新增learn-kubernetes（https://github.com/yyong-brs/learn-kubernetes）相关文件

learn/learn-kubernetes-master/kiamol/ch17/lab/README.md

@@ -0,0 +1,51 @@
+# ch17 lab
+
+## Setup
+
+Deploy the Kube Explorer app in the lab configuration:
+
+```
+kubectl apply -f lab/kube-explorer/
+```
+
+Note that [02-service-account.yaml](./kube-explorer/02-service-account.yaml) sets `automountServiceAccountToken` to `false` so Pods don't automatically see the token; [04-deployment.yaml](./kube-explorer/04-deployment.yaml) explicitly mounts the token in the Pod spec.
+
+> Browse to the app and check you can access Pods - e.g. http://localhost:8022
+
+> But not Pods in the lab namespace - http://localhost:8022?ns=kiamol-ch17-lab
+
+## Sample Solution
+
+To access Pods in the lab namespace [rbac-pods.yaml](./solution/rbac-pods.yaml) applies the `default-pod-reader-lab` ClusterRole to the lab namespace:
+
+```
+kubectl apply -f lab/solution/rbac-pods.yaml
+```
+
+> Now you can work with Pods in the lab namespace - http://localhost:8022?ns=kiamol-ch17-lab
+
+![Kube Explorer browsing Pods in the lab namespace](./solution/pods.png)
+
+> But not Service Accounts - http://localhost:8022/ServiceAccounts
+
+To access Service Accounts [rbac-serviceaccounts.yaml](./solution/rbac-serviceaccounts.yaml) creates:
+
+- a ClusterRole with get and list access to ServiceAccounts
+- a RoleBinding applying the ClusterRole to the default namespace
+- a RoleBinding applying the ClusterRole to the lab namespace
+
+```
+kubectl apply -f lab/solution/rbac-serviceaccounts.yaml
+```
+
+> Now you can access Pods in the default and lab namespaces - http://localhost:8022/ServiceAccounts?ns=kiamol-ch17-lab
+
+![Kube Explorer browsing Service Accounts in the lab namespace](./solution/service-accounts.png)
+
+## Teardown
+
+Delete all the resources:
+
+```
+kubectl delete ns,rolebinding,role,clusterrole -l kiamol=ch17-lab
+```