Question

我想使用OpenShift REST api从单独的门户网站进行查询。我们首先使用以下步骤创建了一个服务帐户（其中my-id是项目中的管理员）：

C:\openshift>oc login
Authentication required for https://openshift-test.foo.com:8443 (openshift)
Username: my-id
Password:
Login successful.

You have access to the following projects and can switch between them with 'oc project <projectname>':

  * datalake-replication-consumers
    datalake-replication-demo

Using project "datalake-replication-consumers".

C:\openshift>oc create serviceaccount gmi-registry
serviceaccount "gmi-registry" created

C:\openshift>oc policy add-role-to-user admin system:serviceaccounts:datalake-replication-consumers:gmi-registry
role "admin" added: "system:serviceaccounts:datalake-replication-consumers:gmi-registry"

C:\openshift>oc serviceaccounts get-token gmi-registry
<token here>

然后我将该令牌作为持有人令牌粘贴到Postman中以进行一些api调用。由于我将我的服务帐户添加到项目中的管理员角色，因此我认为这样可行，但我们会重新获得403.

GET pods：

https://openshift-test.foo.com:8443/api/v1/namespaces/datalake-replication-consumers/pods

响应：

{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "User \"system:serviceaccount:datalake-replication-consumers:gmi-registry\" cannot list pods in project \"datalake-replication-consumers\"",
    "reason": "Forbidden",
    "details": {
        "kind": "pods"
    },
    "code": 403
}

获取具体部署：

https://openshift-test.foo.com:8443/oapi/v1/namespaces/datalake-replication-consumers/deploymentconfigs/entity-65869977-9d56-49a5-afa2-4a547df82d5c

响应：

{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "User \"system:serviceaccount:datalake-replication-consumers:gmi-registry\" cannot get deploymentconfigs in project \"datalake-replication-consumers\"",
    "reason": "Forbidden",
    "details": {
        "name": "entity-65869977-9d56-49a5-afa2-4a547df82d5c",
        "kind": "deploymentconfigs"
    },
    "code": 403
}

我们在此处缺少服务帐户权限？

UDPATE ：我还应该补充一点，我将自己的承载令牌从CLI中取出并将其用于两个呼叫。这很有用。

Answer 1

这不是一个非常令人兴奋的答案，但是当我们安装v3.7实例时，我们的问题就解决了。我的初步测试是在v1.5上，我认为在企业版中对应3.5或3.6？

OpenShift服务帐户权限读取Pod和部署状态

1 个答案: