容器服务
容器服务
容器服务
文档指南
请输入
容器服务 VKE
产品动态
Kubernetes 版本发布记录
组件发布记录
监控组件
DNS 组件
GPU 组件
Sandbox 组件
安全公告
产品公告
历史公告
用户指南
集群
节点池
授权
网络
容器网络
服务（Service）
路由（Ingress）
APIG Ingress
ALB Ingress
自定义转发规则配置示例
CLB Ingress
Nginx Ingress
Gateway API
工作负载
存储
数据管理中心（DMC）
对象存储（TOS）
FSX 访问方式
文件存储（NAS）
FSX 访问方式
弹性文件存储（EFS）
文件存储（vePFS）
FSX 访问方式
vePFS Client 访问方式
NFS 访问方式
大数据文件存储（CloudFS）
弹性伸缩
工作负载弹性伸缩
事件驱动伸缩（KEDA）
组件管理
网络组件
监控组件
DNS 组件
GPU 组件
Sandbox 组件
异构计算
调度管理
可观测性
基础观测
诊断与巡检
最佳实践
网络
可观测性
安全合规
API 参考
集群管理
节点池管理
组件管理
机型镜像管理
云原生观测
巡检诊断
弹性容器实例
附录
开发指南
常见问题
通用 FAQ
集群 FAQ
集群管理
集群升级
节点与节点池 FAQ
授权 FAQ
工作负载 FAQ
服务与路由 FAQ
存储 FAQ
弹性伸缩 FAQ
可观测性 FAQ
配额 FAQ
组件 FAQ
容器镜像 FAQ
AI 云原生
推理套件
Helm 模板 AI 应用
Deepseek 实践
Qwen 实践
最佳实践
MiniMax 模型部署
Qwen 模型部署
弹性容器实例 VCI
最新动态
用户指南
虚拟节点
VKE 集群使用虚拟节点
自建/跨云集群使用虚拟节点
创建 VCI 实例
VCI Agent Sandbox
安全合规
- 文档首页
容器服务容器服务 VKE用户指南授权RBAC 权限RBAC 权限角色说明
复制全文
下载 pdfRBAC 权限角色说明
文档反馈
问问助手本文主要描述 RBAC 角色的中文名称与对应的 ClusterRole 英文名，以及在 Kubernetes 中的对应权限名称说明。
ClusterRole 命名说明
RBAC 访问权限角色 | ClusterRole 名称 | Kubernetes 权限名称 |
RBAC 访问权限角色 | ClusterRole 名称 | Kubernetes 权限名称 |
集群管理员 | vke:admin | |
运维管理员 | vke:ops | |
高权限开发人员 | vke:dev-promoted | |
开发人员 | vke:dev | |
只读用户 | vke:visitor |
Kubernetes 权限名称说明
vke:admin
执行如下命令，查看vke:admin对应的 Kubernetes 权限详情。
kubectl get ClusterRole vke:admin --output=yaml
预期输出结果：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.0
name: vke:admin
resourceVersion: "308"
uid: f79ed7ee-2c92-4074-9b00-359d********
rules:
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
- nonResourceURLs:
- '*'
verbs:
- '*'
vke:ops
执行如下命令，查看vke:ops对应的 Kubernetes 权限详情。
kubectl get clusterrole vke:ops --output=yaml
预期输出结果：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
argocd.argoproj.io/instance: vke-resource-controller
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.6
name: vke:ops
resourceVersion: "37760530"
uid: 85d4a166-1acf-4cd0-8ef1-2bf5********
rules:
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
- pods/eviction
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- namespaces
- nodes
- persistentvolumes
- configmaps
- endpoints
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
- limitranges
- resourcequotas
- resourcequotas/status
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- bindings
- events
- namespaces/status
- replicationcontrollers/status
- pods/log
- pods/status
- componentstatuses
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- apiGroups:
- apps
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- controllerrevisions
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- ingresses
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- networking.k8s.io
resources:
- '*'
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterserviceclasses
- clusterserviceplans
- clusterservicebrokers
- serviceinstances
- servicebindings
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterservicebrokers/status
- clusterserviceclasses/status
- clusterserviceplans/status
- serviceinstances/status
- serviceinstances/reference
- servicebindings/status
verbs:
- update
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- vke.volcengine.com
resources:
- cronhpas
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- appinspect.elkeid.bytedance.com
resources:
- secinspectpolicies
- secinspectreports
- secinspectrunconfigs
- secinspectclusterreports
verbs:
- get
- list
- watch
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
vke:dev-promoted
执行如下命令，查看vke:dev-promoted对应的 Kubernetes 权限详情。
kubectl get clusterrole vke:dev-promoted --output=yaml
预期输出结果：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.4
name: vke:dev-promoted
resourceVersion: "37760524"
uid: 7baff690-a3eb-4ab4-b5b2-4ff3********
rules:
- apiGroups:
- ""
resources:
- nodes
- persistentvolumes
- limitranges
- resourcequotas
verbs:
- get
- list
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- get
- list
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
vke:dev
执行如下命令，查看vke:dev对应的 Kubernetes 权限详情。
kubectl get clusterrole vke:dev --output=yaml
预期输出结果：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
argocd.argoproj.io/instance: vke-resource-controller
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.5
name: vke:dev
resourceVersion: "37760513"
uid: a6917647-e8c8-429d-abe5-b381********
rules:
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
- persistentvolumeclaims
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- events
- namespaces/status
- replicationcontrollers/status
- pods/log
- pods/status
- componentstatuses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- namespaces
- nodes
- persistentvolumes
- limitranges
- resourcequotas
- resourcequotas/status
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- controllerrevisions
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- ingresses
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- networking.k8s.io
resources:
- '*'
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterserviceclasses
- clusterserviceplans
- clusterservicebrokers
- serviceinstances
- servicebindings
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterservicebrokers/status
- clusterserviceclasses/status
- clusterserviceplans/status
- serviceinstances/status
- serviceinstances/reference
- servicebindings/status
verbs:
- update
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- watch
- apiGroups:
- vke.volcengine.com
resources:
- cronhpas
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- appinspect.elkeid.bytedance.com
resources:
- secinspectpolicies
- secinspectreports
- secinspectrunconfigs
- secinspectclusterreports
verbs:
- get
- list
- watch
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
vke:visitor
执行如下命令，查看vke:visitor对应的 Kubernetes 权限详情。
kubectl get clusterrole vke:visitor --output=yaml
预期输出结果：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.4
name: vke:visitor
resourceVersion: "307"
uid: 0174b6f8-cde5-411d-bb01-b34f********
rules:
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- endpoints
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- serviceaccounts
- services
- services/proxy
- namespaces
- nodes
- persistentvolumes
- limitranges
- resourcequotas
- resourcequotas/status
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
- replicationcontrollers/status
- pods/log
- pods/status
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- controllerrevisions
verbs:
- get
- list
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- get
- list
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- ingresses
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterserviceclasses
- clusterserviceplans
- clusterservicebrokers
- serviceinstances
- servicebindings
verbs:
- get
- list
- watch
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- get
- list
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- watch
- apiGroups:
- vke.volcengine.com
resources:
- cronhpas
verbs:
- get
- list
- watch
- apiGroups:
- appinspect.elkeid.bytedance.com
resources:
- secinspectpolicies
- secinspectreports
- secinspectrunconfigs
- secinspectclusterreports
verbs:
- get
- list
- watch
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- get
- list
- watch
最近更新时间：2026.02.12 20:22:01
这个页面对您有帮助吗？
有用
有用
无用
无用