kubernetes - ClusterRoleBinding 需要命名空间

Question

我有以下内容:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: SomeServiceAccount

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: SomeClusterRole
rules:
  - apiGroups:
      - "myapi.com"
    resources:
      - 'myapi-resources'
    verbs:
      - '*'

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: SomeClusterRoleBinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: SomeClusterRole
subjects:
  - kind: ServiceAccount
    name: SomeServiceAccount

但它抛出: The ClusterRoleBinding "SomeClusterRoleBinding" is invalid: subjects[0].namespace: Required value
我认为 "Cluster"RoleBinding 的全部要点是它不限于单个命名空间。任何人都可以解释这个吗？

Kubernetes 版本 1.13.12Kubectl 版本 v1.16.2谢谢。

Answer 1

创建 ServiceAccount 时不需要设置命名空间，这里的情况是在创建 ClusterRoleBinding 以选择它时引用它时需要指定服务帐户的命名空间。

ServiceAccounts are namespace scoped subjects, so when you refer to them, you have to specify the namespace of the service account you want to bind. Source

例如，在您的情况下，您可以在创建 ClusterRoleBinding 时使用默认命名空间。

通过这样做，您不会将 ClusterRoleBinding 绑定(bind)到任何命名空间，如您在此示例中所见。

$ kubectl get clusterrolebinding.rbac.authorization.k8s.io/tiller -o yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"tiller"},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"cluster-admin"},"subjects":[{"kind":"ServiceAccount","name":"tiller","namespace":"kube-system"}]}
  creationTimestamp: "2019-11-18T13:47:59Z"
  name: tiller
  resourceVersion: "66715"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/tiller
  uid: 085ed826-0a0a-11ea-a665-42010a8000f7
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: tiller
  namespace: kube-system