kubernetes - Kubernetes RunAsUser 被禁止

Question

当我尝试使用非 root fsgroup(此处为 2000)创建 pod 时

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: gcr.io/google-samples/node-hello:1.0
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: true

点击错误

Error from server (Forbidden): error when creating "test.yml": pods "security-context-demo" is forbidden: pod.Spec.SecurityContext.RunAsUser is forbidden

版本

root@ubuntuguest:~# kubectl  version
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.2", GitCommit:"81753b10df112992bf51bbc2c2f85208aad78335", GitTreeState:"clean", BuildDate:"2018-04-27T09:22:21Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.2", GitCommit:"81753b10df112992bf51bbc2c2f85208aad78335", GitTreeState:"clean", BuildDate:"2018-04-27T09:10:24Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}

任何人都可以帮助我如何在集群中设置 ClusterRoleBinding。

Answer 1

如果问题确实是因为 RBAC 权限，那么您可以尝试创建一个集群角色为 explained here 的 ClusterRoleBinding .

创建 pod 时，您必须在 kubectl 客户端中使用该 token 和配置，而不是该帖子中的最后一步(使用身份验证 token 登录仪表板)。

有关使用上下文、集群和用户的更多信息 visit here