# 通过API管理用户
# 禁用用户
[root@rancher ~]# curl -k -X PUT \
-H “Content-Type: application/json” \
-u “admin:password” \
https://192.168.1.100/v3/users/u-2345678901 \
-d ‘{
“enabled”: false
}’

# 启用用户
[root@rancher ~]# curl -k -X PUT \
-H “Content-Type: application/json” \
-u “admin:password” \
https://192.168.1.100/v3/users/u-2345678901 \
-d ‘{
“enabled”: true
}’

# 删除用户
[root@rancher ~]# curl -k -X DELETE \
-u “admin:password” \
https://192.168.1.100/v3/users/u-2345678901

# 测试创建Pod权限
[root@rancher ~]# kubectl auth can-i create pods –as=fgedu-dev
yes

# 测试删除Pod权限
[root@rancher ~]# kubectl auth can-i delete pods –as=fgedu-dev
yes

# 测试读取Secret权限
[root@rancher ~]# kubectl auth can-i get secrets –as=fgedu-dev
yes

# 测试创建Secret权限
[root@rancher ~]# kubectl auth can-i create secrets –as=fgedu-dev
no

# 测试删除Secret权限
[root@rancher ~]# kubectl auth can-i delete secrets –as=fgedu-dev
no

# 测试读取所有资源权限
[root@rancher ~]# kubectl auth can-i get “*” –as=fgedu-dev –all-namespaces
no

# 测试创建所有资源权限
[root@rancher ~]# kubectl auth can-i create “*” –as=fgedu-dev –all-namespaces
no

# 使用用户凭证测试权限
[root@rancher ~]# kubectl get pods –kubeconfig=/home/fgedu-dev/.kube/config
NAME READY STATUS RESTARTS AGE
fgedu-nginx-1234567890-abcde 1/1 Running 0 10m

[root@rancher ~]# kubectl create deployment test –image=nginx –kubeconfig=/home/fgedu-dev/.kube/config
deployment.apps/test created

[root@rancher ~]# kubectl delete secret default-token-12345 –kubeconfig=/home/fgedu-dev/.kube/config
Error from server (Forbidden): secrets “default-token-12345” is forbidden: User “fgedu-dev” cannot delete resource “secrets” in API group “” in the namespace “default”

# 通过kubectl查看审计日志
[root@rancher ~]# kubectl get events –sort-by=.metadata.creationTimestamp
LAST SEEN TYPE REASON OBJECT MESSAGE
1m Normal Scheduled pod/test-1234567890-abcde Successfully assigned default/test-1234567890-abcde to rke2-worker1
1m Normal Pulling pod/test-1234567890-abcde Pulling image “nginx:latest”
1m Normal Pulled pod/test-1234567890-abcde Successfully pulled image “nginx:latest”
1m Normal Created pod/test-1234567890-abcde Created container test
1m Normal Started pod/test-1234567890-abcde Started container test

# 通过API查看审计日志
[root@rancher ~]# curl -k -u “admin:password” \
“https://192.168.1.100/v3/auditlogs?user=fgedu-dev&limit=10”

{
“data”: [
{
“id”: “auditlog-1234567890”,
“type”: “auditLog”,
“user”: “fgedu-dev”,
“action”: “create”,
“resourceType”: “deployment”,
“resourceName”: “test”,
“request”: “POST /apis/apps/v1/namespaces/default/deployments”,
“responseCode”: 201,
“timestamp”: “2026-04-10T10:00:00Z”
},
{
“id”: “auditlog-2345678901”,
“type”: “auditLog”,
“user”: “fgedu-dev”,
“action”: “delete”,
“resourceType”: “secret”,
“resourceName”: “default-token-12345”,
“request”: “DELETE /api/v1/namespaces/default/secrets/default-token-12345”,
“responseCode”: 403,
“timestamp”: “2026-04-10T10:01:00Z”
}
]
}

# 导出审计日志
[root@rancher ~]# curl -k -u “admin:password” \
“https://192.168.1.100/v3/auditlogs?user=fgedu-dev&limit=1000” \
-o /Rancher/fgdata/audit/fgedu-dev-audit.log

# 分析审计日志
[root@rancher ~]# grep -i “error\|forbidden\|unauthorized” /Rancher/fgdata/audit/fgedu-dev-audit.log
{“user”:”fgedu-dev”,”action”:”delete”,”resourceType”:”secret”,”responseCode”:403}