minishift V1.29.0でRBACを確認する

# はじめに

年末から挑戦しているopenshift namespaceにイメージをインポートするですが
結局失敗ばかりで自プロジェクトにイメージをインポートしておりました。

そこで、目を背けてきたRBACを確認したいと思います。


# 現在のユーザのできることを確認する(`oc policy can-i --list`)

OpenShiftにログインして現在のユーザでできることを確認します。
因みにこのコマンド`oc policy can-i --list`はdeprecatedらしいです。
`oc auth can-i`を使えって言われてるけど使いません(笑)

まずは`system`から

```bash
[tak@centos76 ~]$ oc login $(minishift ip):8443 -u system -p admin
Login successful.

You don't have any projects. You can try to create a new project, by running

    oc new-project <projectname>

[tak@centos76 ~]$ oc policy can-i --list
Command "can-i" is deprecated, use 'oc auth can-i'
VERBS              NON-RESOURCE URLS        RESOURCE NAMES   API GROUPS                     RESOURCES
[create]           []                       []               [authorization.k8s.io]         [selfsubjectaccessreviews]
[create]           []                       []               []                             [selfsubjectrulesreviews]
[create]           []                       []               [authorization.openshift.io]   [selfsubjectrulesreviews]
[create get]       []                       []               []                             [buildconfigs/webhooks]
[create get]       []                       []               [build.openshift.io]           [buildconfigs/webhooks]
[create list]      []                       []               []                             [projectrequests]
[create list]      []                       []               [project.openshift.io]         [projectrequests]
[create]           []                       []               []                             [builds/docker]
[create]           []                       []               []                             [builds/jenkinspipeline]
[create]           []                       []               []                             [builds/optimizeddocker]
[create]           []                       []               []                             [builds/source]
[create]           []                       []               [authorization.k8s.io]         [selfsubjectrulesreviews]
[create]           []                       []               [build.openshift.io]           [builds/docker]
[create]           []                       []               [build.openshift.io]           [builds/jenkinspipeline]
[create]           []                       []               [build.openshift.io]           [builds/optimizeddocker]
[create]           []                       []               [build.openshift.io]           [builds/source]
[delete]           []                       []               []                             [oauthaccesstokens]
[delete]           []                       []               []                             [oauthauthorizetokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthaccesstokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthauthorizetokens]
[get list watch]   []                       []               [rbac.authorization.k8s.io]    [clusterroles]
[get list]         []                       []               []                             [clusterroles]
[get list]         []                       []               [authorization.openshift.io]   [clusterroles]
[get list]         []                       []               [storage.k8s.io]               [storageclasses]
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/]                      []               []                             []
[get]              [/]                      []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/healthz/*]             []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/openapi/*]             []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi]               []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/]              []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              []                       [~]              []                             [users]
[get]              []                       [~]              [user.openshift.io]            [users]
[impersonate]      []                       []               [authentication.k8s.io]        [userextras/scopes.authorization.openshift.io]
[list watch]       []                       []               []                             [projects]
[list watch]       []                       []               [project.openshift.io]         [projects]
```

次に`Developer`で`openshift` namespaceの権限を確認します。

```bash
[tak@centos76 ~]$ oc login $(minishift ip):8443 -u developer
Logged into "https://192.168.42.233:8443" as "developer" using existing credentials.

You have one project on this server: "<your_project>"

Using project "<your_project>".
[tak@centos76 ~]$ oc policy can-i --list -n openshift
Command "can-i" is deprecated, use 'oc auth can-i'
VERBS              NON-RESOURCE URLS        RESOURCE NAMES   API GROUPS                     RESOURCES
[create]           []                       []               [authorization.k8s.io]         [selfsubjectaccessreviews]
[create]           []                       []               []                             [selfsubjectrulesreviews]
[create]           []                       []               [authorization.openshift.io]   [selfsubjectrulesreviews]
[create get]       []                       []               []                             [buildconfigs/webhooks]
[create get]       []                       []               [build.openshift.io]           [buildconfigs/webhooks]
[create]           []                       []               []                             [builds/docker]
[create]           []                       []               []                             [builds/jenkinspipeline]
[create]           []                       []               []                             [builds/optimizeddocker]
[create]           []                       []               []                             [builds/source]
[create]           []                       []               [authorization.k8s.io]         [selfsubjectrulesreviews]
[create]           []                       []               [build.openshift.io]           [builds/docker]
[create]           []                       []               [build.openshift.io]           [builds/jenkinspipeline]
[create]           []                       []               [build.openshift.io]           [builds/optimizeddocker]
[create]           []                       []               [build.openshift.io]           [builds/source]
[delete]           []                       []               []                             [oauthaccesstokens]
[delete]           []                       []               []                             [oauthauthorizetokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthaccesstokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthauthorizetokens]
[get list watch]   []                       []               []                             [imagestreamimages]
[get list watch]   []                       []               []                             [imagestreams]
[get list watch]   []                       []               []                             [imagestreamtags]
[get list watch]   []                       []               []                             [templates]
[get list watch]   []                       []               [image.openshift.io]           [imagestreamimages]
[get list watch]   []                       []               [image.openshift.io]           [imagestreams]
[get list watch]   []                       []               [image.openshift.io]           [imagestreamtags]
[get list watch]   []                       []               [rbac.authorization.k8s.io]    [clusterroles]
[get list watch]   []                       []               [template.openshift.io]        [templates]
[get list]         []                       []               []                             [clusterroles]
[get list]         []                       []               [authorization.openshift.io]   [clusterroles]
[get list]         []                       []               [storage.k8s.io]               [storageclasses]
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/]                      []               []                             []
[get]              [/]                      []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/healthz/*]             []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/openapi/*]             []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi]               []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/]              []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              []                       []               []                             [imagestreams/layers]
[get]              []                       [~]              []                             [users]
[get]              []                       []               [image.openshift.io]           [imagestreams/layers]
[get]              []                       [~]              [user.openshift.io]            [users]
[impersonate]      []                       []               [authentication.k8s.io]        [userextras/scopes.authorization.openshift.io]
[create list]      []                       []               []                             [projectrequests]
[create list]      []                       []               [project.openshift.io]         [projectrequests]
[list watch]       []                       []               []                             [projects]
[list watch]       []                       []               [project.openshift.io]         [projects]
```

次に`Developer`で自プロジェクト`<your_project>`のnamespaceの権限を確認します。

```bash
[tak@centos76 ~]$ oc login $(minishift ip):8443 -u developer
Logged into "https://192.168.42.233:8443" as "developer" using existing credentials.

You have one project on this server: "<your_project>"

Using project "<your_project>".
[tak@centos76 ~]$ oc policy can-i --list -n <your_project>
Command "can-i" is deprecated, use 'oc auth can-i'
VERBS                                                                      NON-RESOURCE URLS        RESOURCE NAMES   API GROUPS                     RESOURCES
[admin edit view]                                                          []                       []               [build.openshift.io]           [jenkins]
[create]                                                                   []                       []               [authorization.k8s.io]         [selfsubjectaccessreviews]
[create]                                                                   []                       []               []                             [selfsubjectrulesreviews]
[create]                                                                   []                       []               [authorization.openshift.io]   [selfsubjectrulesreviews]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [networkpolicies]
[create delete deletecollection get list patch update watch]               []                       []               [networking.k8s.io]            [networkpolicies]
[create delete deletecollection get impersonate list patch update watch]   []                       []               []                             [serviceaccounts]
[create delete deletecollection get list patch update watch]               []                       []               []                             [buildconfigs]
[create delete deletecollection get list patch update watch]               []                       []               []                             [buildlogs]
[create delete deletecollection get list patch update watch]               []                       []               []                             [builds]
[create delete deletecollection get list patch update watch]               []                       []               []                             [configmaps]
[create delete deletecollection get list patch update watch]               []                       []               []                             [deploymentconfigs/scale]
[create delete deletecollection get list patch update watch]               []                       []               []                             [deploymentconfigs]
[create delete deletecollection get list patch update watch]               []                       []               []                             [endpoints]
[create delete deletecollection get list patch update watch]               []                       []               []                             [imagestreamimages]
[create delete deletecollection get list patch update watch]               []                       []               []                             [imagestreammappings]
[create delete deletecollection get list patch update watch]               []                       []               []                             [imagestreams/secrets]
[create delete deletecollection get list patch update watch]               []                       []               []                             [imagestreams]
[create delete deletecollection get list patch update watch]               []                       []               []                             [imagestreamtags]
[create delete deletecollection get list patch update watch]               []                       []               []                             [persistentvolumeclaims]
[create delete deletecollection get list patch update watch]               []                       []               []                             [pods/attach]
[create delete deletecollection get list patch update watch]               []                       []               []                             [pods/exec]
[create delete deletecollection get list patch update watch]               []                       []               []                             [pods/portforward]
[create delete deletecollection get list patch update watch]               []                       []               []                             [pods/proxy]
[create delete deletecollection get list patch update watch]               []                       []               []                             [pods]
[create delete deletecollection get list patch update watch]               []                       []               []                             [processedtemplates]
[create delete deletecollection get list patch update watch]               []                       []               []                             [replicationcontrollers/scale]
[create delete deletecollection get list patch update watch]               []                       []               []                             [replicationcontrollers]
[create delete deletecollection get list patch update watch]               []                       []               []                             [rolebindings]
[create delete deletecollection get list patch update watch]               []                       []               []                             [roles]
[create delete deletecollection get list patch update watch]               []                       []               []                             [routes]
[create delete deletecollection get list patch update watch]               []                       []               []                             [secrets]
[create delete deletecollection get list patch update watch]               []                       []               []                             [services/proxy]
[create delete deletecollection get list patch update watch]               []                       []               []                             [services]
[create delete deletecollection get list patch update watch]               []                       []               []                             [templateconfigs]
[create delete deletecollection get list patch update watch]               []                       []               []                             [templateinstances]
[create delete deletecollection get list patch update watch]               []                       []               []                             [templates]
[create delete deletecollection get list patch update watch]               []                       []               [apps.openshift.io]            [deploymentconfigs/scale]
[create delete deletecollection get list patch update watch]               []                       []               [apps.openshift.io]            [deploymentconfigs]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [daemonsets]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [deployments/rollback]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [deployments/scale]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [deployments]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [replicasets/scale]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [replicasets]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [statefulsets/scale]
[create delete deletecollection get list patch update watch]               []                       []               [apps]                         [statefulsets]
[create delete deletecollection get list patch update watch]               []                       []               [authorization.openshift.io]   [rolebindings]
[create delete deletecollection get list patch update watch]               []                       []               [authorization.openshift.io]   [roles]
[create delete deletecollection get list patch update watch]               []                       []               [autoscaling]                  [horizontalpodautoscalers]
[create delete deletecollection get list patch update watch]               []                       []               [batch]                        [cronjobs]
[create delete deletecollection get list patch update watch]               []                       []               [batch]                        [jobs]
[create delete deletecollection get list patch update watch]               []                       []               [build.openshift.io]           [buildconfigs]
[create delete deletecollection get list patch update watch]               []                       []               [build.openshift.io]           [buildlogs]
[create delete deletecollection get list patch update watch]               []                       []               [build.openshift.io]           [builds]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [daemonsets]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [deployments/rollback]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [deployments/scale]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [deployments]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [ingresses]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [replicasets/scale]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [replicasets]
[create delete deletecollection get list patch update watch]               []                       []               [extensions]                   [replicationcontrollers/scale]
[create delete deletecollection get list patch update watch]               []                       []               [image.openshift.io]           [imagestreamimages]
[create delete deletecollection get list patch update watch]               []                       []               [image.openshift.io]           [imagestreammappings]
[create delete deletecollection get list patch update watch]               []                       []               [image.openshift.io]           [imagestreams/secrets]
[create delete deletecollection get list patch update watch]               []                       []               [image.openshift.io]           [imagestreams]
[create delete deletecollection get list patch update watch]               []                       []               [image.openshift.io]           [imagestreamtags]
[create delete deletecollection get list patch update watch]               []                       []               [policy]                       [poddisruptionbudgets]
[create delete deletecollection get list patch update watch]               []                       []               [rbac.authorization.k8s.io]    [rolebindings]
[create delete deletecollection get list patch update watch]               []                       []               [rbac.authorization.k8s.io]    [roles]
[create delete deletecollection get list patch update watch]               []                       []               [route.openshift.io]           [routes]
[create delete deletecollection get list patch update watch]               []                       []               [template.openshift.io]        [processedtemplates]
[create delete deletecollection get list patch update watch]               []                       []               [template.openshift.io]        [templateconfigs]
[create delete deletecollection get list patch update watch]               []                       []               [template.openshift.io]        [templateinstances]
[create delete deletecollection get list patch update watch]               []                       []               [template.openshift.io]        [templates]
[create delete deletecollection get list patch update watch]               []                       []               []                             [buildconfigs/webhooks]
[create delete deletecollection get list patch update watch]               []                       []               [build.openshift.io]           [buildconfigs/webhooks]
[create]                                                                   []                       []               []                             [buildconfigs/instantiate]
[create]                                                                   []                       []               []                             [buildconfigs/instantiatebinary]
[create]                                                                   []                       []               []                             [builds/clone]
[create]                                                                   []                       []               []                             [builds/docker]
[create]                                                                   []                       []               []                             [builds/jenkinspipeline]
[create]                                                                   []                       []               []                             [builds/optimizeddocker]
[create]                                                                   []                       []               []                             [builds/source]
[create]                                                                   []                       []               []                             [deploymentconfigrollbacks]
[create]                                                                   []                       []               []                             [deploymentconfigs/instantiate]
[create]                                                                   []                       []               []                             [deploymentconfigs/rollback]
[create]                                                                   []                       []               []                             [imagestreamimports]
[create]                                                                   []                       []               []                             [localresourceaccessreviews]
[create]                                                                   []                       []               []                             [localsubjectaccessreviews]
[create]                                                                   []                       []               []                             [podsecuritypolicyreviews]
[create]                                                                   []                       []               []                             [podsecuritypolicyselfsubjectreviews]
[create]                                                                   []                       []               []                             [podsecuritypolicysubjectreviews]
[create]                                                                   []                       []               []                             [resourceaccessreviews]
[create]                                                                   []                       []               []                             [routes/custom-host]
[create]                                                                   []                       []               []                             [subjectaccessreviews]
[create]                                                                   []                       []               []                             [subjectrulesreviews]
[create]                                                                   []                       []               [apps.openshift.io]            [deploymentconfigrollbacks]
[create]                                                                   []                       []               [apps.openshift.io]            [deploymentconfigs/instantiate]
[create]                                                                   []                       []               [apps.openshift.io]            [deploymentconfigs/rollback]
[create]                                                                   []                       []               [authorization.k8s.io]         [localsubjectaccessreviews]
[create]                                                                   []                       []               [authorization.k8s.io]         [selfsubjectrulesreviews]
[create]                                                                   []                       []               [authorization.openshift.io]   [localresourceaccessreviews]
[create]                                                                   []                       []               [authorization.openshift.io]   [localsubjectaccessreviews]
[create]                                                                   []                       []               [authorization.openshift.io]   [resourceaccessreviews]
[create]                                                                   []                       []               [authorization.openshift.io]   [subjectaccessreviews]
[create]                                                                   []                       []               [authorization.openshift.io]   [subjectrulesreviews]
[create]                                                                   []                       []               [build.openshift.io]           [buildconfigs/instantiate]
[create]                                                                   []                       []               [build.openshift.io]           [buildconfigs/instantiatebinary]
[create]                                                                   []                       []               [build.openshift.io]           [builds/clone]
[create]                                                                   []                       []               [build.openshift.io]           [builds/docker]
[create]                                                                   []                       []               [build.openshift.io]           [builds/jenkinspipeline]
[create]                                                                   []                       []               [build.openshift.io]           [builds/optimizeddocker]
[create]                                                                   []                       []               [build.openshift.io]           [builds/source]
[create]                                                                   []                       []               [image.openshift.io]           [imagestreamimports]
[create]                                                                   []                       []               [route.openshift.io]           [routes/custom-host]
[create]                                                                   []                       []               [security.openshift.io]        [podsecuritypolicyreviews]
[create]                                                                   []                       []               [security.openshift.io]        [podsecuritypolicyselfsubjectreviews]
[create]                                                                   []                       []               [security.openshift.io]        [podsecuritypolicysubjectreviews]
[delete]                                                                   []                       []               []                             [oauthaccesstokens]
[delete]                                                                   []                       []               []                             [oauthauthorizetokens]
[delete]                                                                   []                       []               [oauth.openshift.io]           [oauthaccesstokens]
[delete]                                                                   []                       []               [oauth.openshift.io]           [oauthauthorizetokens]
[get list update watch]                                                    []                       []               []                             [routes/status]
[get list update watch]                                                    []                       []               [route.openshift.io]           [routes/status]
[get list watch]                                                           []                       []               []                             [appliedclusterresourcequotas]
[get list watch]                                                           []                       []               []                             [bindings]
[get list watch]                                                           []                       []               []                             [builds/log]
[get list watch]                                                           []                       []               []                             [deploymentconfigs/log]
[get list watch]                                                           []                       []               []                             [deploymentconfigs/status]
[get list watch]                                                           []                       []               []                             [events]
[get list watch]                                                           []                       []               []                             [imagestreams/status]
[get list watch]                                                           []                       []               []                             [limitranges]
[get list watch]                                                           []                       []               []                             [namespaces/status]
[get list watch]                                                           []                       []               []                             [namespaces]
[get list watch]                                                           []                       []               []                             [pods/log]
[get list watch]                                                           []                       []               []                             [pods/status]
[get list watch]                                                           []                       []               []                             [replicationcontrollers/status]
[get list watch]                                                           []                       []               []                             [resourcequotas/status]
[get list watch]                                                           []                       []               []                             [resourcequotas]
[get list watch]                                                           []                       []               []                             [resourcequotausages]
[get list watch]                                                           []                       []               []                             [rolebindingrestrictions]
[get list watch]                                                           []                       []               [apps.openshift.io]            [deploymentconfigs/log]
[get list watch]                                                           []                       []               [apps.openshift.io]            [deploymentconfigs/status]
[get list watch]                                                           []                       []               [authorization.openshift.io]   [rolebindingrestrictions]
[get list watch]                                                           []                       []               [build.openshift.io]           [builds/log]
[get list watch]                                                           []                       []               [image.openshift.io]           [imagestreams/status]
[get list watch]                                                           []                       []               [quota.openshift.io]           [appliedclusterresourcequotas]
[get list watch]                                                           []                       []               [rbac.authorization.k8s.io]    [clusterroles]
[get list]                                                                 []                       []               []                             [clusterroles]
[get list]                                                                 []                       []               [authorization.openshift.io]   [clusterroles]
[get list]                                                                 []                       []               [storage.k8s.io]               [storageclasses]
[get update]                                                               []                       []               []                             [imagestreams/layers]
[get update]                                                               []                       []               [image.openshift.io]           [imagestreams/layers]
[get]                                                                      [/.well-known/*]         []               []                             []
[get]                                                                      [/.well-known/*]         []               []                             []
[get]                                                                      [/.well-known]           []               []                             []
[get]                                                                      [/.well-known]           []               []                             []
[get]                                                                      [/]                      []               []                             []
[get]                                                                      [/]                      []               []                             []
[get]                                                                      [/api/*]                 []               []                             []
[get]                                                                      [/api/*]                 []               []                             []
[get]                                                                      [/api/*]                 []               []                             []
[get]                                                                      [/api]                   []               []                             []
[get]                                                                      [/api]                   []               []                             []
[get]                                                                      [/api]                   []               []                             []
[get]                                                                      [/apis/*]                []               []                             []
[get]                                                                      [/apis/*]                []               []                             []
[get]                                                                      [/apis/*]                []               []                             []
[get]                                                                      [/apis]                  []               []                             []
[get]                                                                      [/apis]                  []               []                             []
[get]                                                                      [/apis]                  []               []                             []
[get]                                                                      [/healthz/*]             []               []                             []
[get]                                                                      [/healthz]               []               []                             []
[get]                                                                      [/healthz]               []               []                             []
[get]                                                                      [/oapi/*]                []               []                             []
[get]                                                                      [/oapi/*]                []               []                             []
[get]                                                                      [/oapi]                  []               []                             []
[get]                                                                      [/oapi]                  []               []                             []
[get]                                                                      [/openapi/*]             []               []                             []
[get]                                                                      [/openapi/v2]            []               []                             []
[get]                                                                      [/openapi/v2]            []               []                             []
[get]                                                                      [/openapi]               []               []                             []
[get]                                                                      [/osapi/]                []               []                             []
[get]                                                                      [/osapi/]                []               []                             []
[get]                                                                      [/osapi]                 []               []                             []
[get]                                                                      [/osapi]                 []               []                             []
[get]                                                                      [/swagger-2.0.0.pb-v1]   []               []                             []
[get]                                                                      [/swagger-2.0.0.pb-v1]   []               []                             []
[get]                                                                      [/swagger-2.0.0.pb-v1]   []               []                             []
[get]                                                                      [/swagger.json]          []               []                             []
[get]                                                                      [/swagger.json]          []               []                             []
[get]                                                                      [/swagger.json]          []               []                             []
[get]                                                                      [/swaggerapi/*]          []               []                             []
[get]                                                                      [/swaggerapi/*]          []               []                             []
[get]                                                                      [/swaggerapi/*]          []               []                             []
[get]                                                                      [/swaggerapi]            []               []                             []
[get]                                                                      [/swaggerapi]            []               []                             []
[get]                                                                      [/swaggerapi]            []               []                             []
[get]                                                                      [/version/*]             []               []                             []
[get]                                                                      [/version/*]             []               []                             []
[get]                                                                      [/version/]              []               []                             []
[get]                                                                      [/version]               []               []                             []
[get]                                                                      [/version]               []               []                             []
[get]                                                                      [/version]               []               []                             []
[get]                                                                      []                       [~]              []                             [users]
[get]                                                                      []                       [~]              [user.openshift.io]            [users]
[impersonate]                                                              []                       []               [authentication.k8s.io]        [userextras/scopes.authorization.openshift.io]
[create list]                                                              []                       []               []                             [projectrequests]
[create list]                                                              []                       []               [project.openshift.io]         [projectrequests]
[delete get list patch update watch]                                       []                       []               []                             [projects]
[delete get list patch update watch]                                       []                       []               [project.openshift.io]         [projects]
[update]                                                                   []                       []               []                             [builds/details]
[update]                                                                   []                       []               [build.openshift.io]           [builds/details]
```

自プロジェクトの場合、権限が増えていますね。
特に`image.openshift.io`の`imagestreams`に対して`create`権限があるのでイメージがインポートできるんでしょうね。

```bash
[create delete deletecollection get list patch update watch]               []                       []               [image.openshift.io]           [imagestreams]
```

# 権限の種類を確認する(`oc get clusterrole.rbac`)

system以外のクラスタ全体で利用できるロールを確認します。

```bash
[tak@centos76 ~]$ oc get clusterrole.rbac | grep -v system:
NAME                                                                   AGE
admin                                                                  1d
basic-user                                                             1d
cluster-admin                                                          1d
cluster-debugger                                                       1d
cluster-reader                                                         1d
cluster-status                                                         1d
edit                                                                   1d
registry-admin                                                         1d
registry-editor                                                        1d
registry-viewer                                                        1d
self-access-reviewer                                                   1d
self-provisioner                                                       1d
storage-admin                                                          1d
sudoer                                                                 1d
view                                                                   1d
```

`admin`ロールの権限を確認する。

```bash
[tak@centos76 ~]$ oc describe clusterrole.rbac admin
Name:         admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  openshift.io/description=A user that has edit rights within the project and can change the project's membership.
              rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources                                                  Non-Resource URLs  Resource Names  Verbs
  ---------                                                  -----------------  --------------  -----
  jenkins.build.openshift.io                                 []                 []              [admin edit view]
  networkpolicies.extensions                                 []                 []              [create delete deletecollection get list patch update watch create delete deletecollection get list patch update watch]
  networkpolicies.networking.k8s.io                          []                 []              [create delete deletecollection get list patch update watch create delete deletecollection get list patch update watch]
  serviceaccounts                                            []                 []              [create delete deletecollection get list patch update watch impersonate]
  buildconfigs/webhooks                                      []                 []              [create delete deletecollection get list patch update watch]
  buildconfigs                                               []                 []              [create delete deletecollection get list patch update watch]
  buildlogs                                                  []                 []              [create delete deletecollection get list patch update watch]
  builds                                                     []                 []              [create delete deletecollection get list patch update watch]
  configmaps                                                 []                 []              [create delete deletecollection get list patch update watch]
  deploymentconfigs/scale                                    []                 []              [create delete deletecollection get list patch update watch]
  deploymentconfigs                                          []                 []              [create delete deletecollection get list patch update watch]
  endpoints                                                  []                 []              [create delete deletecollection get list patch update watch]
  imagestreamimages                                          []                 []              [create delete deletecollection get list patch update watch]
  imagestreammappings                                        []                 []              [create delete deletecollection get list patch update watch]
  imagestreams/secrets                                       []                 []              [create delete deletecollection get list patch update watch]
  imagestreams                                               []                 []              [create delete deletecollection get list patch update watch]
  imagestreamtags                                            []                 []              [create delete deletecollection get list patch update watch]
  persistentvolumeclaims                                     []                 []              [create delete deletecollection get list patch update watch]
  pods/attach                                                []                 []              [create delete deletecollection get list patch update watch]
  pods/exec                                                  []                 []              [create delete deletecollection get list patch update watch]
  pods/portforward                                           []                 []              [create delete deletecollection get list patch update watch]
  pods/proxy                                                 []                 []              [create delete deletecollection get list patch update watch]
  pods                                                       []                 []              [create delete deletecollection get list patch update watch]
  processedtemplates                                         []                 []              [create delete deletecollection get list patch update watch]
  replicationcontrollers/scale                               []                 []              [create delete deletecollection get list patch update watch]
  replicationcontrollers                                     []                 []              [create delete deletecollection get list patch update watch]
  rolebindings                                               []                 []              [create delete deletecollection get list patch update watch]
  roles                                                      []                 []              [create delete deletecollection get list patch update watch]
  routes                                                     []                 []              [create delete deletecollection get list patch update watch]
  secrets                                                    []                 []              [create delete deletecollection get list patch update watch]
  services/proxy                                             []                 []              [create delete deletecollection get list patch update watch]
  services                                                   []                 []              [create delete deletecollection get list patch update watch]
  templateconfigs                                            []                 []              [create delete deletecollection get list patch update watch]
  templateinstances                                          []                 []              [create delete deletecollection get list patch update watch]
  templates                                                  []                 []              [create delete deletecollection get list patch update watch]
  deploymentconfigs.apps.openshift.io/scale                  []                 []              [create delete deletecollection get list patch update watch]
  deploymentconfigs.apps.openshift.io                        []                 []              [create delete deletecollection get list patch update watch]
  daemonsets.apps                                            []                 []              [create delete deletecollection get list patch update watch]
  deployments.apps/rollback                                  []                 []              [create delete deletecollection get list patch update watch]
  deployments.apps/scale                                     []                 []              [create delete deletecollection get list patch update watch]
  deployments.apps                                           []                 []              [create delete deletecollection get list patch update watch]
  replicasets.apps/scale                                     []                 []              [create delete deletecollection get list patch update watch]
  replicasets.apps                                           []                 []              [create delete deletecollection get list patch update watch]
  statefulsets.apps/scale                                    []                 []              [create delete deletecollection get list patch update watch]
  statefulsets.apps                                          []                 []              [create delete deletecollection get list patch update watch]
  rolebindings.authorization.openshift.io                    []                 []              [create delete deletecollection get list patch update watch]
  roles.authorization.openshift.io                           []                 []              [create delete deletecollection get list patch update watch]
  horizontalpodautoscalers.autoscaling                       []                 []              [create delete deletecollection get list patch update watch]
  cronjobs.batch                                             []                 []              [create delete deletecollection get list patch update watch]
  jobs.batch                                                 []                 []              [create delete deletecollection get list patch update watch]
  buildconfigs.build.openshift.io/webhooks                   []                 []              [create delete deletecollection get list patch update watch]
  buildconfigs.build.openshift.io                            []                 []              [create delete deletecollection get list patch update watch]
  buildlogs.build.openshift.io                               []                 []              [create delete deletecollection get list patch update watch]
  builds.build.openshift.io                                  []                 []              [create delete deletecollection get list patch update watch]
  daemonsets.extensions                                      []                 []              [create delete deletecollection get list patch update watch]
  deployments.extensions/rollback                            []                 []              [create delete deletecollection get list patch update watch]
  deployments.extensions/scale                               []                 []              [create delete deletecollection get list patch update watch]
  deployments.extensions                                     []                 []              [create delete deletecollection get list patch update watch]
  ingresses.extensions                                       []                 []              [create delete deletecollection get list patch update watch]
  replicasets.extensions/scale                               []                 []              [create delete deletecollection get list patch update watch]
  replicasets.extensions                                     []                 []              [create delete deletecollection get list patch update watch]
  replicationcontrollers.extensions/scale                    []                 []              [create delete deletecollection get list patch update watch]
  imagestreamimages.image.openshift.io                       []                 []              [create delete deletecollection get list patch update watch]
  imagestreammappings.image.openshift.io                     []                 []              [create delete deletecollection get list patch update watch]
  imagestreams.image.openshift.io/secrets                    []                 []              [create delete deletecollection get list patch update watch]
  imagestreams.image.openshift.io                            []                 []              [create delete deletecollection get list patch update watch]
  imagestreamtags.image.openshift.io                         []                 []              [create delete deletecollection get list patch update watch]
  poddisruptionbudgets.policy                                []                 []              [create delete deletecollection get list patch update watch]
  rolebindings.rbac.authorization.k8s.io                     []                 []              [create delete deletecollection get list patch update watch]
  roles.rbac.authorization.k8s.io                            []                 []              [create delete deletecollection get list patch update watch]
  routes.route.openshift.io                                  []                 []              [create delete deletecollection get list patch update watch]
  processedtemplates.template.openshift.io                   []                 []              [create delete deletecollection get list patch update watch]
  templateconfigs.template.openshift.io                      []                 []              [create delete deletecollection get list patch update watch]
  templateinstances.template.openshift.io                    []                 []              [create delete deletecollection get list patch update watch]
  templates.template.openshift.io                            []                 []              [create delete deletecollection get list patch update watch]
  buildconfigs/instantiate                                   []                 []              [create]
  buildconfigs/instantiatebinary                             []                 []              [create]
  builds/clone                                               []                 []              [create]
  deploymentconfigrollbacks                                  []                 []              [create]
  deploymentconfigs/instantiate                              []                 []              [create]
  deploymentconfigs/rollback                                 []                 []              [create]
  imagestreamimports                                         []                 []              [create]
  localresourceaccessreviews                                 []                 []              [create]
  localsubjectaccessreviews                                  []                 []              [create]
  podsecuritypolicyreviews                                   []                 []              [create]
  podsecuritypolicyselfsubjectreviews                        []                 []              [create]
  podsecuritypolicysubjectreviews                            []                 []              [create]
  resourceaccessreviews                                      []                 []              [create]
  routes/custom-host                                         []                 []              [create]
  subjectaccessreviews                                       []                 []              [create]
  subjectrulesreviews                                        []                 []              [create]
  deploymentconfigrollbacks.apps.openshift.io                []                 []              [create]
  deploymentconfigs.apps.openshift.io/instantiate            []                 []              [create]
  deploymentconfigs.apps.openshift.io/rollback               []                 []              [create]
  localsubjectaccessreviews.authorization.k8s.io             []                 []              [create]
  localresourceaccessreviews.authorization.openshift.io      []                 []              [create]
  localsubjectaccessreviews.authorization.openshift.io       []                 []              [create]
  resourceaccessreviews.authorization.openshift.io           []                 []              [create]
  subjectaccessreviews.authorization.openshift.io            []                 []              [create]
  subjectrulesreviews.authorization.openshift.io             []                 []              [create]
  buildconfigs.build.openshift.io/instantiate                []                 []              [create]
  buildconfigs.build.openshift.io/instantiatebinary          []                 []              [create]
  builds.build.openshift.io/clone                            []                 []              [create]
  imagestreamimports.image.openshift.io                      []                 []              [create]
  routes.route.openshift.io/custom-host                      []                 []              [create]
  podsecuritypolicyreviews.security.openshift.io             []                 []              [create]
  podsecuritypolicyselfsubjectreviews.security.openshift.io  []                 []              [create]
  podsecuritypolicysubjectreviews.security.openshift.io      []                 []              [create]
  projects                                                   []                 []              [delete get patch update]
  projects.project.openshift.io                              []                 []              [delete get patch update]
  routes/status                                              []                 []              [get list watch update]
  routes.route.openshift.io/status                           []                 []              [get list watch update]
  appliedclusterresourcequotas                               []                 []              [get list watch]
  bindings                                                   []                 []              [get list watch]
  builds/log                                                 []                 []              [get list watch]
  deploymentconfigs/log                                      []                 []              [get list watch]
  deploymentconfigs/status                                   []                 []              [get list watch]
  events                                                     []                 []              [get list watch]
  imagestreams/status                                        []                 []              [get list watch]
  limitranges                                                []                 []              [get list watch]
  namespaces/status                                          []                 []              [get list watch]
  namespaces                                                 []                 []              [get list watch]
  pods/log                                                   []                 []              [get list watch]
  pods/status                                                []                 []              [get list watch]
  replicationcontrollers/status                              []                 []              [get list watch]
  resourcequotas/status                                      []                 []              [get list watch]
  resourcequotas                                             []                 []              [get list watch]
  resourcequotausages                                        []                 []              [get list watch]
  rolebindingrestrictions                                    []                 []              [get list watch]
  deploymentconfigs.apps.openshift.io/log                    []                 []              [get list watch]
  deploymentconfigs.apps.openshift.io/status                 []                 []              [get list watch]
  rolebindingrestrictions.authorization.openshift.io         []                 []              [get list watch]
  builds.build.openshift.io/log                              []                 []              [get list watch]
  imagestreams.image.openshift.io/status                     []                 []              [get list watch]
  appliedclusterresourcequotas.quota.openshift.io            []                 []              [get list watch]
  imagestreams/layers                                        []                 []              [get update]
  imagestreams.image.openshift.io/layers                     []                 []              [get update]
  builds/details                                             []                 []              [update]
  builds.build.openshift.io/details                          []                 []              [update]
```

↓があるので`system`に`admin`ロールを与えたら出来そうですけどね。

```bash
  imagestreams                                               []                 []              [create delete deletecollection get list patch update watch]
```

# 権限を与える(`oc adm policy add-role-to-user`)

安直に`system`に`admin`ロールを付与してみます(笑)

```bash
[tak@centos76 ~]$ oc login $(minishift ip):8443 -u system -p admin
Login successful.

You don't have any projects. You can try to create a new project, by running

    oc new-project <projectname>

[tak@centos76 ~]$  oc adm policy add-role-to-user admin system
Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system" cannot list rolebindings.rbac.authorization.k8s.io in the namespace "default": no RBAC policy matched
```

一体だれが権限をもっているんでしょうかね？
`system`より強いユーザって( ;∀;)

って事で更なる捜索の旅に出ました。


# minishitのaddons(`admin-user`)

[OKD Latest > Minishift > Using Minishift > Add-ons](https://docs.okd.io/latest/minishift/using/addons.html)

デフォルトでは以下のようなAddonsが入っているそうな
その中でも一際輝いて見えるのが`admin-user`です。
これは期待大

|Add-on Name|Description|
|-----------|-----------|
|anyuid|Changes the default security context constraints to allow pods to run with arbitrary UID.|
|admin-user|Creates a user named 'admin' and assigns the cluster-admin role to it.|
|registry-route|Creates an edge terminated route for the OpenShift registry.|
|htpasswd-identity-provider|User can change and add default login username and password for the OpenShift instance.|
|admissions-webhook|Enables validating and mutating admission webhooks.|
|xpaas|Imports xPaaS templates.|
|redhat-registry-login|Creates secret to access images on registry.redhat.io.|
|che|Deploy che on the Minishift.|

> admin-user :
> Creates a user named 'admin' and assigns the cluster-admin role to it.

正に望んでいた最強権限のユーザ`admin`誕生のAdd-onですね(^^♪

# minishiftのAdd-onを設定する

```bash
$ minishift addons enable admin-user
Add-on 'admin-user' enabled
```

Addonsの状況を確認します。

```bash
$ minishift addons list
- admin-user                     : enabled	P(0)
- admissions-webhook             : disabled	P(0)
- anyuid                         : disabled	P(0)
- che                            : disabled	P(0)
- redhat-registry-login	         : disabled	P(0)
- registry-route                 : disabled	P(0)
- htpasswd-identity-provider     : disabled	P(0)
- xpaas	                         : disabled	P(0)
```

## `cluster-admin`の`admin`でログイン

いよいよ'admin'でログインします。

```bash
[tak@centos76 ~]$ oc login $(minishift ip):8443 -u admin
Authentication required for https://192.168.42.233:8443 (openshift)
Username: admin
Password: <任意のPassword>
Login successful.

You don't have any projects. You can try to create a new project, by running

    oc new-project <projectname>

```

`admin`の権限を確認する。

```bash
[tak@centos76 ~]$ oc policy can-i --list -n openshift
Command "can-i" is deprecated, use 'oc auth can-i'
VERBS              NON-RESOURCE URLS        RESOURCE NAMES   API GROUPS                     RESOURCES
[create]           []                       []               [authorization.k8s.io]         [selfsubjectaccessreviews]
[create]           []                       []               []                             [selfsubjectrulesreviews]
[create]           []                       []               [authorization.openshift.io]   [selfsubjectrulesreviews]
[create get]       []                       []               []                             [buildconfigs/webhooks]
[create get]       []                       []               [build.openshift.io]           [buildconfigs/webhooks]
[create list]      []                       []               []                             [projectrequests]
[create list]      []                       []               [project.openshift.io]         [projectrequests]
[create]           []                       []               []                             [builds/docker]
[create]           []                       []               []                             [builds/jenkinspipeline]
[create]           []                       []               []                             [builds/optimizeddocker]
[create]           []                       []               []                             [builds/source]
[create]           []                       []               [authorization.k8s.io]         [selfsubjectrulesreviews]
[create]           []                       []               [build.openshift.io]           [builds/docker]
[create]           []                       []               [build.openshift.io]           [builds/jenkinspipeline]
[create]           []                       []               [build.openshift.io]           [builds/optimizeddocker]
[create]           []                       []               [build.openshift.io]           [builds/source]
[delete]           []                       []               []                             [oauthaccesstokens]
[delete]           []                       []               []                             [oauthauthorizetokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthaccesstokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthauthorizetokens]
[get list watch]   []                       []               []                             [imagestreamimages]
[get list watch]   []                       []               []                             [imagestreams]
[get list watch]   []                       []               []                             [imagestreamtags]
[get list watch]   []                       []               []                             [templates]
[get list watch]   []                       []               [image.openshift.io]           [imagestreamimages]
[get list watch]   []                       []               [image.openshift.io]           [imagestreams]
[get list watch]   []                       []               [image.openshift.io]           [imagestreamtags]
[get list watch]   []                       []               [rbac.authorization.k8s.io]    [clusterroles]
[get list watch]   []                       []               [template.openshift.io]        [templates]
[get list]         []                       []               []                             [clusterroles]
[get list]         []                       []               [authorization.openshift.io]   [clusterroles]
[get list]         []                       []               [storage.k8s.io]               [storageclasses]
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/]                      []               []                             []
[get]              [/]                      []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/healthz/*]             []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/openapi/*]             []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi]               []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/]              []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              []                       []               []                             [imagestreams/layers]
[get]              []                       [~]              []                             [users]
[get]              []                       []               [image.openshift.io]           [imagestreams/layers]
[get]              []                       [~]              [user.openshift.io]            [users]
[impersonate]      []                       []               [authentication.k8s.io]        [userextras/scopes.authorization.openshift.io]
[list watch]       []                       []               []                             [projects]
[list watch]       []                       []               [project.openshift.io]         [projects]
```

