改进：model资源支持rbac认证，需要打开enable_rbac选项，默认关闭。非model资源还不支持

scripts/rbac/member.yaml

@@ -0,0 +1,8 @@
+# rbac for normal user, not allow for delete
+is_admin: false
+policy:
+  *:
+    *:
+      *: allow
+      create: deny
+      delete: deny

scripts/rbac/projectowner.yaml

@@ -0,0 +1,7 @@
+# rbac for project owner, not allow for delete
+condition: roles.contains("project_owner")
+is_admin: false
+policy:
+  *:
+    *:
+      *: allow

scripts/rbac/sysadmin.yaml

@@ -0,0 +1,5 @@
+# rbac for sysadmin
+condition: tenant=="system" && roles.contains("admin")
+is_admin: true
+policy:
+  *: allow