您需要为系统创建角色：匿名用户在您的命名空间中观察pod，类似于下面的yaml

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: spark # your namespace
name: pod-reader # Role name will be needed for binding to user
rules:

• apiGroups: [""] # "" indicates the core API group
  resources: ["pods"]

verbs: ["get", "watch", "list"]
然后，您需要创建RoleBindging以将此角色绑定到系统：匿名用户与yaml类似

This role binding allows "system:anonymous" to read pods in the "spark" namespace.

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: read-pods
namespace: spark # your namespace
subjects:

• kind: User
  name: system:anonymous # Name is case sensitive

apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role #this must be Role or ClusterRole
name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
apiGroup: rbac.authorization.k8s.io