由于RBAC，无法在kubernetes集群上部署pachyderm

Question

我的目标是运行以下命令：

sudo pachctl deploy google ${BUCKET_NAME} ${STORAGE_SIZE} --dynamic-etcd-nodes=1

我面临一个关于我拥有的权限的错误(最后发布)。因此，我想通过以下命令创建我的角色：

sudo kubectl create clusterrolebinding aviralsrivastava-cluster-admin-binding --clusterrole=cluster-admin --user=aviral@socialcops.com

然而，上面的命令产生了一个错误：

Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "aviral@socialcops.com" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission.

Answer 1

您需要以cluster-admin的身份申请以下RBAC权限，为用户aviral@socialcops.com提供创建clusterRole和clusterRoleBinding的权限：

ClusterRole.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: prom-admin
rules:
# Just an example, feel free to change it
- apiGroups: [""]
  resources: ["clusterRole", "clusterRoleBinding"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]

ClusterRoleBinding.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: prom-rbac
subjects:
- kind: User
  name: aviral@socialcops.com
roleRef:
  kind: ClusterRole
  name: prom-admin
  apiGroup: rbac.authorization.k8s.io