kubernetes ServiceAccount角色验证失败

Question

问题：

在默认名称空间中创建服务帐户名称dev-sa，dev-sa可以在dev命名空间中创建以下组件：

部署StatefulSet DaemonSet

结果：

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: dev-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: dev
  name: sa-role
rules:
- apiGroups: [""]
  resources: ["deployment","statefulset","daemonset"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sa-rolebinding
  namespace: dev
subjects:
- kind: ServiceAccount
  name: dev-sa
  namespace: default
roleRef:
  kind: Role
  name: sa-role
  apiGroup: rbac.authorization.k8s.io

审定：

kubectl auth can-i create deployment -n dev \
--as=system:serviceaccount:default:dev-sa
no

这是个试题，但我不能及格

你能告诉我哪里出错了吗？thx

Answer 1

首先，apiGroups of Deployment，daemonSet和statefulSet是apps，而不是core。因此，对于apiGroup的值，而不是""，放置"apps"。(表示core的空字符串)

第二，记住：resources总是在复数中定义"kind“。因此，对于resources值，您应该始终使用复数名称。例如，您不用deployment，而是使用deployments

所以，您的文件应该是这样的：

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: dev-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: dev
  name: sa-role
rules:
- apiGroups: ["apps"]
  resources: ["deployments","statefulsets","daemonsets"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sa-rolebinding
  namespace: dev
subjects:
- kind: ServiceAccount
  name: dev-sa
  namespace: default
roleRef:
  kind: Role
  name: sa-role
  apiGroup: rbac.authorization.k8s.io

对于apiGroups的值，一定要检查医生们。

我建议您在Kubernetes中阅读关于用户和权限的这篇文章。

Answer 2

在角色中，在api组上使用*，并在资源名上添加s。

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: dev-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: dev
  name: sa-role
rules:
- apiGroups: ["*"]
  resources: ["deployments", "statefulsets", "daemonsets"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sa-rolebinding
  namespace: dev
subjects:
- kind: ServiceAccount
  name: dev-sa
  namespace: default
roleRef:
  kind: Role
  name: sa-role
  apiGroup: rbac.authorization.k8s.io