通过添加 Role 与 RoleBinding 搞定了

1）创建 Role 配置文件 configmap-reader-role.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: configmap-reader
rules:
- apiGroups: [""] # "" indicates the core API group
  resourceNames:
    - appsettings.shared.json
  resources:
    - configmaps
  verbs:
    - get

2）在集群中添加该 Role

kubectl apply -f configmap-reader-role.yaml

3）创建 configmap-reader-rolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-configmap
  namespace: production
subjects:
- kind: ServiceAccount
  name: default
roleRef:
  kind: Role 
  name: configmap-reader # this must match the name of the Role you wish to bind to
  apiGroup: rbac.authorization.k8s.io

注：default 是 pod 的默认 ServiceAccount

4）在集群中添加该 RoleBinding

kubectl apply -f configmap-reader-rolebinding.yaml