OpenShift服务帐户权限读取Pod和部署状态

时间:2018-01-03 21:59:39

标签: api permissions openshift

我想使用OpenShift REST api从单独的门户网站进行查询。我们首先使用以下步骤创建了一个服务帐户(其中my-id是项目中的管理员):

C:\openshift>oc login
Authentication required for https://openshift-test.foo.com:8443 (openshift)
Username: my-id
Password:
Login successful.

You have access to the following projects and can switch between them with 'oc project <projectname>':

  * datalake-replication-consumers
    datalake-replication-demo

Using project "datalake-replication-consumers".

C:\openshift>oc create serviceaccount gmi-registry
serviceaccount "gmi-registry" created

C:\openshift>oc policy add-role-to-user admin system:serviceaccounts:datalake-replication-consumers:gmi-registry
role "admin" added: "system:serviceaccounts:datalake-replication-consumers:gmi-registry"

C:\openshift>oc serviceaccounts get-token gmi-registry
<token here>

然后我将该令牌作为持有人令牌粘贴到Postman中以进行一些api调用。由于我将我的服务帐户添加到项目中的管理员角色,因此我认为这样可行,但我们会重新获得403.

GET pods:

https://openshift-test.foo.com:8443/api/v1/namespaces/datalake-replication-consumers/pods

响应:

{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "User \"system:serviceaccount:datalake-replication-consumers:gmi-registry\" cannot list pods in project \"datalake-replication-consumers\"",
    "reason": "Forbidden",
    "details": {
        "kind": "pods"
    },
    "code": 403
}

获取具体部署:

https://openshift-test.foo.com:8443/oapi/v1/namespaces/datalake-replication-consumers/deploymentconfigs/entity-65869977-9d56-49a5-afa2-4a547df82d5c

响应:

{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "User \"system:serviceaccount:datalake-replication-consumers:gmi-registry\" cannot get deploymentconfigs in project \"datalake-replication-consumers\"",
    "reason": "Forbidden",
    "details": {
        "name": "entity-65869977-9d56-49a5-afa2-4a547df82d5c",
        "kind": "deploymentconfigs"
    },
    "code": 403
}

我们在此处缺少服务帐户权限?

UDPATE :我还应该补充一点,我将自己的承载令牌从CLI中取出并将其用于两个呼叫。这很有用。

1 个答案:

答案 0 :(得分:1)

这不是一个非常令人兴奋的答案,但是当我们安装v3.7实例时,我们的问题就解决了。我的初步测试是在v1.5上,我认为在企业版中对应3.5或3.6?