k8s RBAC 权限不足

**症状：**
```
Error from server (Forbidden): ... is forbidden: User "xxx" cannot ...
```

**排查：**
```bash
# 检查当前用户权限
kubectl auth can-i <verb> <resource> -n <namespace>
kubectl auth can-i create pods -n default

# 模拟其他用户权限
kubectl auth can-i create pods --as=system:serviceaccount:default:default
```

**解决：**
```bash
# 创建 Role 和 RoleBinding
kubectl create role <name> --verb=get,list,create --resource=pods -n <namespace>
kubectl create rolebinding <name> --role=<role-name> --user=<username> -n <namespace>
```