[기타] Roles and Bindings

Managing Authorization Policies

참고 : https://docs.openshift.com/enterprise/3.0/admin_guide/manage_authorization_policy.html

최초 프로젝트 생성 후 S2i build 진행 중 Integrated Registry로 이미지 push 단계가 있다. 

예) 프로젝트 명 : test

     접속 계정   : demo1

위 계정으로 해당 프로젝트에 dotnet 빌드 중 이미지 push 단계에서 실패를 할 경우 아래의 방법으로 해결한다.

[프로젝트 policyBindings]

아래 결과를 보면 test 프로젝트에 image-builder를 할수 있는 계정이 <none>

# oc describe policyBindings -n test Name: :default Namespace: test Created: 13 hours ago Labels: <none> Annotations: <none> Last Modified: {2017-01-17 20:34:58 +0900 KST} Policy: <none> RoleBinding[admin]:   Role: admin Users: demo1 Groups: <none> ServiceAccounts: <none> Subjects: <none> RoleBinding[system:deployers]:   Role: system:deployer Users: <none> Groups: <none> ServiceAccounts: deployer Subjects: <none> RoleBinding[system:image-builders]:   Role: system:image-builder Users: <none> Groups: <none> ServiceAccounts: builder Subjects: <none> RoleBinding[system:image-pullers]:   Role: system:image-puller Users: <none> Groups: system:serviceaccounts:test ServiceAccounts: <none> Subjects: <none>

권한부여

1) system:admin 계정으로 로그인 # oc login -u system:admin 2) 권한부여 # oadm policy add-role-to-user system:image-builder demo1 -n test

확인

# oc describe policyBindings -n test Name: :default Namespace: test Created: 13 hours ago Labels: <none> Annotations: <none> Last Modified: {2017-01-18 10:29:35 +0900 KST} Policy: <none> RoleBinding[admin]:   Role: admin Users: demo1 Groups: <none> ServiceAccounts: <none> Subjects: <none> RoleBinding[system:deployers]:   Role: system:deployer Users: <none> Groups: <none> ServiceAccounts: deployer Subjects: <none> RoleBinding[system:image-builders]:   Role: system:image-builder Users: demo1 Groups: <none> ServiceAccounts: builder Subjects: <none> RoleBinding[system:image-pullers]:   Role: system:image-puller Users: <none> Groups: system:serviceaccounts:test ServiceAccounts: <none> Subjects: <none>

결과

Pushing image 172.30.204.177:5000/test/dotnet:latest ... Pushed 0/4 layers, 3% complete Pushed 1/4 layers, 27% complete Pushed 2/4 layers, 55% complete Pushed 2/4 layers, 67% complete Pushed 2/4 layers, 80% complete Pushed 2/4 layers, 94% complete Pushed 3/4 layers, 100% complete Pushed 4/4 layers, 100% complete Push successful

* 프로젝트 내 권한설정은 다음 명령어로 확인가능하며, 세부 권한은 크게 4가지이다.

$ oc project <project_name>

$ oc describe policyBindings :default