Question

我正在使用EKS群集。我有一个脚本，该脚本在自定义资源上调用“监视” API。当我从笔记本电脑使用群集管理凭据运行此脚本时，可以看到事件按预期到达。但是，每当我使用集群内的安全凭证在Pod中运行此脚本时，都不会到达任何事件，但是不会出现身份验证或其他错误。这似乎不是名称空间的问题，因为无论是否在身份验证脚本的同一名称空间中创建资源以及吊舱的位置，我都看到相同的行为。

可能是什么原因造成的？

我正在发出的API请求是：

GET /apis/mydomain.com/v1/mycustomresource?watch=1

非常感谢收到任何帮助。

这是ClusterRole：

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1 
metadata:
  name: manage-mycustomresource
  namespace: kube-system
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true" 
    rbac.authorization.k8s.io/aggregate-to-edit: "true" 
rules:
- apiGroups: ["*"] 
  resources: ["*"] 
  verbs: ["*"]

...这是ClusterRoleBinding：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    meta.helm.sh/release-name: mycustomresource-operator
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2020-07-01T13:23:08Z"
  labels:
    app.kubernetes.io/managed-by: Helm
  name: mycustomresource-operator
  resourceVersion: "12976069"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/mycustomresource-operator
  uid: 41e6ef6d-cc96-43ec-a58e-48299290f1bc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: mycustomresource-operator
  namespace: kube-system

...以及广告连播的ServiceAccount：

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::043180741939:role/k8s-mycustomresource-operator
    meta.helm.sh/release-name: mycustomresource-operator
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2020-07-01T13:23:08Z"
  labels:
    app.kubernetes.io/instance: mycustomresource-operator
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mycustomresource-operator
    app.kubernetes.io/version: 1.16.0
    helm.sh/chart: mycustomresource-operator-0.1.0
  name: mycustomresource-operator
  namespace: kube-system
  resourceVersion: "12976060"
  selfLink: /api/v1/namespaces/kube-system/serviceaccounts/mycustomresource-operator
  uid: 4f30b10b-1deb-429e-95e4-2ff2a91a32c3
secrets:
- name: mycustomresource-operator-token-qz9xz

运行脚本的部署：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
    meta.helm.sh/release-name: mycustomresource-operator
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2020-07-01T13:23:08Z"
  generation: 1
  labels:
    app.kubernetes.io/instance: mycustomresource-operator
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: mycustomresource-operator
    app.kubernetes.io/version: 1.16.0
    helm.sh/chart: mycustomresource-operator-0.1.0
  name: mycustomresource-operator
  namespace: kube-system
  resourceVersion: "12992297"
  selfLink: /apis/extensions/v1beta1/namespaces/kube-system/deployments/mycustomresource-operator
  uid: 7b118d47-e467-48f9-b497-f9e4592e6baf
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: mycustomresource-operator
      app.kubernetes.io/name: mycustomresource-operator
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/instance: mycustomresource-operator
        app.kubernetes.io/name: mycustomresource-operator
    spec:
      containers:
      - image: myrepo.com/myrepo/k8s-mycustomresource-operator:master
        imagePullPolicy: Always
        name: mycustomresource-operator
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: mycustomresource-operator
      serviceAccountName: mycustomresource-operator
      terminationGracePeriodSeconds: 30
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2020-07-01T13:23:08Z"
    lastUpdateTime: "2020-07-01T13:23:10Z"
    message: ReplicaSet "mycustomresource-operator-5dc74765cd" has successfully progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  - lastTransitionTime: "2020-07-01T15:13:31Z"
    lastUpdateTime: "2020-07-01T15:13:31Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

Answer 1

使用以下命令检查服务帐户的权限

kubectl auth can-i watch mycustomresource --as=system:serviceaccount:kube-system:ycustomresource-operator -n kube-system

Kubernetes``监视''未从Pod内部接收事件

1 个答案: