k8s应用服务权限问题无法读取configmap

ⅰ亾dé卋堺 提交于 2019-11-28 04:17:36

报错信息:

Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. User "system:serviceaccount:mycomp-services-process:default" cannot get resource “pods” in API group "" in the namespace "sscp-sit"

报错截图:

解决方法:

在第一个错误中,问题是默认命名空间中的serviceaccount default无法获取服务,因为它无法访问list / get服务。 因此,您需要做的是使用clusterrolebinding为该用户分配角色。

参考:https://www.e-learn.cn/content/wangluowenzhang/504150

遵循一组最低权限,您可以先创建一个可以访问列表服务的角色:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: sscp-sit-minimal
  namespace: sscp-sit
rules:
- apiGroups:
  - ""
  - "extensions"
  resources:
  - nodes
  - services
  - endpoints
  - namespaces
  - ingresses
  - secrets
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  - "extensions"
  resources:
  - configmaps
  - events
  - ingresses/status
  verbs:
  - get
  - list
  - watch
  - update
  - create
  - patch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sscp-sit-minimal
  namespace: sscp-sit
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: sscp-sit-minimal
subjects:
- kind: ServiceAccount
  name: default
  namespace: sscp-sit
标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!