あれ？`get list watch`のみ
確かに`system`より権限は多いのですが…
`developer`の`openshift` Namespaceと同じじゃないか？

> ```bash
[get list watch]   []                       []               [image.openshift.io]           [imagestreamimages]
[get list watch]   []                       []               [image.openshift.io]           [imagestreams]
[get list watch]   []                       []               [image.openshift.io]           [imagestreamtags]
```

おかしいなぁと思いつつ`cluster-admin`権限を確認すると
全てのリソースについて権限を持ってますよね。
ちゃんと`cluster-admin`ロールなのかなぁ～

```bash
[tak@centos76 ~]$ oc describe clusterrole.rbac cluster-admin
Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  authorization.openshift.io/system-only=true
              rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  *.*        []                 []              [*]
             [*]                []              [*]
```

じゃあ、試しに`system`に`admin`権限を与えてみたら

```bash
[tak@centos76 ~]$ oc adm policy add-role-to-user admin system
Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "admin" cannot list rolebindings.rbac.authorization.k8s.io in the namespace "default": no RBAC policy matched
```

結局ダメなんかぁい

# minishiftのAdd-onを適用する
enableに設定した後、適用がいるようです(^^;

```bash
[tak@centos76 ~]$ minishift addons apply admin-user
-- Applying addon 'admin-user':..
```

改めて権限を確認します。
すると先ほどまで出てこなかったProjectも見えてますね。
特にopenshiftが見えているのは期待大ですね(笑)

```bash
[tak@centos76 ~]$ oc login $(minishift ip):8443 -u admin
Authentication required for https://192.168.42.85:8443 (openshift)
Username: admin
Password: <任意のパスワード>
Login successful.

You have access to the following projects and can switch between them with 'oc project <projectname>':

    default
    kube-dns
    kube-proxy
    kube-public
    kube-system
  * myproject
    openshift
    openshift-apiserver
    openshift-controller-manager
    openshift-core-operators
    openshift-infra
    openshift-node
    openshift-service-cert-signer
    openshift-web-console

Using project "myproject".
```

焦る気持ちを押さえつつまずは権限の確認から

```bash
[tak@centos76 ~]$ oc policy can-i --list -n openshift
Command "can-i" is deprecated, use 'oc auth can-i'
VERBS              NON-RESOURCE URLS        RESOURCE NAMES   API GROUPS                     RESOURCES
[*]                []                       []               [*]                            [*]
[*]                [*]                      []               []                             []
[create]           []                       []               [authorization.k8s.io]         [selfsubjectaccessreviews]
[create]           []                       []               []                             [selfsubjectrulesreviews]
[create]           []                       []               [authorization.openshift.io]   [selfsubjectrulesreviews]
[create get]       []                       []               []                             [buildconfigs/webhooks]
[create get]       []                       []               [build.openshift.io]           [buildconfigs/webhooks]
[create]           []                       []               []                             [builds/docker]
[create]           []                       []               []                             [builds/jenkinspipeline]
[create]           []                       []               []                             [builds/optimizeddocker]
[create]           []                       []               []                             [builds/source]
[create]           []                       []               [authorization.k8s.io]         [selfsubjectrulesreviews]
[create]           []                       []               [build.openshift.io]           [builds/docker]
[create]           []                       []               [build.openshift.io]           [builds/jenkinspipeline]
[create]           []                       []               [build.openshift.io]           [builds/optimizeddocker]
[create]           []                       []               [build.openshift.io]           [builds/source]
[delete]           []                       []               []                             [oauthaccesstokens]
[delete]           []                       []               []                             [oauthauthorizetokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthaccesstokens]
[delete]           []                       []               [oauth.openshift.io]           [oauthauthorizetokens]
[get list watch]   []                       []               []                             [imagestreamimages]
[get list watch]   []                       []               []                             [imagestreams]
[get list watch]   []                       []               []                             [imagestreamtags]
[get list watch]   []                       []               []                             [templates]
[get list watch]   []                       []               [image.openshift.io]           [imagestreamimages]
[get list watch]   []                       []               [image.openshift.io]           [imagestreams]
[get list watch]   []                       []               [image.openshift.io]           [imagestreamtags]
[get list watch]   []                       []               [rbac.authorization.k8s.io]    [clusterroles]
[get list watch]   []                       []               [template.openshift.io]        [templates]
[get list]         []                       []               []                             [clusterroles]
[get list]         []                       []               [authorization.openshift.io]   [clusterroles]
[get list]         []                       []               [storage.k8s.io]               [storageclasses]
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known/*]         []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/.well-known]           []               []                             []
[get]              [/]                      []               []                             []
[get]              [/]                      []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api/*]                 []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/api]                   []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis/*]                []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/apis]                  []               []                             []
[get]              [/healthz/*]             []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/healthz]               []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi/*]                []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/oapi]                  []               []                             []
[get]              [/openapi/*]             []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi/v2]            []               []                             []
[get]              [/openapi]               []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi/]                []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/osapi]                 []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger-2.0.0.pb-v1]   []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swagger.json]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi/*]          []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/swaggerapi]            []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/*]             []               []                             []
[get]              [/version/]              []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              [/version]               []               []                             []
[get]              []                       []               []                             [imagestreams/layers]
[get]              []                       [~]              []                             [users]
[get]              []                       []               [image.openshift.io]           [imagestreams/layers]
[get]              []                       [~]              [user.openshift.io]            [users]
[impersonate]      []                       []               [authentication.k8s.io]        [userextras/scopes.authorization.openshift.io]
[create list]      []                       []               []                             [projectrequests]
[create list]      []                       []               [project.openshift.io]         [projectrequests]
[list watch]       []                       []               []                             [projects]
[list watch]       []                       []               [project.openshift.io]         [projects]
```

一瞬同じじゃんと思ったら先頭に[＊]が入ってますね♪

> ```bash
[*]                []                       []               [*]                            [*]
[*]                [*]                      []               []                             []
```












# minishift addons :: registry-route

試す前に必要そうなAdd-onをenableにしていきます。


> registry-route :
> Creates an edge terminated route for the OpenShift registry.

```bash
$ minishift addons enable registry-route
Add-on 'registry-route' enabled
```

```bash
$ minishift addons list
- admin-user                     : enabled	P(0)
- redhat-registry-login	         : enabled	P(0)
- registry-route                 : enabled	P(0)
- admissions-webhook             : disabled	P(0)
- anyuid                         : disabled	P(0)
- che                            : disabled	P(0)
- htpasswd-identity-provider     : disabled	P(0)
- xpaas	                         : disabled	P(0)
```

まずは`registory-route`をapplyします。

```bash
[tak@centos76 ~]$ minishift addons apply registry-route
-- Applying addon 'registry-route':
 -- Create secret directory..
 -- Creating server cert.
 -- Creating the secret for the registry certificates.
 -- Adding the secret to the registry pod’s service accounts (including the default service account)..
 -- Pausing the docker-registry service.
 -- Adding the secret volume to the registry deployment configuration.
 -- Enabling TLS by adding the environment variables to the registry deployment configuration.
 -- Updating the scheme used for the registry’s liveness probe from HTTP to HTTPS.
 -- Updating the scheme used for the registry’s readiness probe from HTTP to HTTPS.
 -- Resuming the docker-registry service.
 -- Creating passthrough route for docker-registry service....
 -- Add-on 'registry-route' created docker-registry route. Please run following commands to login to the OpenShift docker registry:
 -- $ eval $(minishift docker-env)
 -- $ eval $(minishift oc-env)

 -- $ docker login -u developer -p `oc whoami -t` docker-registry-default.192.168.42.85.nip.io

```

# minishift addons :: redhat-registry-login	

> redhat-registry-login :
> Creates secret to access images on registry.redhat.io.


RHCCなどを使用するためのAdd-onなのかな？

```bash
$ minishift addons enable redhat-registry-login	
Add-on 'redhat-registry-login' enabled
```

```bash
$ minishift addons apply redhat-registry-login
-- Applying addon 'redhat-registry-login':Error applying the add-on: The variable(s) 'REGISTRY_USERNAME, REGISTRY_PASSWORD' are required by the add-on, but are not defined in the context
```

環境変数にセットすれば良いのかと思ったのですが違うみたい

```bash
$ REGISTRY_USERNAME=<RedHatに登録したID>
$ REGISTRY_PASSWORD=<RedHatに登録した際のPassword>

$ set | grep REGISTRY
REGISTRY_PASSWORD=<RedHatに登録した際のPassword>
REGISTRY_USERNAME=<RedHatに登録したID>

$ minishift addons apply redhat-registry-login
-- Applying addon 'redhat-registry-login':Error applying the add-on: The variable(s) 'REGISTRY_USERNAME, REGISTRY_PASSWORD' are required by the add-on, but are not defined in the context
```

```bash
$ minishift start --disk-size 30GB --username <userid> --password <password>
：
$ minishift addons apply redhat-registry-login
-- Applying addon 'redhat-registry-login':Error applying the add-on: The variable(s) 'REGISTRY_USERNAME, REGISTRY_PASSWORD' are required by the add-on, but are not defined in the context
```

うぅ～ん。これは別途調査ですね。


調査しました(笑)

```bash
$ minishift config set addon-env REGISTRY_USERNAME=<RedHatに登録したID>
$ minishift config view
- addon-env                          : [REGISTRY_USERNAME=<RedHatに登録したID>]
- disk-size                          : 30GB
- iso-url                            : centos

$ minishift config set addon-env REGISTRY_PASSWORD=<RedHatに登録した際のPassword>
$ minishift config view
- addon-env                          : [REGISTRY_PASSWORD=<RedHatに登録した際のPassword>]
- disk-size                          : 30GB
- iso-url                            : centos

$ minishift addons apply redhat-registry-login
-- Applying addon 'redhat-registry-login':Error applying the add-on: The variable(s) 'REGISTRY_USERNAME' are required by the add-on, but are not defined in the context
```

うぅ～ん。複数変数の指定方法が判らない…。色々試した結果、正解は`,`区切りでした(^^♪

```bash
$ minishift config set addon-env REGISTRY_USERNAME=<RedHatに登録したID>,REGISTRY_PASSWORD=<RedHatに登録した際のPassword>

$ minishift config view
- addon-env                          : [REGISTRY_USERNAME=<RedHatに登録したID> REGISTRY_PASSWORD=<RedHatに登録した際のPassword>]
- disk-size                          : 30GB
- iso-url                            : centos

$ minishift addons apply redhat-registry-login
-- Applying addon 'redhat-registry-login':.
```


# `admin`でログインし`openshift` namespaceへインポート

まずは`admin`でログインします。パスワードは聞かれません。

```bash
$ oc login $(minishift ip):8443 -u admin
Logged into "https://192.168.42.85:8443" as "admin" using existing credentials.

You have access to the following projects and can switch between them with 'oc project <projectname>':

    default
    kube-dns
    kube-proxy
    kube-public
    kube-system
  * myproject
    openshift
    openshift-apiserver
    openshift-controller-manager
    openshift-core-operators
    openshift-infra
    openshift-node
    openshift-service-cert-signer
    openshift-web-console

Using project "myproject".
```

Projectをopenshiftに変更します。

```bash
$ oc project openshift
Now using project "openshift" on server "https://192.168.42.85:8443".
```

## rhscl/python-36-rhel7のインポート

イメージをインポートします。
`Namespace: openshift`になりましたね。

```bash
$ oc import-image openshift/python-36-rhel7:latest --from=registry.access.redhat.com/rhscl/python-36-rhel7 --confirm
imagestream.image.openshift.io/python-36-rhel7 imported

Name:			python-36-rhel7
Namespace:		openshift
Created:		Less than a second ago
Labels:			<none>
Annotations:		openshift.io/image.dockerRepositoryCheck=2019-01-14T11:43:32Z
Docker Pull Spec:	172.30.1.1:5000/openshift/python-36-rhel7
Image Lookup:		local=false
Unique Images:		1
Tags:			1

latest
  tagged from registry.access.redhat.com/rhscl/python-36-rhel7

  * registry.access.redhat.com/rhscl/python-36-rhel7@sha256:bc3538e03e4b8c60dbeb806e02b24360a389bd65a12ff73f55328eedfbcdcb3e
      Less than a second ago

Image Name:	python-36-rhel7:latest
Docker Image:	registry.access.redhat.com/rhscl/python-36-rhel7@sha256:bc3538e03e4b8c60dbeb806e02b24360a389bd65a12ff73f55328eedfbcdcb3e
Name:		sha256:bc3538e03e4b8c60dbeb806e02b24360a389bd65a12ff73f55328eedfbcdcb3e
Created:	Less than a second ago
Annotations:	image.openshift.io/dockerLayersOrder=ascending
Image Size:	222.1MB in 5 layers
Layers:		75.72MB	sha256:23113ae36f8e9d98b1423e44673979132dec59db2805e473e931d83548b0be82
		1.223kB	sha256:d134b18b98b0d113b7b1194a60efceaa2c06eff41386d6c14b0e44bfe557eee8
		6.795MB	sha256:e9c030a1a5e35aacb0fe94238025996b812bafcc8c1422a35d7bda1223da6e9e
		86.37MB	sha256:784f9bf048226aaa367d5784fcf90628254eb9c6998d72e894a525c4399d4c38
		53.24MB	sha256:8daef2dd454ce803baaa827469d1ef3c6e0342422f61bac311021a15fa4cf7ce
Image Created:	7 weeks ago
Author:		<none>
Arch:		amd64
Entrypoint:	container-entrypoint
Command:	/bin/sh -c $STI_SCRIPTS_PATH/usage
Working Dir:	/opt/app-root/src
User:		1001
Exposes Ports:	8080/tcp
Docker Labels:	architecture=x86_64
		authoritative-source-url=registry.access.redhat.com
		build-date=2018-11-26T07:27:36.337423
		com.redhat.build-host=cpt-0010.osbs.prod.upshift.rdu2.redhat.com
		com.redhat.component=rh-python36-container
		description=Python 3.6 available as container is a base platform for building and running various Python 3.6 applications and frameworks. Python is an easy to learn, powerful programming language. It has efficient high-level data structures and a simple but effective approach to object-oriented programming. Python's elegant syntax and dynamic typing, together with its interpreted nature, make it an ideal language for scripting and rapid application development in many areas on most platforms.
		distribution-scope=public
		io.k8s.description=Python 3.6 available as container is a base platform for building and running various Python 3.6 applications and frameworks. Python is an easy to learn, powerful programming language. It has efficient high-level data structures and a simple but effective approach to object-oriented programming. Python's elegant syntax and dynamic typing, together with its interpreted nature, make it an ideal language for scripting and rapid application development in many areas on most platforms.
		io.k8s.display-name=Python 3.6
		io.openshift.expose-services=8080:http
		io.openshift.s2i.scripts-url=image:///usr/libexec/s2i
		io.openshift.tags=builder,python,python36,rh-python36
		io.s2i.scripts-url=image:///usr/libexec/s2i
		maintainer=SoftwareCollections.org <sclorg@redhat.com>
		name=rhscl/python-36-rhel7
		release=36
		summary=Platform for building and running Python 3.6 applications
		url=https://access.redhat.com/containers/#/registry.access.redhat.com/rhscl/python-36-rhel7/images/1-36
		usage=s2i build https://github.com/sclorg/s2i-python-container.git --context-dir=3.6/test/setup-test-app/ rhscl/python-36-rhel7 python-sample-app
		vcs-ref=96351017867feb48429a2dc98ecdd27fc450960c
		vcs-type=git
		vendor=Red Hat, Inc.
		version=1
Environment:	PATH=/opt/app-root/src/.local/bin/:/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
		container=oci
		SUMMARY=Platform for building and running Python 3.6 applications
		DESCRIPTION=Python 3.6 available as container is a base platform for building and running various Python 3.6 applications and frameworks. Python is an easy to learn, powerful programming language. It has efficient high-level data structures and a simple but effective approach to object-oriented programming. Python's elegant syntax and dynamic typing, together with its interpreted nature, make it an ideal language for scripting and rapid application development in many areas on most platforms.
		STI_SCRIPTS_URL=image:///usr/libexec/s2i
		STI_SCRIPTS_PATH=/usr/libexec/s2i
		APP_ROOT=/opt/app-root
		HOME=/opt/app-root/src
		BASH_ENV=/opt/app-root/etc/scl_enable
		ENV=/opt/app-root/etc/scl_enable
		PROMPT_COMMAND=. /opt/app-root/etc/scl_enable
		NODEJS_SCL=rh-nodejs8
		PYTHON_VERSION=3.6
		PYTHONUNBUFFERED=1
		PYTHONIOENCODING=UTF-8
		LC_ALL=en_US.UTF-8
		LANG=en_US.UTF-8
		PIP_NO_CACHE_DIR=off
```

