更新lock失败:配置映射禁止:用户"system:serviceaccount:ingress

Question

获取以下错误：-

Failed to update lock: configmaps "ingress-controller-leader-internal-nginx-internal" is forbidden: User "system:serviceaccount:ingress-nginx-internal:ingress-nginx-internal" cannot update resource "configmaps" in API group "" in the namespace "ingress-nginx-internal"

我在我的设置中使用了多个入口控制器和两个不同的名称空间。入口-Nginx-内部入口-Nginx-外部

安装后，所有工作正常，直到15小时，得到上述错误。

Ingress-nginx-internal.yaml

https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-0.32.0/deploy/static/provider/aws/deploy.yaml

在上面的deploy.YAML中，我替换。sed /入口-Nginx/入口-Nginx-internal/g‘deploy.yaml

以下命令的输出：-

# kubectl describe cm ingress-controller-leader-internal-nginx-internal -n ingress-nginx-internal
Name:         ingress-controller-leader-internal-nginx-internal
Namespace:    ingress-nginx-internal
Labels:       <none>
Annotations:  control-plane.alpha.kubernetes.io/leader:
                {"holderIdentity":"ingress-nginx-internal-controller-657","leaseDurationSeconds":30,"acquireTime":"2020-07-24T06:06:27Z","ren...

Data
====
Events:  <none>

服务：

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    helm.sh/chart: ingress-nginx-internal-2.0.3
    app.kubernetes.io/name: ingress-nginx-internal
    app.kubernetes.io/instance: ingress-nginx-internal
    app.kubernetes.io/version: 0.32.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-internal
  namespace: ingress-nginx-internal

Answer 1

从docs here

为了运行多个NGINX入口控制器(例如，一个服务于公共业务的入口控制器，一个服务于“内部”业务的入口控制器)，必须将选项--ingress-class改变为在复制控制器的定义内对于集群唯一的值。以下是部分示例：

spec:
  template:
     spec:
       containers:
         - name: nginx-ingress-internal-controller
           args:
             - /nginx-ingress-controller
             - '--election-id=ingress-controller-leader-internal'
             - '--ingress-class=nginx-internal'
             - '--configmap=ingress/nginx-ingress-internal-controller'

在为internal创建入口资源时，需要指定上面指定的入口类，即nginx-internal

使用以下命令检查服务帐号的权限。如果返回no，则创建角色和角色绑定。

kubectl auth can-i update configmaps --as=system:serviceaccount:ingress-nginx-internal:ingress-nginx-internal -n ingress-nginx-internal

基于角色的访问控制

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cm-role
  namespace: ingress-nginx-internal
rules:
- apiGroups:
  - ""
  resources:
  - configmap
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cm-rolebinding
  namespace: ingress-nginx-internal
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cm-role
subjects:
- kind: ServiceAccount
  name: ingress-nginx-internal
  namespace: ingress-nginx-internal

Answer 2

如果您使用多入口，请记住在Role中更改资源名称。