我有一个简单的RBAC配置,可以访问Kubernetes API集群内。但是,我从kubectl
中获得了似乎有冲突的信息。部署清单后,似乎RBAC已正确设置。
$ kubectl exec -ti pod/controller -- kubectl auth can-i get namespaces
Warning: resource 'namespaces' is not namespace scoped
yes
但是,实际上发出请求会产生权限错误
$ kubectl exec -ti pod/controller -- kubectl get namespaces
Error from server (Forbidden): namespaces is forbidden: User "system:serviceaccount:default:controller" cannot list resource "namespaces" in API group "" at the cluster scope
command terminated with exit code 1
apiVersion: 'v1'
kind: 'ServiceAccount'
metadata:
name: 'controller'
---
apiVersion: 'rbac.authorization.k8s.io/v1'
kind: 'Role'
metadata:
name: 'read-namespaces'
rules:
- apiGroups:
- ''
resources:
- 'namespaces'
verbs:
- 'get'
- 'watch'
- 'list'
---
apiVersion: 'rbac.authorization.k8s.io/v1'
kind: 'RoleBinding'
metadata:
name: 'read-namespaces'
roleRef:
apiGroup: ''
kind: 'Role'
name: 'read-namespaces'
subjects:
- kind: 'ServiceAccount'
name: 'controller'
---
apiVersion: 'v1'
kind: 'Pod'
metadata:
name: 'controller'
labels:
'app': 'controller'
spec:
containers:
- name: 'kubectl'
image: 'bitnami/kubectl:latest'
imagePullPolicy: 'Always'
command:
- 'sleep'
- '3600'
serviceAccountName: 'controller'
---
我尝试过kubectl auth reconcile -f manifest.yaml
和kubectl apply -f manifest.yaml
,结果是相同的。
我还将“ read-namespaces” RoleBinding.subjects[0].namespace
设置为适当的名称空间(在这种情况下为“默认”)。输出无变化。
角色是每个命名空间,您需要使用ClusterRoleBinding
创建集群角色和绑定>