无法使用RBAC列出部署资源
无法使用RBAC列出部署资源
提问于 2018-03-26 15:29:03
我正在对Kubernetes中的用户使用x509身份验证，这很好。然而，虽然提供访问部署的权限似乎不太好，但如下所示：
作用：
# kubectl get rolebindings devops-rb -n demo -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
creationTimestamp: 2018-03-26T13:43:49Z
name: devops-rb
namespace: demo
resourceVersion: "2530329"
selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/demo/rolebindings/devops-rb
uid: b6c17e28-30fb-11e8-b530-000d3a11bb2f
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: devops-role
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: devops角色绑定：
# kubectl get roles devops-role -n demo -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
creationTimestamp: 2018-03-26T13:43:49Z
name: devops-role
namespace: demo
resourceVersion: "2538402"
selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/demo/roles/devops-role
uid: b6bee0fb-30fb-11e8-b530-000d3a11bb2f
rules:
- apiGroups:
- ""
resources:
- pods
- secrets
- services
- replicasets
- persistentvolumeclaims
- deployments
verbs:
- get
- list
- watch试图使用用户配置列出部署：
# kubectl --kubeconfig /root/.kube/config-tesla get deploy -n demo
Error from server (Forbidden): deployments.extensions is forbidden: User "tesla" cannot list deployments.extensions in the namespace "demo"试图使用admin配置列出部署：
# kubectl get deploy -n demo
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
wordpress 1 1 1 1 13d
wordpress-mysql 1 1 1 1 13d试图使用用户配置列出豆荚：
# kubectl --kubeconfig /root/.kube/config-tesla get po -n demo
NAME READY STATUS RESTARTS AGE
ncp-centos-pod 1/1 Running 0 12d
wordpress-77d578745-vdgr9 1/1 Running 0 13d
wordpress-mysql-58cf8dc9f9-pzvbs 1/1 Running 0 13d试图使用admin配置列出吊舱：
# kubectl get pods -n demo
NAME READY STATUS RESTARTS AGE
ncp-centos-pod 1/1 Running 0 12d
wordpress-77d578745-vdgr9 1/1 Running 0 13d
wordpress-mysql-58cf8dc9f9-pzvbs 1/1 Running 0 13d回答 2
Stack Overflow用户
回答已采纳
发布于 2018-03-26 15:50:02
复制集和部署存在于“扩展”和“应用程序”API组中，而不是遗留的“组”中。
尝试：
rules:
- apiGroups:
- ""
resources:
- pods
- secrets
- services
- persistentvolumeclaims
verbs:
- get
- list
- watch
- apiGroups:
- extensions
- apps
resources:
- deployments
- replicasets
verbs:
- get
- list
- watchStack Overflow用户
发布于 2018-03-27 04:44:55
如果我对你的理解正确..。
检查：
kubectl describe clusterrole |grep devops-role
kubectl describe clusterrole |grep devops-rb
kubectl describe clusterrole | less页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/49495189
复制相关文章
相似问题
腾讯云开发者
