policy管理概念
查看policy的方式可以通过cli进行查看
Roles grant various levels of access in the system-wide cluster policy as well as project-scoped local policies. Users and groups can be associated with, or bound to, multiple roles at the same time. You can view details about the roles and their bindings using the oc describe command.
拥有cluster-admin 角色的用户可以在集群范围内查看 拥有admin角色的用户只能在单个project来查看。
Users with the cluster-admin default role in the cluster policy can view cluster policy and all local policies. Users with the admin default role in a given local policy can view that project-scoped policy.
常用命令
policy 是一些列 roles的集合
可以查看出 集群中roles 和 rolebind
oc describe clusterPolicy default
oc describe clusterPolicyBindings :default
查看本空间内 role 和 rolebind
oc describe policyBindings :default
oadm policy 命令来管理 policy