101 lines
2.6 KiB
YAML
101 lines
2.6 KiB
YAML
# spring-cloud-kubernetes 是在 Pod 里调 K8s API 去读 ConfigMap 的，
|
||
# 默认的 default ServiceAccount 没有这个权限——漏了这份清单，应用启动时读配置会 403，
|
||
# 而且 reload 的轮询会每 15 秒报一次错（见 07-config-governance.md「关键规则」）。
|
||
#
|
||
# 权限严格收敛到"读所在 namespace 的 ConfigMap"这一件事：
|
||
# - 不给 secrets 的 get/list：Secret 是通过 envFrom 由 kubelet 注入的，应用自己不需要读；
|
||
# 给了反而等于让一次 RCE 直接拿到 JWT 签名密钥。
|
||
# - 用 Role 而不是 ClusterRole：跨 namespace 读不到，UAT 的 Pod 看不见 Prod 的配置。
|
||
# - reload 用的是 mode: polling 而不是 event，所以不需要 watch 权限。
|
||
#
|
||
# 三个 namespace 各一份，内容相同。
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: conti-backend
|
||
namespace: retailapp-dev
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: Role
|
||
metadata:
|
||
name: conti-backend-config-reader
|
||
namespace: retailapp-dev
|
||
rules:
|
||
- apiGroups: [""]
|
||
resources: ["configmaps"]
|
||
verbs: ["get", "list"]
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: RoleBinding
|
||
metadata:
|
||
name: conti-backend-config-reader
|
||
namespace: retailapp-dev
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: Role
|
||
name: conti-backend-config-reader
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: conti-backend
|
||
namespace: retailapp-dev
|
||
---
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: conti-backend
|
||
namespace: retailapp-uat
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: Role
|
||
metadata:
|
||
name: conti-backend-config-reader
|
||
namespace: retailapp-uat
|
||
rules:
|
||
- apiGroups: [""]
|
||
resources: ["configmaps"]
|
||
verbs: ["get", "list"]
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: RoleBinding
|
||
metadata:
|
||
name: conti-backend-config-reader
|
||
namespace: retailapp-uat
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: Role
|
||
name: conti-backend-config-reader
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: conti-backend
|
||
namespace: retailapp-uat
|
||
---
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: conti-backend
|
||
namespace: retailapp-prod
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: Role
|
||
metadata:
|
||
name: conti-backend-config-reader
|
||
namespace: retailapp-prod
|
||
rules:
|
||
- apiGroups: [""]
|
||
resources: ["configmaps"]
|
||
verbs: ["get", "list"]
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: RoleBinding
|
||
metadata:
|
||
name: conti-backend-config-reader
|
||
namespace: retailapp-prod
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: Role
|
||
name: conti-backend-config-reader
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: conti-backend
|
||
namespace: retailapp-prod
|