Skip to content

Instantly share code, notes, and snippets.

@darrenclark
Created November 15, 2020 15:25
Show Gist options
  • Save darrenclark/1e0810a0e864efe9bb712d3d0dd991c7 to your computer and use it in GitHub Desktop.
Save darrenclark/1e0810a0e864efe9bb712d3d0dd991c7 to your computer and use it in GitHub Desktop.
kubectl --as example
apiVersion: batch/v1
kind: Job
metadata:
generateName: echo-job-
spec:
template:
spec:
containers:
- name: echo
image: alpine:latest
command: ["sh", "-c", "echo 'Hello, world!'"]
restartPolicy: Never
backoffLimit: 5
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: alice
namespace: default
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: bob
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: jobs-viewer
namespace: default
rules:
- apiGroups: ["", "batch"]
resources: ["jobs", "pods", "jobs/status", "pods/status", "pods/log"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: jobs-manager
namespace: default
rules:
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: alice-and-bob-jobs-viewer
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: jobs-viewer
subjects:
- kind: ServiceAccount
name: alice
namespace: default
- kind: ServiceAccount
name: bob
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: alice-jobs-manager
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: jobs-manager
subjects:
- kind: ServiceAccount
name: alice
namespace: default
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment