如何在 Google Kubernetes Engine 中为 KubeIP 部署 ClusterRoleBinding
How to deploy ClusterRoleBinding in Google Kubernetes Engine for KubeIP
我在尝试将 KubeIP 部署到 GKE 时看到 RBAC 失败。
我已将问题归结为 KubeIP infrastructure 的以下部分:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: kubeip-sa
namespace: kube-system
rules:
- apiGroups: [""]
resources: ["nodes"]
verbs: ["get","list","watch","patch"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["get","list","watch"]
我从 kubectl
和 GKE 收到以下错误:
Error from server (Forbidden): error when creating "template.yml": clusterroles.rbac.authorization.k8s.io "kubeip-sa" is forbidden: attempt to grant extra privileges: [{[get] [] [nodes] [] []} {[list] [] [nodes] [] []} {[watch] [] [nodes] [] []} {[patch] [] [nodes] [] []} {[get] [] [pods] [] []} {[list] [] [pods] [] []} {[watch] [] [pods] [] []}] user=&{108986779198363313539 [system:authenticated] map[user-assertion.cloud.google.com:[AKUJVpldMDXqrDZ2slnJReDbLytxt6P2EEyEBbLNRB90oOATH4vIURo/lIhaBuAj9nnwwyxJDSxj2OdCyjjgBC/s5QxftIJnr8128ToTglCzk+e8Wybt4heIizRHugWnIhKNqkF+B0yiv0pIxgOfakma+SbkzbQbVzJPtgxsmHmak30YfPA58n/xyJ8R7oNVJ5dFUAWDFNsqHf/auolViw0Zd7Cr4aYYDXX4GScw==]]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews selfsubjectrulesreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /openapi /openapi/* /swagger-2.0.0.pb-v1 /swagger.json /swaggerapi /swaggerapi/* /version /version/]}] ruleResolutionErrors=[]
我已经通过发布
创建了合适的 ~/.kube/config
gcloud container clusters get-credentials <cluster> \
--zone <zone> \
--project <project>
我正在使用的 gcloud 服务帐户已在相关 GKE 集群中被授予 cluster-admin
kubectl create clusterrolebinding cluster-admin-binding \
--clusterrole cluster-admin \
--user $(gcloud config get-value account)
我可以验证我的服务帐户用户应该具有集群管理员角色检查我当前的 gcloud 用户并检查 GKE ClusterRoleBinding
$ gcloud config get-value account
terraform@<project>.iam.gserviceaccount.com
$ kubectl describe clusterrolebinding cluster-admin-binding
Name: cluster-admin-binding
Labels: <none>
Annotations: <none>
Role:
Kind: ClusterRole
Name: cluster-admin
Subjects:
Kind Name Namespace
---- ---- ---------
User terraform@<project>.iam.gserviceaccount.com
根据 kubectl,我应该 能够创建 ClusterRoleBindings
$ kubectl auth can-i create clusterrolebinding
yes
有人看到我缺少的 GKE RBAC 元素了吗?
这个问题“Creating a ClusterRole as the default compute service account fails with extra privileges error”的答案引导我找到了解决方案。
如果您将 ClusterRoleBinding 映射到服务帐户 ID 而不是电子邮件,一切都会按预期进行。
kubectl create clusterrolebinding cluster-admin-binding \
--clusterrole cluster-admin \
--user $(gcloud iam service-accounts describe <service account email> --format="value(uniqueId)")
我在尝试将 KubeIP 部署到 GKE 时看到 RBAC 失败。
我已将问题归结为 KubeIP infrastructure 的以下部分:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: kubeip-sa
namespace: kube-system
rules:
- apiGroups: [""]
resources: ["nodes"]
verbs: ["get","list","watch","patch"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["get","list","watch"]
我从 kubectl
和 GKE 收到以下错误:
Error from server (Forbidden): error when creating "template.yml": clusterroles.rbac.authorization.k8s.io "kubeip-sa" is forbidden: attempt to grant extra privileges: [{[get] [] [nodes] [] []} {[list] [] [nodes] [] []} {[watch] [] [nodes] [] []} {[patch] [] [nodes] [] []} {[get] [] [pods] [] []} {[list] [] [pods] [] []} {[watch] [] [pods] [] []}] user=&{108986779198363313539 [system:authenticated] map[user-assertion.cloud.google.com:[AKUJVpldMDXqrDZ2slnJReDbLytxt6P2EEyEBbLNRB90oOATH4vIURo/lIhaBuAj9nnwwyxJDSxj2OdCyjjgBC/s5QxftIJnr8128ToTglCzk+e8Wybt4heIizRHugWnIhKNqkF+B0yiv0pIxgOfakma+SbkzbQbVzJPtgxsmHmak30YfPA58n/xyJ8R7oNVJ5dFUAWDFNsqHf/auolViw0Zd7Cr4aYYDXX4GScw==]]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews selfsubjectrulesreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /openapi /openapi/* /swagger-2.0.0.pb-v1 /swagger.json /swaggerapi /swaggerapi/* /version /version/]}] ruleResolutionErrors=[]
我已经通过发布
创建了合适的 ~/.kube/configgcloud container clusters get-credentials <cluster> \
--zone <zone> \
--project <project>
我正在使用的 gcloud 服务帐户已在相关 GKE 集群中被授予 cluster-admin
kubectl create clusterrolebinding cluster-admin-binding \
--clusterrole cluster-admin \
--user $(gcloud config get-value account)
我可以验证我的服务帐户用户应该具有集群管理员角色检查我当前的 gcloud 用户并检查 GKE ClusterRoleBinding
$ gcloud config get-value account
terraform@<project>.iam.gserviceaccount.com
$ kubectl describe clusterrolebinding cluster-admin-binding
Name: cluster-admin-binding
Labels: <none>
Annotations: <none>
Role:
Kind: ClusterRole
Name: cluster-admin
Subjects:
Kind Name Namespace
---- ---- ---------
User terraform@<project>.iam.gserviceaccount.com
根据 kubectl,我应该 能够创建 ClusterRoleBindings
$ kubectl auth can-i create clusterrolebinding
yes
有人看到我缺少的 GKE RBAC 元素了吗?
这个问题“Creating a ClusterRole as the default compute service account fails with extra privileges error”的答案引导我找到了解决方案。
如果您将 ClusterRoleBinding 映射到服务帐户 ID 而不是电子邮件,一切都会按预期进行。
kubectl create clusterrolebinding cluster-admin-binding \
--clusterrole cluster-admin \
--user $(gcloud iam service-accounts describe <service account email> --format="value(uniqueId)")