## rhscl/postgresql-96-rhel7のインポート

```bash
$ oc import-image openshift/postgresql-96-rhel7:latest --from=registry.access.redhat.com/rhscl/postgresql-96-rhel7 --confirm
imagestream.image.openshift.io/postgresql-96-rhel7 imported

Name:			postgresql-96-rhel7
Namespace:		openshift
Created:		Less than a second ago
Labels:			<none>
Annotations:		openshift.io/image.dockerRepositoryCheck=2019-01-14T11:49:21Z
Docker Pull Spec:	172.30.1.1:5000/openshift/postgresql-96-rhel7
Image Lookup:		local=false
Unique Images:		1
Tags:			1

latest
  tagged from registry.access.redhat.com/rhscl/postgresql-96-rhel7

  * registry.access.redhat.com/rhscl/postgresql-96-rhel7@sha256:52784d5e55d82076ac5f809ed6d298af6bac2003e2cfe1f0099123deefc45da1
      Less than a second ago

Image Name:	postgresql-96-rhel7:latest
Docker Image:	registry.access.redhat.com/rhscl/postgresql-96-rhel7@sha256:52784d5e55d82076ac5f809ed6d298af6bac2003e2cfe1f0099123deefc45da1
Name:		sha256:52784d5e55d82076ac5f809ed6d298af6bac2003e2cfe1f0099123deefc45da1
Created:	Less than a second ago
Annotations:	image.openshift.io/dockerLayersOrder=ascending
Image Size:	116.6MB in 4 layers
Layers:		75.72MB	sha256:23113ae36f8e9d98b1423e44673979132dec59db2805e473e931d83548b0be82
		1.223kB	sha256:d134b18b98b0d113b7b1194a60efceaa2c06eff41386d6c14b0e44bfe557eee8
		6.795MB	sha256:e9c030a1a5e35aacb0fe94238025996b812bafcc8c1422a35d7bda1223da6e9e
		34.04MB	sha256:b4b43ee5f56192791068dc1f70645e4b34f03919846cb92968a61f1a10a8857b
Image Created:	7 weeks ago
Author:		<none>
Arch:		amd64
Entrypoint:	container-entrypoint
Command:	run-postgresql
Working Dir:	/opt/app-root/src
User:		26
Exposes Ports:	5432/tcp
Docker Labels:	architecture=x86_64
		authoritative-source-url=registry.access.redhat.com
		build-date=2018-11-26T09:22:52.545618
		com.redhat.build-host=cpt-0002.osbs.prod.upshift.rdu2.redhat.com
		com.redhat.component=rh-postgresql96-container
		description=PostgreSQL is an advanced Object-Relational database management system (DBMS). The image contains the client and server programs that you'll need to create, run, maintain and access a PostgreSQL DBMS server.
		distribution-scope=public
		io.k8s.description=PostgreSQL is an advanced Object-Relational database management system (DBMS). The image contains the client and server programs that you'll need to create, run, maintain and access a PostgreSQL DBMS server.
		io.k8s.display-name=PostgreSQL 9.6
		io.openshift.expose-services=5432:postgresql
		io.openshift.s2i.scripts-url=image:///usr/libexec/s2i
		io.openshift.tags=database,postgresql,postgresql96,rh-postgresql96
		io.s2i.scripts-url=image:///usr/libexec/s2i
		maintainer=SoftwareCollections.org <sclorg@redhat.com>
		name=rhscl/postgresql-96-rhel7
		release=32
		summary=PostgreSQL is an advanced Object-Relational database management system
		url=https://access.redhat.com/containers/#/registry.access.redhat.com/rhscl/postgresql-96-rhel7/images/1-32
		usage=docker run -d --name postgresql_database -e POSTGRESQL_USER=user -e POSTGRESQL_PASSWORD=pass -e POSTGRESQL_DATABASE=db -p 5432:5432 rhscl/postgresql-96-rhel7
		vcs-ref=4d1b1f1c6f1fe58893e1d300ad7462ebbde15dd2
		vcs-type=git
		vendor=Red Hat, Inc.
		version=1
Environment:	PATH=/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
		container=oci
		SUMMARY=PostgreSQL is an advanced Object-Relational database management system
		DESCRIPTION=PostgreSQL is an advanced Object-Relational database management system (DBMS). The image contains the client and server programs that you'll need to create, run, maintain and access a PostgreSQL DBMS server.
		STI_SCRIPTS_URL=image:///usr/libexec/s2i
		STI_SCRIPTS_PATH=/usr/libexec/s2i
		APP_ROOT=/opt/app-root
		HOME=/var/lib/pgsql
		BASH_ENV=/usr/share/container-scripts/postgresql/scl_enable
		ENV=/usr/share/container-scripts/postgresql/scl_enable
		PROMPT_COMMAND=. /usr/share/container-scripts/postgresql/scl_enable
		POSTGRESQL_VERSION=9.6
		POSTGRESQL_PREV_VERSION=9.5
		PGUSER=postgres
		APP_DATA=/opt/app-root
		CONTAINER_SCRIPTS_PATH=/usr/share/container-scripts/postgresql
		ENABLED_COLLECTIONS=rh-postgresql96
Volumes:	/var/lib/pgsql/data
```

# openshift namespaceにインポートしたければ…

結論です。
`openshift` namespaceにインポートしたければ、
minishiftのadd-on`admin-user`をenableにしてapplyした後に実施する。

```bash
$ minishift addons enable admin-user
Add-on 'admin-user' enabled

$ minishift addons apply admin-user
-- Applying addon 'admin-user':..

$ oc login $(minishift ip):8443 -u admin
Logged into "https://192.168.42.85:8443" as "admin" using existing credentials.

You have access to the following projects and can switch between them with 'oc project <projectname>':

    default
    kube-dns
    kube-proxy
    kube-public
    kube-system
  * myproject
    openshift
    openshift-apiserver
    openshift-controller-manager
    openshift-core-operators
    openshift-infra
    openshift-node
    openshift-service-cert-signer
    openshift-web-console

Using project "myproject".

$ oc project openshift
Now using project "openshift" on server "https://192.168.42.85:8443".

$ oc import-image openshift/postgresql-96-rhel7:latest --from=registry.access.redhat.com/rhscl/postgresql-96-rhel7 --confirm
imagestream.image.openshift.io/postgresql-96-rhel7 imported
```