Question

我们正在测试Shiny-proxy Kubernetes容器，每个应用程序都旋转它自己的容器，直到这部分工作正常为止。我们进行了一些更改，以创建PVC / PV来保留每个容器的用户特定数据，请注意，尽管我为该帐户配置了以下角色，但serviceaccount无法创建PVC。通常，是否还有其他步骤可确保SA能够访问/创建PVC？

从普通容器中进行测试时可以访问PV / PVC，但是似乎与用于创建新容器的服务帐户角色/权限有关。

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: sp-ns
  name: sp-sa
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "persistentvolumeclaims"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

我已经验证了serviceaccount角色的设置正确，如下所示，命令返回“ yes”。

kubectl auth can-i create pvc --as=system:serviceaccount:sp-ns:sp-sa -n sp-ns

从应用程序创建容器时出错：

at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
    Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: http://localhost:8001/api/v1/namespaces/sp-ns/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods "sp-pod-92e1efc0-0859-4a87-8b9b-04d6adaa11f5" is forbidden: user "system:serviceaccount:sp-ns:sp-sa" is not an admin and does not have permissions to use host bind mounts for resource .
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:503)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:440)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:406)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:365)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleCreate(OperationSupport.java:234)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleCreate(BaseOperation.java:735)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.create(BaseOperation.java:325)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.create(BaseOperation.java:321)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.lambda$createNew$0(BaseOperation.java:336)
    at io.fabric8.kubernetes.api.model.DoneablePod.done(DoneablePod.java:26)
    at eu.openanalytics.containerproxy.backend.kubernetes.KubernetesBackend.startContainer(KubernetesBackend.java:223)
    at eu.openanalytics.containerproxy.backend.AbstractContainerBackend.doStartProxy(AbstractContainerBackend.java:129)
    at eu.openanalytics.containerproxy.backend.AbstractContainerBackend.startProxy(AbstractContainerBackend.java:110)
    ... 95 more

Answer 1

容器未以特权运行。在pod规范中使用privileged: true。
服务帐户没有cluster-admin角色。在下面使用以提供许可。

kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=sp-ns:sp-sa

Serviceaccount无法创建永久的体积声明（PVC）

1 个答案: