Question

我在使用Kubernetes时遇到问题。我现在尝试将服务部署两天，但我做错了。

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/\": No policy matched.",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}

有人知道这个问题可能是什么吗？这也是我的yaml文件：

# Certificate
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
 name: ${APP_NAME}
spec:
 secretName: ${APP_NAME}-cert
 dnsNames:
   - ${URL}
   - www.${URL}
 acme:
   config:
     - domains:
         - ${URL}
         - www.${URL}
       http01:
         ingressClass: nginx
 issuerRef:
   name: ${CERT_ISSUER}
   kind: ClusterIssuer

---
# Ingress
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ${APP_NAME}
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/from-to-www-redirect: 'true'
spec:
  tls:
  - secretName: ${APP_NAME}-cert
    hosts:
    - ${URL}
    - www.${URL}
  rules:
  - host: ${URL}
    http:
      paths:
      - backend:
          serviceName: ${APP_NAME}-service
          servicePort: 80

---
# Service
apiVersion: v1
kind: Service
metadata:
  name: ${APP_NAME}-service
  labels:
    app: ${CI_PROJECT_NAME}
spec:
  selector:
    name: ${APP_NAME}
    app: ${CI_PROJECT_NAME}
  ports:
    - name: http
      port: 80
      targetPort: http

---
# Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${APP_NAME}
  labels:
    app: ${CI_PROJECT_NAME}
spec:
  replicas: ${REPLICAS}
  revisionHistoryLimit: 0
  selector:
    matchLabels:
      app: ${CI_PROJECT_NAME}
  template:
    metadata:
      labels:
        name: ${APP_NAME}
        app: ${CI_PROJECT_NAME}
    spec:
      containers:
        - name: webapp
          image: eu.gcr.io/my-site/my-site.com:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 80
          env:
            - name: COMMIT_SHA
              value: ${CI_COMMIT_SHA}
          livenessProbe:
            tcpSocket:
              port: 80
            initialDelaySeconds: 30
            timeoutSeconds: 1
          readinessProbe:
            tcpSocket:
              port: 80
            initialDelaySeconds: 5
            timeoutSeconds: 1
          resources:
            requests:
              memory: '16Mi'
            limits:
              memory: '64Mi'
      imagePullSecrets:
        - name: ${REGISTRY_PULL_SECRET}

有人可以帮助我吗？我被卡住了，不知道可能是什么问题。这也是我的第一个Kubernetes项目。

Answer 1

"message": "forbidden: User \"system:anonymous\" cannot get path \"/\": No policy matched.",

..就是说的意思：您对kubernetes api的请求未通过身份验证（这是system:anonymous部分），并且您的RBAC配置不容许匿名用户向kubernetes api发送任何请求API

这里没有人能够帮助您解决该问题，因为解决方法取决于大量的变量。也许请您的群集管理员为您提供正确的凭据。

Answer 2

我已经在此post中进行了解释。您将需要ServiceAccount，ClusterRole和RoleBinding。您可以在此article中找到解释。就像Matthew L Daniel在Kubernetes文档中提到的那样。如果仍然有问题，请提供用于部署集群的方法/教程（因为“ Gitlab Kubernetes集成”对使用的方法没有多大帮助）。

我对Kubernetes部署有问题。有人可以帮我尝试连接到群集IP时始终出现此错误吗

2 个答案: