ServiceAccount 无法在命名空间中列出资源 "pods"，尽管它具有适当资源的角色

Question

我的自定义命名空间中有以下定义：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: test
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/exec"]
    verbs: ["get", "list", "delete", "patch", "create"]
  - apiGroups: ["extensions", "apps"]
    resources: ["deployments", "deployments/scale"]
    verbs: ["get", "list", "delete", "patch", "create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test
subjects:
  - kind: User
    name: test-sa
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: test
  apiGroup: rbac.authorization.k8s.io

运行 describe role test

Name:         test
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"test","namespace":"test-namesapce...
PolicyRule:
  Resources                     Non-Resource URLs  Resource Names  Verbs
  ---------                     -----------------  --------------  -----
  pods/exec                     []                 []              [get list delete patch create]
  pods                          []                 []              [get list delete patch create]
  deployments.apps/scale        []                 []              [get list delete patch create]
  deployments.apps              []                 []              [get list delete patch create]
  deployments.extensions/scale  []                 []              [get list delete patch create]
  deployments.extensions        []                 []              [get list delete patch create]

当我在使用此服务帐户的 pod 中尝试运行命令 kubectl get pods 时，出现以下错误：

Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:test-namespace:test-sa" cannot list resource "pods" in API group "" in the namespace "test-namespace"

哪里配置错误了？

Answer 1

问题出在 RoleBinding 的 subjects 上。正确的定义是：

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test
subjects:
  - kind: ServiceAccount
    name: test-sa
roleRef:
  kind: Role
  name: test
  apiGroup: rbac.authorization.k8s.io

ServiceAccount 无法在命名空间中列出资源 "pods"，尽管它具有适当资源的角色

ServiceAccount cannot list resource "pods" in namespace though it has role with appropriate resources

rbac

kubernetes

kubectl