无法创建群集。 <>已被指定为"容器引擎管理员"的角色&安培; "容器引擎集群管理员"
Error from server (Forbidden): error when creating "prometheus-
operator/prometheus-operator-cluster-role.yaml":
clusterroles.rbac.authorization.k8s.io "prometheus-operator"
is forbidden: attempt to grant extra privileges: [{[create]
[extensions] [thirdpartyresources] [] []} {[*]
[monitoring.coreos.com] [alertmanagers] [] []} {[*]
[monitoring.coreos.com] [prometheuses] [] []} {[*]
[monitoring.coreos.com] [servicemonitors] [] []} {[*]
[apps] [statefulsets] [] []} {[*] [] [configmaps] [] []}
{[*] [] [secrets] [] []} {[list] [] [pods] [] []} {[delete]
[] [pods] [] []} {[get] [] [services] [] []} {[create]
[] [services] [] []} {[update] [] [services] [] []} {[get]
[] [endpoints] [] []} {[create] [] [endpoints] [] []}
{[update] [] [endpoints] [] []} {[list] [] [nodes]
[] []} {[watch] [] [nodes] [] []}]
user=&{<<my_account>>@gmail.com
[system:authenticated] map[]} ownerrules=[{[create]
[authorization.k8s.io] [selfsubjectaccessreviews]
[] []} {[get] [] [] [] [/api /api/* /apis /apis/*
/healthz /swaggerapi /swaggerapi/* /version]}]
ruleResolutionErrors=[]
答案 0 :(得分:42)
我在Google Kubernetes Engine上遇到了同样的问题。
根据 enj 的回答和 ccyang2005 的评论,请找到解决我问题的以下snipet:)
gcloud info | grep Account
会输出类似Account: [myname@example.org]
kubectl create clusterrolebinding myname-cluster-admin-binding \
--clusterrole=cluster-admin \
--user=myname@example.org
将输出类似Clusterrolebinding "myname-cluster-admin-binding" created
之后,您将能够创建CusterRoles
答案 1 :(得分:11)
由于Container Engine在创建Role或ClusterRole时检查权限的方式,您必须首先创建一个RoleBinding,授予您要创建的角色中包含的所有权限。
示例解决方法是创建一个RoleBinding,在尝试创建其他Role或ClusterRolepermissions之前为您的Google身份提供群集管理员角色。
这是Kubernetes和Container Engine 1.6版中基于角色的访问控制的Beta版本中的一个已知问题。
因此,您需要将帐户绑定到群集管理员角色。