创建RoleBindingcreateRbacAuthorizationV1NamespacedRoleBinding_RoleBinding

华为云计算云知识创建RoleBindingcreateRbacAuthorizationV1NamespacedRoleBinding

新客秒杀 2核2G 3M L实例

68元/年

普惠上云领千元上云礼券

立即前往

企业专享 X实例 4核8G 5M

888元/年

热门域名 1元随心购

1元/年起

创建RoleBindingcreateRbacAuthorizationV1NamespacedRoleBinding

时间: 2023-12-25 15:40:43

猜你想看：

实时语音识别云服务器配置 CDN是什么意思视频点播加速什么是云桌面

功能介绍

This API is used to create a RoleBinding

调用方法

请参见如何调用API。

URI

POST /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings

表1 路径参数
参数	是否必选	参数类型	描述
namespace	是	String	object name and auth scope, such as for teams and projects

表2 Query参数
参数	是否必选	参数类型	描述
dryRun	否	String	When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
fieldManager	否	String	fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
pretty	否	String	If 'true', then the output is pretty printed.

请求参数

表3 请求Header参数
参数	是否必选	参数类型	描述
X-Auth-Token	是	String	用户Token。通过调用 IAM 服务获取用户Token接口获取（响应消息头中X-Subject-Token的值）。
Content-Type	是	String	消息体的类型（格式），默认取值为“application/json” 缺省值：application/json

表4 请求Body参数
参数	是否必选	参数类型	描述
apiVersion	否	String	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind	否	String	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata	否	io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta object	Standard object's metadata.
roleRef	是	io.k8s.api.rbac.v1.RoleRef object	RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.
subjects	否	Array of io.k8s.api.rbac.v1.Subject objects	Subjects holds references to the objects the role applies to.

表5 io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
参数	是否必选	参数类型	描述
annotations	否	Map<String,String>	Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
clusterName	否	String	The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
creationTimestamp	否	String	CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
deletionGracePeriodSeconds	否	Long	Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
deletionTimestamp	否	String	DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
finalizers	否	Array of strings	Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
generateName	否	String	GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
generation	否	Long	A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
labels	否	Map<String,String>	Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels
managedFields	否	Array of io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry objects	ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
name	否	String	Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names
namespace	否	String	Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces
ownerReferences	否	Array of io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference objects	List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
resourceVersion	否	String	An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
selfLink	否	String	SelfLink is a URL representing this object. Populated by the system. Read-only. DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.
uid	否	String	UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

表6 io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
参数	是否必选	参数类型	描述
apiVersion	否	String	APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
fieldsType	否	String	FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
fieldsV1	否	Object	FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
manager	否	String	Manager is an identifier of the workflow managing these fields.
operation	否	String	Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
time	否	String	Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'

表7 io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference
参数	是否必选	参数类型	描述
apiVersion	是	String	API version of the referent.
blockOwnerDeletion	否	Boolean	If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
controller	否	Boolean	If true, this reference points to the managing controller.
kind	是	String	Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
name	是	String	Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
uid	是	String	UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

表8 io.k8s.api.rbac.v1.RoleRef
参数	是否必选	参数类型	描述
apiGroup	是	String	APIGroup is the group for the resource being referenced
kind	是	String	Kind is the type of resource being referenced
name	是	String	Name is the name of resource being referenced

表9 io.k8s.api.rbac.v1.Subject
参数	是否必选	参数类型	描述
apiGroup	否	String	APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
kind	是	String	Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
name	是	String	Name of the object being referenced.
namespace	否	String	Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.

响应参数

状态码： 200

**表10** 响应Body参数
参数	参数类型	描述
apiVersion	String	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind	String	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata	io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta object	Standard object's metadata.
roleRef	io.k8s.api.rbac.v1.RoleRef object	RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.
subjects	Array of io.k8s.api.rbac.v1.Subject objects	Subjects holds references to the objects the role applies to.

