# subjectaccessreview

Published articles for subjectaccessreview.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## 【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列

DevFeed: [【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列](<https://devfeed.tech/articles/kube-apiserver-authorization-audit-rbac-sar-403-33967.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/11-authz-audit/11-authz-audit.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [audit](<https://devfeed.tech/topics/audit.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [403](<https://devfeed.tech/tags/403.md>), [admission](<https://devfeed.tech/tags/admission.md>), [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [audit](<https://devfeed.tech/tags/audit.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [authz](<https://devfeed.tech/tags/authz.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [etcd](<https://devfeed.tech/tags/etcd.md>), [http](<https://devfeed.tech/tags/http.md>), [k8s](<https://devfeed.tech/tags/k8s.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [policy](<https://devfeed.tech/tags/policy.md>), [post](<https://devfeed.tech/tags/post.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [subjectaccessreview](<https://devfeed.tech/tags/subjectaccessreview.md>), [v1](<https://devfeed.tech/tags/v1.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

### AI overview

This tutorial explains Kubernetes v1.30.3 authorization and auditing. It distinguishes the RBAC, Node, Webhook, and legacy ABAC authorizer paths; describes SAR and SSAR access checks; outlines audit policies and stages; and explains why user-facing 403 errors come from Kubernetes authorization rather than etcd permissions or Admission failures.

### Source excerpt

钉 K8s v1.30.3 的授权链：RBAC、Node、Webhook、ABAC（遗留）；SubjectAccessReview / SelfSubjectAccessReview 用法；Audit policy 四级；403 与 etcd 权限错误、Admission 拒绝的分列；不把 etcd 的 mTLS 错误写成 K8s RBAC 故障。