  policy 命令来管理 policy