创建“install/kubernetes/istio beta.yaml”时出错

Question

我试图在我的环境中部署Istio，并遇到以下错误。所有的在线解决方案都是关于集群绑定的，我试过这样做，但还是失败了。对我的问题有什么意见吗？

kubectl api-版本\ grep rbac

rbac.authorization.k8s.io/v1alpha1
rbac.authorization.k8s.io/v1beta1

应用install/kubernetes/istio-rbac-beta.yaml sudo kubectl

rolebinding "istio-pilot-admin-role-binding" configured
rolebinding "istio-ca-role-binding" configured
rolebinding "istio-ingress-admin-role-binding" configured
rolebinding "istio-sidecar-role-binding" configured

Error from server (Forbidden): 
error when creating"install/kubernetes/istio-rbac-beta.yaml": 
clusterroles.rbac.authorization.k8s.io "istio-pilot" is forbidden:
attempt to grant extra privileges: [{[*] [istio.io] [istioconfigs] [] 
[]} {[*] [istio.io] [istioconfigs.istio.io] [] []} {[*] [extensions] 
[thirdpartyresources] [] []} {[*] [extensions] 
[thirdpartyresources.extensions] [] []} {[*] [extensions] [ingresses] 
[] []} {[*] [] [configmaps] [] []} {[*] [] [endpoints] [] []} {[*] [] 
[pods] [] []} {[*] [] [services] [] []}] user=&{kubeconfig  
[system:authenticated] map[]} ownerrules=[] ruleResolutionErrors=[]

Error from server (Forbidden): error when creating 
"install/kubernetes/istio-rbac-beta.yaml": 
clusterroles.rbac.authorization.k8s.io "istio-ca" is forbidden: 
attempt to grant extra privileges: [{[create] [] [secrets] [] []} 
{[get] [] [secrets] [] []} {[watch] [] [secrets] [] []} {[list] [] 
[secrets] [] []} {[watch] [] [serviceaccounts] [] []} {[list] [] 
[serviceaccounts] [] []}] user=&{kubeconfig  [system:authenticated] 
map[]} ownerrules=[] ruleResolutionErrors=[]

Error from server (Forbidden): error when creating 
"install/kubernetes/istio-rbac-beta.yaml": 
clusterroles.rbac.authorization.k8s.io "istio-sidecar" is forbidden: 
attempt to grant extra privileges: [{[get] [istio.io] [istioconfigs] [] 
[]} {[watch] [istio.io] [istioconfigs] [] []} {[list] [istio.io] 
[istioconfigs] [] []} {[get] [extensions] [thirdpartyresources] [] []} 
{[watch] [extensions] [thirdpartyresources] [] []} {[list] [extensions] 
[thirdpartyresources] [] []} {[update] [extensions] 
[thirdpartyresources] [] []} {[get] [extensions] [ingresses] [] []} 
{[watch] [extensions] [ingresses] [] []} {[list] [extensions] 
[ingresses] [] []} {[update] [extensions] [ingresses] [] []} {[get] [] 
[configmaps] [] []} {[watch] [] [configmaps] [] []} {[list] [] 
[configmaps] [] []} {[get] [] [pods] [] []} {[watch] [] [pods] [] []} 
{[list] [] [pods] [] []} {[get] [] [endpoints] [] []} {[watch] [] 
[endpoints] [] []} {[list] [] [endpoints] [] []} {[get] [] [services] 
[] []} {[watch] [] [services] [] []} {[list] [] [services] [] []}] 
user=&{kubeconfig  [system:authenticated] map[]} ownerrules=[] 
ruleResolutionErrors=[]

Answer 1

Kubernetes给出的错误基本上意味着它认为您要做的任何事情都是权限提升(这是正确的)，并试图防止这种情况发生。

RBAC通过编辑角色或角色绑定防止用户升级权限。因为这是在API级别强制执行的，所以即使RBAC授权程序没有使用，它也适用。用户只有在已经拥有角色中包含的所有权限的情况下才能创建/更新角色，其作用域与角色的作用域相同( ClusterRole在集群范围内，在同一命名空间内或在集群范围内的角色)。例如，如果“用户-1”无法在集群范围内列出机密信息，则无法创建包含该权限的ClusterRole。(取自这里)

这样做的原因是，应用到用于访问集群的用户的ClusterRole (使用ClusterRoleBinding)实际上并不具有您试图授予应用程序的所有权限。要解决这个问题，您需要创建一个ClusterRoleBinding，它为用户提供了必要的权限。在您的例子中，将您绑定到集群管理角色是有意义的，它为您提供了无限的权限。

要做到这一点，您可以运行这样的操作：

kubectl create clusterrolebinding --clusterrole cluster-admin --user your-user

Answer 2

为了防止升级攻击，RBAC API将不允许您使用用户当前没有的权限创建角色(或者将角色绑定到包含您没有权限的角色)。

该消息告诉您，您要创建的角色在其中具有当前用户(username=kubeconfig)不具有的权限。

有关更多细节，请参见https://kubernetes.io/docs/admin/authorization/rbac/#privilege-escalation-prevention-and-bootstrapping