K8s面试系列：K8s常用 API 资源总结速记

apiVersion: v1
kind: Pod

metadata:
  creationTimestamp: null
  labels:
    run: pod-static
  name: pod-static
  namespeace: default

spec:
  containers:
  - image: nginx
    imagePullPolicy: IfNotPresent
    name: pod-demo
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Always
......

status:
  phase: Running
  conditions:
    - type: Initialized
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2023-02-18T14:46:54Z'
    - type: Ready
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2023-02-18T14:54:04Z'
    - type: ContainersReady
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2023-02-18T14:54:04Z'
    - type: PodScheduled
      status: 'True'
      lastProbeTime: null
      lastTransitionTime: '2023-02-11T04:11:46Z'
  hostIP: 192.168.26.105
  podIP: 10.244.169.101
  podIPs:
    - ip: 10.244.169.101
  startTime: '2023-02-11T04:11:46Z'
  ..................

kubectl apply -f deployment.yaml --server-side

kubectl apply -f deployment.yaml --server-side

liruilong@liruilongdeMacBook-Air .kube % kubectl get vs -n defalut m-liruilong-online-vs  -o yaml --show-managed-fields 
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"networking.istio.io/v1beta1","kind":"VirtualService","metadata":{"annotations":{},"name":"m-liruilong-online-vs","namespace":"defalut"},"spec":{"gateways":["istio-system/gw-any-liruilong-online"],"hosts":["m.liruilong.online"],"http":[{"match":[{"uri":{"prefix":"/"}}],"route":[{"destination":{"host":"share-web-svc.defalut.svc.cluster.local","port":{"number":8083}}}]}]}}
  creationTimestamp: "2024-11-11T12:40:54Z"
  generation: 3
  managedFields:
  - apiVersion: networking.istio.io/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:kubectl.kubernetes.io/last-applied-configuration: {}
      f:spec:
        .: {}
        f:gateways: {}
        f:hosts: {}
        f:http: {}
    manager: kubectl-client-side-apply
    operation: Update
    time: "2024-11-11T17:49:04Z"
  name: m-liruilong-online-vs
  namespace: defalut
  resourceVersion: "16170709"
  uid: 1b772566-d540-459e-9b2d-3b42f5d7e088
spec:
  ........
liruilong@liruilongdeMacBook-Air .kube % 

kubectl apply -f deployment.yaml --server-side

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-cm
  namespace: default
  labels:
    test-label: test
  managedFields:
  - manager: kubectl
    operation: Apply # 注意大写: “Apply” (或者 “Update”)
    apiVersion: v1
    time: "2010-10-10T0:00:00Z"
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          f:test-label: {}
      f:data:
        f:key: {}
data:
  key: some value

liruilong@liruilongdeMacBook-Air .kube % kubectl get deploy ams-hotel-cloudr-server -n  defalut  -o yaml --show-managed-fields 
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "19"
  creationTimestamp: "2024-11-08T07:32:43Z"
  generation: 27
  labels:
    app: ams-hotel-cloudr-server
  managedFields:
  - apiVersion: apps/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations: {}
        f:labels:
          .: {}
          f:app: {}
      f:spec:
        f:progressDeadlineSeconds: {}
        f:replicas: {}
        f:revisionHistoryLimit: {}
        f:selector: {}
        f:strategy:
          f:rollingUpdate:
            .: {}
            f:maxSurge: {}
            f:maxUnavailable: {}
          f:type: {}
        f:template:
          f:metadata:
            f:labels:
              .: {}
              f:app: {}
          f:spec:
            f:containers:
              k:{"name":"ams-hotel-cloudr-server"}:
                .: {}
                f:env:
                  .: {}
                  k:{"name":"TZ"}:
                    .: {}
                    f:name: {}
                    f:value: {}
                f:image: {}
                f:imagePullPolicy: {}
                f:name: {}
                f:ports:
                  .: {}
                  k:{"containerPort":8080,"protocol":"TCP"}:
                    .: {}
                    f:containerPort: {}
                    f:protocol: {}
                f:resources:
                  .: {}
                  f:requests:
                    .: {}
                    f:cpu: {}
                    f:memory: {}
                f:terminationMessagePath: {}
                f:terminationMessagePolicy: {}
            f:dnsPolicy: {}
            f:imagePullSecrets:
              .: {}
              k:{"name":"acck"}: {}
            f:restartPolicy: {}
            f:schedulerName: {}
            f:securityContext: {}
            f:terminationGracePeriodSeconds: {}
    manager: okhttp
    operation: Update
    time: "2024-11-21T09:49:35Z"
  - apiVersion: apps/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:deployment.kubernetes.io/revision: {}
      f:status:
        f:availableReplicas: {}
        f:conditions:
          .: {}
          k:{"type":"Available"}:
            .: {}
            f:lastTransitionTime: {}
            f:lastUpdateTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"Progressing"}:
            .: {}
            f:lastTransitionTime: {}
            f:lastUpdateTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
        f:observedGeneration: {}
        f:readyReplicas: {}
        f:replicas: {}
        f:updatedReplicas: {}
    manager: kube-controller-manager
    operation: Update
    subresource: status
    time: "2024-11-21T09:49:44Z"
  name: ams-hotel-cloudr-server
  namespace: defalut
  resourceVersion: "21530560"
  uid: c9fb0c9c-2129-4ffe-9675-96e01c396289
spec:
   .....
liruilong@liruilongdeMacBook-Air .kube % 

$ kubectl apply --server-side=true --field-manager="test" -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-server-side-apply
data:
  a: "a"
  # 把b，改成c了。
  b: "c" 
EOF
error: Apply failed with 1 conflict: conflict with "kubectl": .data.b
Please review the fields above--they currently have other managers. Here
are the ways you can resolve this warning:
* If you intend to manage all of these fields, please re-run the apply
  command with the `--force-conflicts` flag.
* If you do not intend to manage all of the fields, please edit your
  manifest to remove references to the fields that should keep their
  current managers.
* You may co-own fields by updating your manifest to match the existing
  value; in this case, you'll become the manager if the other manager(s)
  stop managing the field (remove it from their configuration).
See https://kubernetes.io/docs/reference/using-api/server-side-apply/#conflicts

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx # has to match .spec.template.metadata.labels
  serviceName: "nginx"
  replicas: 3 # by default is 1
  minReadySeconds: 10 # by default is 0
  template:
    metadata:
      labels:
        app: nginx # has to match .spec.selector.matchLabels
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.24
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "my-storage-class"
      resources:
        requests:
          storage: 1Gi

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: php-apache-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: php-apache
  minReplicas: 1
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 50

apiVersion: apps/v1
kind: ControllerRevision
metadata:
  name: example-controllerrevision
  namespace: default
  labels:
    app: example-app
spec:
  revision: 2
  selector:
    matchLabels:
      app: example-app
  template:
    metadata:
      labels:
        app: example-app
    spec:
      containers:
      - name: example-container
        image: nginx:1.16.1
        ports:
        - containerPort: 80

apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl:5.34.0
        command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4

apiVersion: batch/v1
kind: CronJob
metadata:
  name: hello
spec:
  schedule: "* * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: hello
            image: busybox:1.28
            imagePullPolicy: IfNotPresent
            command:
            - /bin/sh
            - -c
            - date; echo Hello from the Kubernetes cluster
          restartPolicy: OnFailure

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-elasticsearch
  namespace: kube-system
  labels:
    k8s-app: fluentd-logging
spec:
  selector:
    matchLabels:
      name: fluentd-elasticsearch
  template:
    metadata:
      labels:
        name: fluentd-elasticsearch
    spec:
      tolerations:
      # these tolerations are to have the daemonset runnable on control plane nodes
      # remove them if your control plane nodes should not run pods
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      containers:
      - name: fluentd-elasticsearch
        image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlog
          mountPath: /var/log
      # it may be desirable to set a high priority class to ensure that a DaemonSet Pod
      # preempts running Pods
      # priorityClassName: important
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log

apiVersion: apps/v1
kind: ReplicaSet
metadata:
  name: frontend
  labels:
    app: guestbook
    tier: frontend
spec:
  # modify replicas according to your case
  replicas: 3
  selector:
    matchLabels:
      tier: frontend
  template:
    metadata:
      labels:
        tier: frontend
    spec:
      containers:
      - name: php-redis
        image: us-docker.pkg.dev/google-samples/containers/gke/gb-frontend:v5

apiVersion: v1
kind: ReplicationController
metadata:
  name: nginx
spec:
  replicas: 3
  selector:
    app: nginx
  template:
    metadata:
      name: nginx
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:1.14.2
    ports:
    - containerPort: 80

  containers:
  - name: nginx
    image: nginx:1.14.2
    ports:
    - containerPort: 80

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 1000000 # 优先级值
globalDefault: false # 不是全局默认优先级
description: "此优先级类应仅用于 XYZ 服务 Pod。"

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority-nonpreempting
value: 1000000
preemptionPolicy: Never #使用这个优先级类的 Pod 永远不会抢占（驱逐）其他 Pod
globalDefault: false
description: "This priority class will not cause other pods to be preempted."

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app.kubernetes.io/name: MyApp
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 9376

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx-ingress
  rules:
  - http:
      paths:
      - path: /testpath
        pathType: Prefix
        backend:
          service:
            name: test
            port:
              number: 80

apiVersion: v1
kind: Endpoints
metadata:
  creationTimestamp: "2024-11-11T02:14:27Z"
  name: ams-hotel-xxl-job-svc
  namespace: smart-campus
  resourceVersion: "18254844"
  uid: 4f5b5662-5c7a-48ad-a386-49a5ecfbde7c
subsets:
- addresses:
  - ip: 172.27.99.11
    nodeName: cn-huhehaote.10.1.20.40
    targetRef:
      kind: Pod
      name: ams-hotel-xxl-job-74c66f67bd-fjz4x
      namespace: smart-campus
      uid: 8948324e-0289-4a04-8a2d-7174252b011c
  ports:
  - port: 8888
    protocol: TCP

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: example-abc
  labels:
    kubernetes.io/service-name: example
addressType: IPv4
ports:
  - name: http
    protocol: TCP
    port: 80
endpoints:
  - addresses:
      - "10.1.2.3"
    conditions:
      ready: true
    hostname: pod-1
    nodeName: node-1
    zone: us-west2-a

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx-ingress
  labels:
    app: nginx-ingress
spec:
  controller: k8s.io/ingress-nginx
  parameters:
    apiGroup: k8s.io
    kind: IngressParameters
    name: default-backend-parameters

apiVersion: v1
kind: ConfigMap
metadata:
  name: game-demo
data:
  # property-like keys; each key maps to a simple value
  player_initial_lives: "3"
  ui_properties_file_name: "user-interface.properties"

  # file-like keys
  game.properties: |
    enemy.types=aliens,monsters
    player.maximum-lives=5    
  user-interface.properties: |
    color.good=purple
    color.bad=yellow
    allow.textmode=true 

apiVersion: v1
kind: Secret
metadata:
  name: dotfile-secret
data:
  .secret-file: dmFsdWUtMg0KDQo=
---
apiVersion: v1
kind: Pod
metadata:
  name: secret-dotfiles-pod
spec:
  volumes:
    - name: secret-volume
      secret:
        secretName: dotfile-secret
  containers:
    - name: dotfile-test-container
      image: registry.k8s.io/busybox
      command:
        - ls
        - "-l"
        - "/etc/secret-volume"
      volumeMounts:
        - name: secret-volume
          readOnly: true
          mountPath: "/etc/secret-volume"

apiVersion: v1
kind: Pod
metadata:
  name: configmap-pod
spec:
  containers:
    - name: test
      image: busybox:1.28
      command: ['sh', '-c', 'echo "The app is running!" && tail -f /dev/null']
      volumeMounts:
        - name: config-vol
          mountPath: /etc/config
  volumes:
    - name: config-vol
      configMap:
        name: log-config
        items:
          - key: log_level
            path: log_level

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: myclaim
spec:
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: 8Gi
  storageClassName: slow
  selector:
    matchLabels:
      release: "stable"
    matchExpressions:
      - {key: environment, operator: In, values: [dev]}

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv0003
spec:
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  storageClassName: slow
  mountOptions:
    - hard
    - nfsvers=4.1
  nfs:
    path: /tmp
    server: 172.17.0.2

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: example-vol-default
provisioner: vendor-name.example/magicstorage
parameters:
  resturl: "http://192.168.10.100:8080"
  restuser: ""
  secretNamespace: ""
  secretName: ""
allowVolumeExpansion: true

apiVersion: storage.k8s.io/v1
kind: VolumeAttachment
metadata:
  annotations:
    csi.alpha.kubernetes.io/node-id: test-vpc-k8s-worker06
# 注解中指定了 node-id，用来表明该 VolumeAttachment 所属的节点;这有助于 CSI 驱动定位挂载目标节点
finalizers:
  - external-attacher/evs-csi-huawei-cn
# 这里 external-attacher/evs-csi-huawei-cn 表示该卷在删除前需要由 evs-csi-huawei-cn 驱动的 external-attacher 进行卸载操作
# 只有在 ControllerUnpublishVolume 成功完成并移除 finalizer 后，VolumeAttachment 才会真正被删除
name: csi-0dc8eaebe8d1f7dc6e035ec06be0dc926f17e7da71edda5fe7a0cdda34d774bc
# csi-0dc8eaebe8d1f7dc6e035ec06be0dc926f17e7da71edda5fe7a0cdda34d774bc VolumeAttachment 对象的名称;
# 通常由 CSI 驱动生成一个唯一的 ID,用于标识此挂载请求
spec:
  attacher: evs-csi-huawei-cn
# 用于指定 CSI 驱动的名称，表明哪个驱动程序负责处理此挂载请求
  nodeName: test-vpc-k8s-worker06
# 指定将卷挂载到的节点名称
  source:
    persistentVolumeName:pvc-19ea9ae8-8b42-45ad-9bcf-7ba216c1c87c
status:
  # 表示挂载状态，通常由 CSI 驱动更新
  attached: true
  # 布尔值，表示卷是否已成功挂载
  attachmentMetadata:
    # 可选字段，包含 CSI 驱动在挂载过程中生成的元数据（例如设备路径）
    evs-csi-huawei-cn/volume-name:pvc-19ea9ae8-8b42-45ad-9bcf-7ba216c1c87c

apiVersion: storage.k8s.io/v1beta1
kind: VolumeAttributesClass
metadata:
  name: silver
driverName: pd.csi.storage.gke.io
parameters:
  provisioned-iops: "3000"
  provisioned-throughput: "50" 
------
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: example-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  volumeAttributesClassName: example-va-class

apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: my-csi-driver
spec:
  attachRequired: true
  podInfoOnMount: true
  volumeLifecycleModes:
    - Persistent
  storageCapacity: true
  topologyAware: true

kind: StorageVersionMigration
apiVersion: storagemigration.k8s.io/v1alpha1
metadata:
  name: secrets-migration
spec:
  resource:
    group: ""
    version: v1
    resource: secrets

apiVersion: authentication.k8s.io/v1
kind: TokenRequest
spec:
  audiences:
  - "https://example.com"  # 这里应该填写你希望令牌有效的受众（audience），通常是 API 服务器的地址或某个特定的服务
  boundObjectRef:
    apiVersion: v1
    kind: ServiceAccount
    name: your-service-account-name  # 替换为你的服务账户名称
    namespace: your-namespace  # 替换为你的命名空间
  expirationSeconds: 86400  # 令牌的过期时间（秒），默认为1小时（3600秒），这里设置为24小时

apiVersion: authentication.k8s.io/v1
kind: TokenReview
spec:
  token: <YOUR_TOKEN_HERE>

{
  "apiVersion": "authentication.k8s.io/v1",
  "kind": "TokenReview",
  "status": {
    "authenticated": true,
    "user": {
      "username": "system:serviceaccount:<your-namespace>:<your-service-account>",
      "uid": "<uid>",
      "groups": [
        "system:serviceaccounts",
        "system:serviceaccounts:<your-namespace>",
        "system:authenticated"
      ],
      "extra": {
        "kubernetes.io/serviceaccount/namespace": [
          "<your-namespace>"
        ],
        "kubernetes.io/serviceaccount/secret.name": [
          "<your-secret-name>"
        ],
        "kubernetes.io/serviceaccount/secret.uid": [
          "<secret-uid>"
        ],
        "kubernetes.io/serviceaccount/name": [
          "<your-service-account>"
        ]
      }
    }
  }
}

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system

apiVersion: authorization.k8s.io/v1
kind: SelfSubjectReview

apiVersion: authentication.k8s.io/v1alpha1
kind: SelfSubjectReview
status:
  userInfo:
    username: jane.doe
    uid: b79dbf30-0c6a-11ed-861d-0242ac120002
    groups:
    - students
    - teachers
    - system:authenticated
    extra:
      skills:
      - reading
      - learning
      subjects:
      - math
      - sports

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: liruilong
spec:
  signerName: kubernetes.io/kube-apiserver-client
  request: LS0tLS1CRUdJTiBDRVJUSUZJ...............
  usages:
  - client auth

kubectl certificate approve liruilong

apiVersion: certificates.k8s.io/v1alpha1
kind: ClusterTrustBundle
metadata:
  name: example-trust-bundle
spec:
  trustBundle: |
    -----BEGIN CERTIFICATE-----
    MIIDQTCCAimgAwIBAgIThAOxVoDEnEXQfankuXrJestQDzANBgkqhkiG9w0BAQsF
    ADAVMRMwEQYDVQQDEwpleGFtcGxlLmNvbTAeFw0xNTEyMTYwMTI1MjZaFw0yMDEy
    MTUwMTI1MjZaMBUxEzARBgNVBAMTCmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0B
    AQEFAAOCAQ8AMIIBCgKCAQEA7bYaCSHxc91o4LRXzxxtVufus1OqV6dMJFEKTIE5
    z23f6BbQoiX4kS/ALCaRj+BPJj+IxstD7M0iDCHVH0jW43yDK2qai0FvgZPuD9vY
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    MIIDAzCCAeugAwIBAgIQCHMGwmqMm8SQR/vdxwIrODANBgkqhkiG9w0BAQsFADAV
    MRMwEQYDVQQDEwpleGFtcGxlLmNvbTAeFw0xNTEyMTYwMTI1MjZaFw0yMDEyMTUw
    MTI1MjZaMBUxEzARBgNVBAMTCmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEF
    AAOCAQ8AMIIBCgKCAQEA7bYaCSHxc91o4LRXzxxtVufus1OqV6dMJFEKTIE5z23f
    6BbQoiX4kS/ALCaRj+BPJj+IxstD7M0iDCHVH0jW43yDK2qai0FvgZPuD9vYKKGs
    -----END CERTIFICATE-----
  signerName: example.com/my-signer

apiVersion: authorization.k8s.io/v1
kind: SelfSubjectAccessReview
metadata:
  name: check-create-pods-in-namespace
spec:
  resourceAttributes:
    namespace: "default"  # 替换为你要检查的命名空间
    verb: "create"
    resource: "pods"

apiVersion: authorization.k8s.io/v1
kind: LocalSubjectAccessReview
spec:
  subjectAccessReviewSpec:
    resourceAttributes:
      namespace: default
      verb: get
      group: apps
      resource: deployments
    user: alice
    group:
    - team-a
    - team-b

status:
  allowed: true

apiVersion: authorization.k8s.io/v1
kind: SubjectAccessReview
metadata:
  name: check-pods-list-cluster-wide
spec:
  user: "example-user"
  resourceAttributes:
    verb: "list"
    resource: "pods"

apiVersion: authorization.k8s.io/v1
kind: SelfSubjectRulesReview
spec:
  namespace: default

apiVersion: authorization.k8s.io/v1
kind: SelfSubjectRulesReview
status:
  evaluationError: ""
  incomplete: false
  nonResourceRules:
  - apiGroups: [""]
    nonResourceURLs: ["/healthz", "/version", "/openapi/*"]
    verbs: ["get"]
  resourceRules:
  - apiGroups: ["apps", ""]
    resourceNames: []
    resources: ["deployments", "replicasets", "pods"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
rules:
- apiGroups:
  - ''
  resources:
  - secrets
  verbs:
  - create
- apiGroups:
  - ''
  resources:
  - secrets
  resourceNames:
  - memberlist
  verbs:
  - list
- apiGroups:
  - apps
  resources:
  - deployments
  resourceNames:
  - controller
  verbs:
  - get

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: controller
subjects:
- kind: ServiceAccount
  name: controller