Kubernetes system:serviceaccount:默认拒绝访问

Question

那么，有没有人确切地知道我需要在我的持久化yaml中放什么，以便在我尝试通过REST API列出东西时不会被拒绝访问我的ServiceAccount : curl https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_PORT_443_TCP_PORT/api/v1/namespaces/default/persistentvolumeclaims -X GET -k -H "Authorization: Bearer $(cat User "system:serviceaccount:default:my-service-service-account“cannot list persistentvolumeclaims in the ServiceAccount ServiceAccount”)。

我的基于角色的serviceAccount在YAML中的设置如下：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Values.service.name }}-service-account
  labels:
    app: {{ .Values.service.name }}
automountServiceAccountToken: true
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: default
  name: {{ .Values.service.name }}-role
  labels:
    app: {{ .Values.service.name }}
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list","delete"]
- apiGroups: [""] # "" indicates the core API group
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "watch", "list","delete"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: {{ .Values.service.name }}-role-binding
  labels:
    app: {{ .Values.service.name }}
subjects:
  - kind: ServiceAccount
    # Reference to upper's `metadata.name`
    name: {{ .Values.service.name }}-service-account
    # Reference to upper's `metadata.namespace`
    namespace: default
roleRef:
  kind: Role
  name: {{ .Values.service.name }}-role
  apiGroup: rbac.authorization.k8s.io

Answer 1

您所显示的角色仅允许对默认命名空间中的pod具有get/list/watch/delete权限

如果要列出持久性卷声明的权限，则还需要在角色中包括谓词和资源