kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: vg-1-1 # 这里表明仅授权读取"development" namespace中的资源，若不定义该字段，则表示整个集群的Pod资源都可访问
subjects:
- kind: ServiceAccount
  name: vg-1-1-reader
  namespace: vg-1-1
roleRef:
  kind: ClusterRole
  name: tfcluster
  apiGroup: rbac.authorization.k8s.io