Question

我正在尝试创建具有受限命名空间访问权限的用户。创建了名为test的命名空间，还创建了Group：programmers，User：frontend。通过遵循http://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/

为user：frontend生成凭据

我创建了一个角色。这是我的role.yml

kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
    namespace: test
    name: frontend-developer
 rules:
 - apiGroups: ["","extensions","apps"]
   resources: ["deployments","replicasets","pods"]
   verbs: ["get","list","watch","create","patch"]`

我创建了角色绑定。这是role-binding.yml

kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: frontend-deploy
   namespace: test
 subjects:
 - kind: User
   name: frontend
   namespace: test
 roleRef:
   kind: Role
   name: frontend-developer
   apiGroup: rbac.authorization.k8s.io

我说我的部署文件为

apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
   name: nodefrontend
   namespace: test
 spec:
   replicas: 3
   template:
     metadata:
       labels:
         app: bookstore
     spec:
       containers:
       - name: nodeweb
         image: balipalligayathri/devops-develop
         ports:
         - name: http
           containerPort: 3000
           protocol: TCP

我在创建角色和角色绑定时正在使用以下命令

$ kubectl create -f role.yml
$ kubectl create -f role-binding.yml

创建了前端开发人员角色和前端部署角色绑定。

同样，我正在使用命令kubectl create -f node-deployment.yml进行部署创建。部署已创建并成功删除。在这里，我在创建部署时没有提及任何用户。因此，我正在尝试使用以下命令与用户一起创建部署。

kubectl create -f node-deployment.yml --as=frontend --context=frontend-context

我正面临着这样的错误

Error from server (Forbidden):

<html><head><meta http-equiv='refresh' content='1;url=/login?from=%2Fswagger-2.0.0.pb-v1%3Ftimeout%3D32s'/><script>window.location.replace('/login?from=%2Fswagger-2.0.0.pb-v1%3Ftimeout%3D32s');</script></head><body style='background-color:white; color:white;'>
    Authentication requiredhttps://stackoverflow.com/questions/48164369/kubernetes-   1-8-dashboard-configurations-fails-with-error-no-kind-role-is-regi
    You are authenticated as: anonymous
    Groups that you are in:
    Permission you need to have (but didn't): hudson.model.Hudson.Read
    which is implied by: hudson.security.Permission.GenericRead
    which is implied by: hudson.model.Hudson.Administer    </body></html>

我的疑问是：是否有必要在deployment.yml文件中提及用户？

Answer 1

您需要创建一个serviceAccount，并查看以下代码段：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: myAccount

将其绑定到您的角色：

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: myBinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: frontend-developer
subjects:
- kind: ServiceAccount
  name: myAccount

并在您的部署中使用它：

apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
   name: nodefrontend
   namespace: test
spec:
  template:
    metadata:
      labels:
        ...
    spec:
      serviceAccountName: myAccount

参考：

无法发现支持的资源

1 个答案: