RBAC Manager 是一個(gè)使用自定義資源對(duì) RBAC 進(jìn)行聲明式配置的 Operator，它的目標(biāo)是簡(jiǎn)化 Kubernetes 的授權(quán)，減少授權(quán)所需的配置量，使其更易擴(kuò)展。例如， 有如下兩個(gè)原生的 RoleBinding 配置清單：

kind:?RoleBinding
apiVersion:?rbac.authorization.k8s.io/v1
metadata:
??name:?joe-web
??namespace:?web
subjects:
-?kind:?User
??name:?joe@example.com
roleRef:
??kind:?ClusterRole
??name:?edit
??apiGroup:?rbac.authorization.k8s.io

kind:?RoleBinding
apiVersion:?rbac.authorization.k8s.io/v1
metadata:
??name:?joe-api
??namespace:?api
subjects:
-?kind:?User
??name:?joe@example.com
roleRef:
??kind:?ClusterRole
??name:?view
??apiGroup:?rbac.authorization.k8s.io

使用 RBAC Manager 后只需一個(gè)自定義資源即可實(shí)現(xiàn)相同的授權(quán)：

apiVersion:?rbacmanager.reactiveops.io/v1beta1
kind:?RBACDefinition
metadata:
??name:?joe-access
rbacBindings:
??-?name:?joe
????subjects:
??????-?kind:?User
????????name:?joe@example.com
????roleBindings:
??????-?namespace:?api
????????clusterRole:?view
??????-?namespace:?web
????????clusterRole:?edit