**表11** io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
参数	参数类型	描述
annotations	Map<String,String>	Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
clusterName	String	The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
creationTimestamp	String	CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
deletionGracePeriodSeconds	Long	Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
deletionTimestamp	String	DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
finalizers	Array of strings	Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
generateName	String	GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
generation	Long	A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
labels	Map<String,String>	Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels
managedFields	Array of io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry objects	ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
name	String	Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names
namespace	String	Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces
ownerReferences	Array of io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference objects	List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
resourceVersion	String	An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
selfLink	String	SelfLink is a URL representing this object. Populated by the system. Read-only. DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.
uid	String	UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

**表12** io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
参数	参数类型	描述
apiVersion	String	APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
fieldsType	String	FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
fieldsV1	Object	FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
manager	String	Manager is an identifier of the workflow managing these fields.
operation	String	Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
time	String	Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'

**表13** io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference
参数	参数类型	描述
apiVersion	String	API version of the referent.
blockOwnerDeletion	Boolean	If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
controller	Boolean	If true, this reference points to the managing controller.
kind	String	Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
name	String	Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
uid	String	UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

**表14** io.k8s.api.rbac.v1.RoleRef
参数	参数类型	描述
apiGroup	String	APIGroup is the group for the resource being referenced
kind	String	Kind is the type of resource being referenced
name	String	Name is the name of resource being referenced

**表15** io.k8s.api.rbac.v1.Subject
参数	参数类型	描述
apiGroup	String	APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
kind	String	Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
name	String	Name of the object being referenced.
namespace	String	Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.

状态码： 201

**表16** 响应Body参数
参数	参数类型	描述
apiVersion	String	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind	String	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata	io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta object	Standard object's metadata.
roleRef	io.k8s.api.rbac.v1.RoleRef object	RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.
subjects	Array of io.k8s.api.rbac.v1.Subject objects	Subjects holds references to the objects the role applies to.

**表17** io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
参数	参数类型	描述
annotations	Map<String,String>	Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
clusterName	String	The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
creationTimestamp	String	CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
deletionGracePeriodSeconds	Long	Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
deletionTimestamp	String	DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
finalizers	Array of strings	Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
generateName	String	GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
generation	Long	A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
labels	Map<String,String>	Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels
managedFields	Array of io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry objects	ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
name	String	Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names
namespace	String	Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces
ownerReferences	Array of io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference objects	List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
resourceVersion	String	An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
selfLink	String	SelfLink is a URL representing this object. Populated by the system. Read-only. DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.
uid	String	UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

**表18** io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
参数	参数类型	描述
apiVersion	String	APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
fieldsType	String	FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
fieldsV1	Object	FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
manager	String	Manager is an identifier of the workflow managing these fields.
operation	String	Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
time	String	Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'

**表19** io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference
参数	参数类型	描述
apiVersion	String	API version of the referent.
blockOwnerDeletion	Boolean	If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
controller	Boolean	If true, this reference points to the managing controller.
kind	String	Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
name	String	Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
uid	String	UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

**表20** io.k8s.api.rbac.v1.RoleRef
参数	参数类型	描述
apiGroup	String	APIGroup is the group for the resource being referenced
kind	String	Kind is the type of resource being referenced
name	String	Name is the name of resource being referenced

**表21** io.k8s.api.rbac.v1.Subject
参数	参数类型	描述
apiGroup	String	APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
kind	String	Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
name	String	Name of the object being referenced.
namespace	String	Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.

状态码： 202

**表22** 响应Body参数
参数	参数类型	描述
apiVersion	String	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind	String	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata	io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta object	Standard object's metadata.
roleRef	io.k8s.api.rbac.v1.RoleRef object	RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.
subjects	Array of io.k8s.api.rbac.v1.Subject objects	Subjects holds references to the objects the role applies to.

**表23** io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
参数	参数类型	描述
annotations	Map<String,String>	Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
clusterName	String	The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
creationTimestamp	String	CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
deletionGracePeriodSeconds	Long	Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
deletionTimestamp	String	DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
finalizers	Array of strings	Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
generateName	String	GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
generation	Long	A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
labels	Map<String,String>	Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels
managedFields	Array of io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry objects	ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
name	String	Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names
namespace	String	Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces
ownerReferences	Array of io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference objects	List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
resourceVersion	String	An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
selfLink	String	SelfLink is a URL representing this object. Populated by the system. Read-only. DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.
uid	String	UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

**表24** io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
参数	参数类型	描述
apiVersion	String	APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
fieldsType	String	FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
fieldsV1	Object	FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
manager	String	Manager is an identifier of the workflow managing these fields.
operation	String	Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
time	String	Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'

**表25** io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference
参数	参数类型	描述
apiVersion	String	API version of the referent.
blockOwnerDeletion	Boolean	If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
controller	Boolean	If true, this reference points to the managing controller.
kind	String	Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
name	String	Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
uid	String	UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

**表26** io.k8s.api.rbac.v1.RoleRef
参数	参数类型	描述
apiGroup	String	APIGroup is the group for the resource being referenced
kind	String	Kind is the type of resource being referenced
name	String	Name is the name of resource being referenced

**表27** io.k8s.api.rbac.v1.Subject
参数	参数类型	描述
apiGroup	String	APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
kind	String	Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
name	String	Name of the object being referenced.
namespace	String	Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.

请求示例

创建RoleBinding，将"rbac-test"命名空间中的用户组绑定到名称为"view"的ClusterRole下。

{
  "apiVersion" : "rbac.authorization.k8s.io/v1",
  "kind" : "RoleBinding",
  "metadata" : {
    "name" : "clusterrole_view_User_07b82a44a680d5661f01c00b448f8f50",
    "namespace" : "rbac-test"
  },
  "roleRef" : {
    "apiGroup" : "rbac.authorization.k8s.io",
    "kind" : "ClusterRole",
    "name" : "view"
  },
  "subjects" : [ {
    "apiGroup" : "rbac.authorization.k8s.io",
    "kind" : "User",
    "name" : "07b82a44a680d5661f01c00b448f8f50"
  } ]
}

响应示例

状态码： 200

{
  "apiVersion" : "rbac.authorization.k8s.io/v1",
  "kind" : "RoleBinding",
  "metadata" : {
    "creationTimestamp" : "2020-04-07T08:25:46Z",
    "name" : "clusterrole_view_User_07b82a44a680d5661f01c00b448f8f50",
    "namespace" : "rbac-test",
    "resourceVersion" : "230511279",
    "selfLink" : "/apis/rbac.authorization.k8s.io/v1/namespaces/rbac-test/rolebindings/clusterrole_view_User_07b82a44a680d5661f01c00b448f8f50",
    "uid" : "6163c216-78a9-11ea-bcc5-340a9837e2a7"
  },
  "roleRef" : {
    "apiGroup" : "rbac.authorization.k8s.io",
    "kind" : "ClusterRole",
    "name" : "view"
  },
  "subjects" : [ {
    "apiGroup" : "rbac.authorization.k8s.io",
    "kind" : "User",
    "name" : "07b82a44a680d5661f01c00b448f8f50"
  } ]
}

状态码

状态码	描述
200	OK
201	Created
202	Accepted
400	BadRequest
401	Unauthorized
403	Forbidden
404	NotFound
405	MethodNotAllowed
406	NotAcceptable
409	AlreadyExists
415	UnsupportedMediaType
422	Invalid
429	TooManyRequests
500	InternalError
503	ServiceUnavailable
504	ServerTimeout

上一篇：Scrum Master是什么下一篇：当网络卡顿遇见华为云CDN

功能介绍

调用方法

URI

请求参数

响应参数

请求示例

响应示例

状态码

最新文章

更多内容

7*24

备案

专业服务

退订

建议反馈

售前咨询热线