Menu Close

Red Hat Training

A Red Hat training course is available for OpenShift Container Platform

31.2. 全局禁用构建策略

要在全局范围内阻止对特定构建策略的访问,请以具有 cluster-admin 特权的用户身份登录,从 system:authenticated 组中移除对应的角色,再应用注解 openshift.io/reconcile-protect: "true" 以防止它们在 API 重启后更改。以下示例演示了如何禁用 Docker 构建策略。

  1. 应用 openshift.io/reconcile-protect 注解

    $ oc edit clusterrolebinding system:build-strategy-docker-binding
    
    apiVersion: v1
    groupNames:
    - system:authenticated
    kind: ClusterRoleBinding
    metadata:
      annotations:
        openshift.io/reconcile-protect: "true" 1
      creationTimestamp: 2018-08-10T01:24:14Z
      name: system:build-strategy-docker-binding
      resourceVersion: "225"
      selfLink: /oapi/v1/clusterrolebindings/system%3Abuild-strategy-docker-binding
      uid: 17b1f3d4-9c3c-11e8-be62-0800277d20bf
    roleRef:
      name: system:build-strategy-docker
    subjects:
    - kind: SystemGroup
      name: system:authenticated
    userNames:
    - system:serviceaccount:management-infra:management-admin
    1
    openshift.io/reconcile-protect 注解的值改为 "true"。默认情况下,它被设置为 "false"。
  2. 移除角色:

    $ oc adm policy remove-cluster-role-from-group system:build-strategy-docker system:authenticated

在 3.2 之前的版本中,构建策略子资源包含在 admin 和 edit 角色中。

确保也从这些角色中移除构建策略子资源:

$ oc edit clusterrole admin
$ oc edit clusterrole edit

对于每个角色,移除与要禁用的策略资源对应的行。

admin禁用 Docker 构建策略

kind: ClusterRole
metadata:
  name: admin
...
rules:
- resources:
  - builds/custom
  - builds/docker 1
  - builds/source
  ...
...

1
删除此行,以在全局范围内禁止具有 admin 角色的用户进行 Docker 构建。