diff --git a/project/nwpu/k8s-rancher/2.account-management/1.account-management/01-account-management-base.yaml b/project/nwpu/k8s-rancher/2.account-management/1.account-management/01-account-management-base.yaml
new file mode 100644
index 0000000..da2e069
--- /dev/null
+++ b/project/nwpu/k8s-rancher/2.account-management/1.account-management/01-account-management-base.yaml
@@ -0,0 +1,21 @@
+# 01-account-management-base.yaml
+
+####################################################
+# supwisdom harbor private docker registry
+####################################################
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: account-management
+  name: account-management-svc
+  labels:
+    app: account-management-svc
+spec:
+  ports:
+  - port: 80
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app: account-management-ui
\ No newline at end of file
diff --git a/project/nwpu/k8s-rancher/2.account-management/1.account-management/02-account-management-env.yaml b/project/nwpu/k8s-rancher/2.account-management/1.account-management/02-account-management-env.yaml
new file mode 100644
index 0000000..33d95d0
--- /dev/null
+++ b/project/nwpu/k8s-rancher/2.account-management/1.account-management/02-account-management-env.yaml
@@ -0,0 +1 @@
+# 02-account-management-env.yaml
diff --git a/project/nwpu/k8s-rancher/2.account-management/1.account-management/03-account-management-ingresses.yaml b/project/nwpu/k8s-rancher/2.account-management/1.account-management/03-account-management-ingresses.yaml
new file mode 100644
index 0000000..5ba7843
--- /dev/null
+++ b/project/nwpu/k8s-rancher/2.account-management/1.account-management/03-account-management-ingresses.yaml
@@ -0,0 +1,18 @@
+# 03-account-management-ingresses.yaml
+
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  namespace: account-management
+  name: account-management-ingress
+spec:
+  rules:
+  # 修改为学校的根域名
+  - host: account-management.paas.xxx.edu.cn
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: account-management-svc
+          servicePort: http
diff --git a/project/nwpu/k8s-rancher/2.account-management/1.account-management/04-1-account-management.yaml b/project/nwpu/k8s-rancher/2.account-management/1.account-management/04-1-account-management.yaml
new file mode 100644
index 0000000..a6a7831
--- /dev/null
+++ b/project/nwpu/k8s-rancher/2.account-management/1.account-management/04-1-account-management.yaml
@@ -0,0 +1,71 @@
+# 04-1-account-management.yaml
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: account-management
+  name: account-management-env
+data:
+  # **修改** 学校的根域名
+  BASE_API: http://personal-security-center.paas.xxx.edu.cn/
+
+  AUTH_TYPE: cas
+
+  # AUTH_TYPE 为 cas 时，配置 AUTH_CAS、JWT_ISS、JWT_SECRET
+  AUTH_CAS: http://cas.paas.xxx.edu.cn/cas
+  JWT_ISS: http://cas.paas.xxx.edu.cn/cas
+  JWT_SECRET: (@<rhnPaUYKC_k770*DuWwYQ_#Zc#8c(2rB?kae)rN)>K7qy)awCjxp$L653Mf$2
+
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: account-management
+  name: account-management-svc
+  labels:
+    app: account-management-svc
+spec:
+  ports:
+  - port: 80
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app: account-management
+
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: account-management
+  name: account-management
+spec:
+  selector:
+    matchLabels:
+      app: account-management
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: account-management
+    spec:
+      containers:
+      - name: account-management
+        image: harbor.supwisdom.com/account-management/account-management:0.0.1
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: http
+        envFrom:
+        - configMapRef:
+           name: account-management-env
+        resources:
+          requests:
+            memory: "128Mi"
+          limits:
+            memory: "256Mi"
+      imagePullSecrets:
+        - name: harbor-supwisdom
diff --git a/project/nwpu/k8s-rancher/2.account-management/10.0.init.sql b/project/nwpu/k8s-rancher/2.account-management/10.0.init.sql
new file mode 100644
index 0000000..4148c76
--- /dev/null
+++ b/project/nwpu/k8s-rancher/2.account-management/10.0.init.sql
@@ -0,0 +1,71 @@
+-- 10.0.init.sql
+
+
+/*
+将 paas.example.com 替换为 paas.学校域名.edu.cn
+*/
+
+
+use cas_server;
+
+-- account-management 认证对接信息
+
+INSERT INTO `TB_SERVICE` (`ID`, `COMPANY_ID`, `DELETED`, `ADD_ACCOUNT`, `ADD_TIME`, 
+  `NAME`, `DESCRIPTION`, `INFORMATION_URL`, `LOGOUT_URL`, 
+  `RESPONSE_TYPE`, `LOGOUT_TYPE`, 
+  `EVALUATION_ORDER`, `FRIENDLY_NAME`, `REGISTERED_SERVICE_ID`, `SERVICE_ID`, 
+  `ENABLED`, `SSO_ENABLED`, `REQUIRE_ALL_ATTRIBUTES`, 
+  `APPLICATION_ID`, `EXTERNAL_ID`)
+VALUES ('300', '1', 0, 'admin', '2020-07-01 00:00:00',
+  '帐号分级管理', '帐号分级管理', 'https://account-management.paas.example.com', 'https://account-management.paas.example.com/?clearCertification=clearCertification', 
+  'REDIRECT', 'FRONT_CHANNEL', 
+  300, '帐号分级管理', 300, 'https://account-management.paas.example.com/(.*)', 
+  1, 1, 1, 
+  '300', '300');
+
+commit;
+
+-- 修改根域名
+update TB_SERVICE 
+set 
+  INFORMATION_URL='https://account-management.paas.example.com', 
+  LOGOUT_URL='https://account-management.paas.example.com/?clearCertification=clearCertification', 
+  SERVICE_ID='https://account-management.paas.example.com/(.*)', 
+  ID_TOKEN_ENABLED=1,
+  JWT_AS_SERVICE_TICKET=1,
+  APPLICATION_DOMAIN='account-management.paas.example.com'
+where ID='300';  -- todo, modify
+
+commit;
+
+-- user_authz
+
+use user_authz;
+
+INSERT INTO `TB_R_SYSTEM` (`ID`, `COMPANY_ID`, `DELETED`, `ADD_ACCOUNT`, `ADD_TIME`, 
+  `BUSINESS_DOMAIN_ID`, 
+  `CODE`, `NAME`, `DESCRIPTION`, `ENABLED`)
+VALUES ('300', '1', 0, 'admin', '2019-07-01 00:00:00', 
+  '1', 
+  'user-management-service', '用户管理服务', '用户管理服务', 1);
+
+
+INSERT INTO `TB_APPLICATION` (`ID`, `COMPANY_ID`, `DELETED`, `ADD_ACCOUNT`, `ADD_TIME`, 
+  `BUSINESS_DOMAIN_ID`, `SYSTEM_ID`, 
+  `NAME`, `APPLICATION_ID`, `SYNC_URL`, `ENABLED`)
+VALUES ('300', '1', 0, 'admin', '2019-07-01 00:00:00', 
+  '1', '300', 
+  '用户管理服务', '300', '', 1);
+
+
+INSERT INTO `TB_ROLE` (`ID`, `COMPANY_ID`, `DELETED`, `ADD_ACCOUNT`, `ADD_TIME`, 
+  `APPLICATION_ID`, `CODE`, `NAME`, `DESCRIPTION`, `ENABLED`, `EXTERNAL_ID`)
+VALUES ('300_31', '1', 0, 'admin', '2019-07-01 00:00:00', 
+  '300', 'user-management-grant-admin', '用户业务管理员', '用户业务管理员', 1, '31');
+
+INSERT INTO `TB_ROLE` (`ID`, `COMPANY_ID`, `DELETED`, `ADD_ACCOUNT`, `ADD_TIME`, 
+  `APPLICATION_ID`, `CODE`, `NAME`, `DESCRIPTION`, `ENABLED`, `EXTERNAL_ID`)
+VALUES ('300_32', '1', 0, 'admin', '2019-07-01 00:00:00', 
+  '300', 'user-management-man-grant-admin', '用户分级管理员', '用户分级管理员', 1, '32');
+
+commit;
diff --git a/project/nwpu/k8s-rancher/2.account-management/readme.md b/project/nwpu/k8s-rancher/2.account-management/readme.md
new file mode 100644
index 0000000..4446e09
--- /dev/null
+++ b/project/nwpu/k8s-rancher/2.account-management/readme.md
@@ -0,0 +1,23 @@
+# readme.md
+
+## 帐号分级管理 实施说明
+
+帐号分级管理，主要基于岗位用户组，以 部门 的维度进行分级管理
+
+即，根据 用户业务管理员 所属某个岗位 下的 部门，来控制 其 可以对 哪些 部门（行政部门）下的帐号进行管理
+
+* 部署时，已经初始化了 用户业务管理员 的角色
+
+* 实施时，在授权管理下，将某个岗位用户组 与 用户业务管理员角色 进行授权
+
+* 此时，隶属于 该岗位用户组 下的 帐号，就拥有了 用户业务管理员 的权限，而该帐号 在 此岗位用户组 下的 部门，就是他可管理的 帐号数据 的范围
+
+注意：如果将 用户业务管理员角色 直接授权给 某个帐号时，此帐号 只会有该服务的访问权限，无法看到帐号数据（即没有数据权限）。除非，此帐号 还隶属于 某个授权了 用户业务管理员角色 的岗位用户组
+
+
+## 帐号分级管理 发布说明
+
+* 将此服务的访问地址 （一般为 `https://account-management.paas.xxx.edu.cn` ）公布给使用人员。
+
+* 将此服务，由门户的服务管理进行发布，授予访问权限 给 用户业务管理员 角色 即可
+