获取ClusterRole列表

allowWatchBookmarks

否

Boolean

allowWatchBookmarks requests watch events with type "BOOKMARK".

Servers that do not implement bookmarks may ignore this flag and bookmarks

are sent at the server's discretion. Clients should not assume bookmarks

are returned at any specific interval, nor may they assume the server will

send any BOOKMARK event during a session. If this is not a watch, this field

is ignored. If the feature gate WatchBookmarks is not enabled in apiserver,

this field is ignored.

continue

否

String

The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key".

This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.

fieldSelector

否

String

A selector to restrict the list of returned objects by their

fields. Defaults to everything.

labelSelector

否

String

A selector to restrict the list of returned objects by their

labels. Defaults to everything.

limit

否

Integer

limit is a maximum number of responses to return for a list call. If more items exist, the server will set the continue field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.

The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.

resourceVersion

否

String

resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.

Defaults to unset

resourceVersionMatch

否

String

resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.

Defaults to unset

timeoutSeconds

否

Integer

Timeout for the list/watch call. This limits the duration of

the call, regardless of any activity or inactivity.

watch

否

Boolean

Watch for changes to the described resources and return them

as a stream of add, update, and remove notifications. Specify resourceVersion.

pretty

否

String

If 'true', then the output is pretty printed.

X-Auth-Token

是

String

用户Token。

通过调用IAM服务获取用户Token接口获取（响应消息头中X-Subject-Token的值）。

apiVersion

String

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

items

Array of io.k8s.api.rbac.v1.ClusterRole objects

Items is a list of ClusterRoles

kind

String

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata

io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta object

Standard object's metadata.

aggregationRule

io.k8s.api.rbac.v1.AggregationRule object

AggregationRule is an optional field that describes how to build

the Rules for this ClusterRole. If AggregationRule is set, then the Rules

are controller managed and direct changes to Rules will be stomped by the

controller.

apiVersion

String

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind

String

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata

io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta object

Standard object's metadata.

rules

Array of io.k8s.api.rbac.v1.PolicyRule objects

Rules holds all the PolicyRules for this ClusterRole

clusterRoleSelectors

Array of io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector objects

ClusterRoleSelectors holds a list of selectors which will be

used to find ClusterRoles and create the rules. If any of the selectors

match, then the ClusterRole's permissions will be added

matchExpressions

Array of io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement objects

matchExpressions is a list of label selector requirements. The

requirements are ANDed.

matchLabels

Map<String,String>

matchLabels is a map of {key,value} pairs. A single {key,value}

in the matchLabels map is equivalent to an element of matchExpressions,

whose key field is "key", the operator is "In", and the values array contains

only "value". The requirements are ANDed.

key

String

key is the label key that the selector applies to.

operator

String

operator represents a key's relationship to a set of values.

Valid operators are In, NotIn, Exists and DoesNotExist.

values

Array of strings

values is an array of string values. If the operator is In or

NotIn, the values array must be non-empty. If the operator is Exists or

DoesNotExist, the values array must be empty. This array is replaced during

a strategic merge patch.

annotations

Map<String,String>

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations

clusterName

String

The name of the cluster which the object belongs to. This is

used to distinguish resources with same name and namespace in different

clusters. This field is not set anywhere right now and apiserver is going

to ignore it if set in create or update request.

creationTimestamp

String

Time is a wrapper around time.Time which supports correct marshaling

to YAML and JSON. Wrappers are provided for many of the factory methods that

the time package offers.

deletionGracePeriodSeconds

Long

Number of seconds allowed for this object to gracefully terminate

before it will be removed from the system. Only set when deletionTimestamp

is also set. May only be shortened. Read-only.

deletionTimestamp

String

Time is a wrapper around time.Time which supports correct marshaling

to YAML and JSON. Wrappers are provided for many of the factory methods that

the time package offers.

finalizers

Array of strings

Must be empty before the object is deleted from the registry.

Each entry is an identifier for the responsible component that will remove

the entry from the list. If the deletionTimestamp of the object is non-nil,

entries in this list can only be removed. Finalizers may be processed and

removed in any order. Order is NOT enforced because it introduces significant

risk of stuck finalizers. finalizers is a shared field, any actor with permission

can reorder it. If the finalizer list is processed in order, then this can

lead to a situation in which the component responsible for the first finalizer

in the list is waiting for a signal (field value, external system, or other)

produced by a component responsible for a finalizer later in the list, resulting

in a deadlock. Without enforced ordering finalizers are free to order amongst

themselves and are not vulnerable to ordering changes in the list.

generateName

String

GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header).

Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency

generation

Long

A sequence number representing a specific generation of the desired

state. Populated by the system. Read-only.

labels

Map<String,String>

Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels

managedFields

Array of io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry objects

ManagedFields maps workflow-id and version to the set of fields

that are managed by that workflow. This is mostly for internal housekeeping,

and users typically shouldn't need to set or understand this field. A workflow

can be the user's name, a controller's name, or the name of a specific apply

path like "ci-cd". The set of fields is always in the version that the workflow

used when modifying the object.

name

String

Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names

namespace

String

Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.

Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces

ownerReferences

Array of io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference objects

List of objects depended by this object. If ALL objects in the

list have been deleted, this object will be garbage collected. If this object

is managed by a controller, then an entry in this list will point to this

controller, with the controller field set to true. There cannot be more

than one managing controller.

resourceVersion

String

An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.

Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

selfLink

String

SelfLink is a URL representing this object. Populated by the system. Read-only.

DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.

uid

String

UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.

Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

apiVersion

String

APIVersion defines the version of this resource that this field

set applies to. The format is "group/version" just like the top-level APIVersion

field. It is necessary to track the version of a field set because it cannot

be automatically converted.

fieldsType

String

FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"

fieldsV1

Object

FieldsV1 holds the first JSON version format as described in

the "FieldsV1" type.

manager

String

Manager is an identifier of the workflow managing these fields.

operation

String

Operation is the type of operation which lead to this ManagedFieldsEntry

being created. The only valid values for this field are 'Apply' and 'Update'.

time

String

Time is a wrapper around time.Time which supports correct marshaling

to YAML and JSON. Wrappers are provided for many of the factory methods that

the time package offers.

apiVersion

String

API version of the referent.

blockOwnerDeletion

Boolean

If true, AND if the owner has the "foregroundDeletion" finalizer,

then the owner cannot be deleted from the key-value store until this reference

is removed. Defaults to false. To set this field, a user needs "delete"

permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.

controller

Boolean

If true, this reference points to the managing controller.

kind

String

Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

name

String

Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names

uid

String

UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids

apiGroups

Array of strings

APIGroups is the name of the APIGroup that contains the resources. If

multiple API groups are specified, any action requested against one of the

enumerated resources in any API group will be allowed.

nonResourceURLs

Array of strings

NonResourceURLs is a set of partial urls that a user should have

access to. *s are allowed, but only as the full, final step in the path

Since non-resource URLs are not namespaced, this field is only applicable

for ClusterRoles referenced from a ClusterRoleBinding. Rules can either

apply to API resources (such as "pods" or "secrets") or non-resource URL

paths (such as "/api"), but not both.

resourceNames

Array of strings

ResourceNames is an optional white list of names that the rule

applies to. An empty set means that everything is allowed.

resources

Array of strings

Resources is a list of resources this rule applies to. ResourceAll

represents all resources.

verbs

Array of strings

Verbs is a list of Verbs that apply to ALL the ResourceKinds

and AttributeRestrictions contained in this rule. VerbAll represents all

kinds.

continue

String

continue may be set if the user set a limit on the number of

items returned, and indicates that the server has more data available. The

value is opaque and may be used to issue another request to the endpoint

that served this list to retrieve the next set of available objects. Continuing

a consistent list may not be possible if the server configuration has changed

or more than a few minutes have passed. The resourceVersion field returned

when using this continue value will be identical to the value in the first

response, unless you have received this token from an error message.

remainingItemCount

Long

remainingItemCount is the number of subsequent items in the list

which are not included in this list response. If the list request contained

label or field selectors, then the number of remaining items is unknown

and the field will be left unset and omitted during serialization. If the

list is complete (either because it is not chunking or because this is the

last chunk), then there are no more remaining items and this field will

be left unset and omitted during serialization. Servers older than v1.15

do not set this field. The intended use of the remainingItemCount is estimating

the size of a collection. Clients should not rely on the remainingItemCount

to be set or to be exact.

resourceVersion

String

String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

selfLink

String

selfLink is a URL representing this object. Populated by the system. Read-only.

DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.

200

OK

400

BadRequest

401

Unauthorized

403

Forbidden

404

NotFound

405

MethodNotAllowed

406

NotAcceptable

409

Conflict

415

UnsupportedMediaType

422

Invalid

429

TooManyRequests

500

InternalError

503

ServiceUnavailable

504

ServerTimeout