用户“system:serviceaccount:gitlab:default”无法获取命名空间“gitlab”中 API 组“apps”中的资源“部署”

问题描述 投票：0回答：1

我正在尝试从 gitlab kubernetes 执行器运行 k8s 部署作业。

我使用 helm 部署了 kubernetes runner，如下所示。

我的values.yaml包含以下rbac规则：

rbac:
  create: true
  rules:
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["list", "get", "watch", "create", "delete"]
    - apiGroups: [""]
      resources: ["pods/exec"]
      verbs: ["create"]
    - apiGroups: [""]
      resources: ["pods/log"]
      verbs: ["get"]
    - apiGroups: [""]
      resources: ["pods/attach"]
      verbs: ["list", "get", "create", "delete", "update"]
    - apiGroups: [""]
      resources: ["secrets"]
      verbs: ["list", "get", "create", "delete", "update"]      
    - apiGroups: [""]
      resources: ["configmaps"]
      verbs: ["list", "get", "create", "delete", "update"]
    - apiGroups: [""]
      resources: ["services"]
      verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
    - apiGroups: ["apps"]
      resources: ["deployments"]
      verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]


  clusterWideAccess: true

  podSecurityPolicy:
    enabled: false
    resourceNames:
    - gitlab-runner

然后

helm install --namespace gitlab gitlab-runner -f values.yaml gitlab/gitlab-runner

并且，我的 .gitlab-ci.yml 有以下阶段：

  script:
    - mkdir -p /etc/deploy
    - echo $kube_config |base64 -d > $KUBECONFIG
    - sed -i "s/IMAGE_TAG/$CI_PIPELINE_ID/g" deployment.yaml
    - cat deployment.yaml
    - kubectl apply -f deployment.yaml

并且，我在管道日志中收到以下错误：

$ kubectl apply -f deployment.yaml
Error from server (Forbidden): error when retrieving current configuration of:
Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment"
Name: "java-demo", Namespace: "gitlab"
Object: &{map["apiVersion":"apps/v1" "kind":"Deployment" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"java-demo" "namespace":"gitlab"] "spec":map["replicas":'\x01' "selector":map["matchLabels":map["app":"java-demo"]] "template":map["metadata":map["labels":map["app":"java-demo"]] "spec":map["containers":[map["image":"square2019/dummy-repo:555060965" "imagePullPolicy":"Always" "name":"java-demo" "ports":[map["containerPort":'\u1f90']]]]]]]]}
from server for: "deployment.yaml": deployments.apps "java-demo" is forbidden: User "system:serviceaccount:gitlab:default" cannot get resource "deployments" in API group "apps" in the namespace "gitlab"
Error from server (Forbidden): error when retrieving current configuration of:
Resource: "/v1, Resource=services", GroupVersionKind: "/v1, Kind=Service"
Name: "java-demo", Namespace: "gitlab"
Object: &{map["apiVersion":"v1" "kind":"Service" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"java-demo" "namespace":"gitlab"] "spec":map["ports":[map["name":"java-demo" "port":'P' "targetPort":'\u1f90']] "selector":map["app":"java-demo"] "type":"ClusterIP"]]}
from server for: "deployment.yaml": services "java-demo" is forbidden: User "system:serviceaccount:gitlab:default" cannot get resource "services" in API group "" in the namespace "gitlab"
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: command terminated with exit code 1

我是否缺少一些 RBAC 规则？

谢谢你！

===更新2022.06.04 =====

kubectl get role -n gitlab -o yaml
apiVersion: v1
items: []
kind: List
metadata:
  resourceVersion: ""

===更新2022.06.05 ===

查看https://gitlab.com/gitlab-org/charts/gitlab-runner/-/blob/main/templates/role.yaml中的逻辑，我用

修改了values.yaml 
clusterWideAccess: false

现在我的角色是：

k get role -n gitlab -o yaml
apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    annotations:
      meta.helm.sh/release-name: gitlab-runner
      meta.helm.sh/release-namespace: gitlab
    creationTimestamp: "2022-06-05T03:49:57Z"
    labels:
      app: gitlab-runner
      app.kubernetes.io/managed-by: Helm
      chart: gitlab-runner-0.41.0
      heritage: Helm
      release: gitlab-runner
    name: gitlab-runner
    namespace: gitlab
    resourceVersion: "283754"
    uid: 8040b295-c9fc-47cb-8c5c-74cbf6c4d8a7
  rules:
  - apiGroups:
    - ""
    resources:
    - pods
    verbs:
    - list
    - get
    - watch
    - create
    - delete
  - apiGroups:
    - ""
    resources:
    - pods/exec
    verbs:
    - create
  - apiGroups:
    - ""
    resources:
    - pods/log
    verbs:
    - get
  - apiGroups:
    - ""
    resources:
    - pods/attach
    verbs:
    - list
    - get
    - create
    - delete
    - update
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - list
    - get
    - create
    - delete
    - update
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - list
    - get
    - create
    - delete
    - update
  - apiGroups:
    - ""
    resources:
    - services
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
kind: List
metadata:
  resourceVersion: ""

服务帐户和角色绑定

k get sa -n gitlab
NAME            SECRETS   AGE
default         1         3d2h
gitlab-runner   1         2d2h

k get RoleBinding -n gitlab
NAME            ROLE                 AGE
gitlab-runner   Role/gitlab-runner   9h

但是，同样的错误仍然存在。

===更新2022.06.06 ===

我暂时应用了以下方法来解决该问题

kubectl create rolebinding --namespace=gitlab gitlab-runner-4 --role=gitlab-runner --serviceaccount=gitlab:default
kubernetes gitlab gitlab-ci gitlab-ci-runner kubernetesexecutor
1个回答
0
投票

我遇到了同样的问题，并通过定义 

ClusterRole
和 
ClusterRoleBinding
来解决它。我不确定，但我认为当您在 gitlab runner 图表中定义 rbac 时，它不适用。因为当我想列出它们时，却什么也没有。这是我的 ClusterRole 和 ClusterRoleBinding :

集群角色.yml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  namespace: gitlab-runner
  name: runner-role
rules:
- apiGroups: [""]
  resources: ["configmaps", "pods", "pods/attach", "secrets", "services", "serviceaccounts", "events"]
  verbs: ["get", "list", "watch", "create", "patch", "update", "delete"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create", "patch", "delete"]
- apiGroups: ["apps", "extensions"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "list"]
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["get", "create", "list"]

ClusterRoleBinding.yml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: runner-binding
  namespace: gitlab-runner
roleRef: # points to the Role
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: runner-role # name of Role
subjects: # points to the ServiceAccount
- kind: ServiceAccount
  name: default # service account to bind to
  namespace: gitlab-runner # ns of service account

希望有帮助！

最新问题
© www.soinside.com 2019 - 2024. All rights reserved.