Question

我正在尝试访问仪表板，但出现以下错误

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "services \"kubernetes-dashboard\" is forbidden: User \"operation\" cannot get services/proxy in the namespace \"kube-system\"",
  "reason": "Forbidden",
  "details": {
    "name": "kubernetes-dashboard",
    "kind": "services"
  },
  "code": 403
}

我的群集角色如下所示。

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
    namespace: '*'
    name: pod-reader
rules:
    - apiGroups: ["", "extensions", "apps"]
      resources: ["pods"]
      verbs: ["get", "list", "watch"]

我的群集角色绑定如下所示。

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
    name: read-pods
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: pod-reader
subjects:
    - kind: User
      name: operation
      namespace: kube-system

我很清楚这是非常基本的。但是我试图添加各种各样的东西都无济于事。关于它的外观有什么建议吗？

Answer 1

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
    name: pod-reader
rules:
    - apiGroups: [""]
      resources:
          - services/proxy
      verbs: ["get", "list", "watch"]

群集角色允许查看仪表板

1 个答案: