建立一個lichuan 只能管理lichuan-dev這個namespace

#下載證書製作軟體
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.4.1/cfssl_1.4.1_linux_amd64 -o cfssl
chmod +x cfssl
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.4.1/cfssljson_1.4.1_linux_amd64 -o cfssljson
chmod +x cfssljson
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.4.1/cfssl-certinfo_1.4.1_linux_amd64 -o cfssl-certinfo
 

chmod +x cfssl-certinfo

cp cfssl* /usr/local/bin

#這裡的CN就會作為使用者名稱，而O就為作為使用者組名，例如建立 lichuan-csr.json檔案如下
{
  "CN": "lichuan",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
     {
       "C": "CN",
       "L": "Beijing",
       "O": "Beijing",
       "OU": "k8s-dev",
       "ST": "System
 
"
     }
  ]
}

#根據上面的請求資訊生成CA認證後的使用者證書和私鑰
cfssl gencert -ca=/etc/kubernetes/pki/ca.crt -ca-key=/etc/kubernetes/pki/ca.key -profile=kubernetes lichuan-csr.json | cfssljson -bare lichuan


#生成使用者專屬的認證config檔案
kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/pki/ca.crt --embed-certs=true
 
 --server=https://10.3.65.37:6443 --kubeconfig=lichuan.config

#設定客戶端認證證書
kubectl config set-credentials lichuan --client-certificate=/etc/kubernetes/pki/lichuan.pem --client-key=/etc/kubernetes/pki/lichuan-key.pem --embed-certs=true --kubeconfig=lichuan.config

#建立一個新的namespace
kubectl create namespace lichuan-dev

#給lichuan使用者設定context
kubectl config set-context kubernetes --cluster=kubernetes --user=lichuan --namespace=lichuan-dev --kubeconfig=lichuan.config
#設定下current-context
kubectl config use-context kubernetes --kubeconfig=lichuan.config

#做rolebinding
kubectl create rolebinding lichuan-admin-dev-binding --clusterrole=admin --user=lichuan --namespace=lichuan-dev

參考：https://blog.csdn.net/Victor2code/article/details/106143273

https://www.qikqiak.com/k8s-book/docs/30.RBAC.html

第二個有建立角色的，可以參考，第一個預設用的admin，自帶的，許可權大

https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb

官網：https://kubernetes.io/zh/docs/reference/access-authn-authz/rbac/