Question

我正在关注Configure RBAC来创建用户帐户，一切正常，但在更新上下文之后，在使用创建的用户绑定任何角色之前，apiserver kubectl get pods会返回广告连播。

apiserver配置

KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"
KUBE_API_PORT="--insecure-port=8080"
KUBELET_PORT="--kubelet-port=10250"
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota"
KUBE_API_ARGS="--client-ca-file=/srv/kubernetes/ca.crt --tls-cert-file=/srv/kubernetes/server.crt --tls-private-key-file=/srv/kubernetes/server.key --authorization-mode=RBAC"

kubectl config

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /srv/kubernetes/ca.crt
    server: http://172.16.3.23:8080
  name: local
contexts:
- context:
    cluster: local
    namespace: kube-system
    user: devops
  name: devops
current-context: devops
kind: Config
preferences: {}
users:
- name: devops
  user:
    client-certificate: /.cert/devops.crt
    client-key: /.cert/devops.key

p.s：我正在使用centos裸机环境

Answer 1

不安全的端口（http://...:8080）绕过所有身份验证和授权

在K8S v 1.8.1中配置RABC

1 个答案: