Serviceaccount无法创建持久的PVC(PVC)。

Question

我们正在测试闪亮的代理Kubernetes容器，每个应用程序都旋转自己的容器，直到这个部分才能正常工作。我们已经做了一些更改，以创建一个PVC/PV来为每个容器持久化用户特定的数据，注意serviceaccount无法创建PVC，尽管我为这个帐户配置了以下角色。一般来说，是否还有其他步骤来确保SA能够访问/创建PVC？

在从普通容器进行测试时，可以访问PV/PVC，但用于创建新容器的服务帐户角色/权限似乎是一个问题。

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: sp-ns
  name: sp-sa
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "persistentvolumeclaims"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

我已经证实了serviceaccount角色是正确设置的，因为下面的命令返回'yes‘。

kubectl auth can-i create pvc --as=system:serviceaccount:sp-ns:sp-sa -n sp-ns

从应用程序创建容器时出错：

at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
    Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: http://localhost:8001/api/v1/namespaces/sp-ns/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods "sp-pod-92e1efc0-0859-4a87-8b9b-04d6adaa11f5" is forbidden: user "system:serviceaccount:sp-ns:sp-sa" is not an admin and does not have permissions to use host bind mounts for resource .
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:503)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:440)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:406)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:365)
    at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleCreate(OperationSupport.java:234)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleCreate(BaseOperation.java:735)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.create(BaseOperation.java:325)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.create(BaseOperation.java:321)
    at io.fabric8.kubernetes.client.dsl.base.BaseOperation.lambda$createNew$0(BaseOperation.java:336)
    at io.fabric8.kubernetes.api.model.DoneablePod.done(DoneablePod.java:26)
    at eu.openanalytics.containerproxy.backend.kubernetes.KubernetesBackend.startContainer(KubernetesBackend.java:223)
    at eu.openanalytics.containerproxy.backend.AbstractContainerBackend.doStartProxy(AbstractContainerBackend.java:129)
    at eu.openanalytics.containerproxy.backend.AbstractContainerBackend.startProxy(AbstractContainerBackend.java:110)
    ... 95 more

Answer 1

1. 容器没有以特权的形式运行。在吊舱规范中使用privileged: true .

1. 服务帐户不具有cluster-admin角色。使用下面提供许可。

kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=sp-ns:sp-sa