kubernetes - 具有受限命名空间访问权限的 Spinnaker

Question

我正在尝试使用 kubernetes 设置大三角帆并收到错误:用户无法列出命名空间。

我无权访问集群范围内的列表命名空间。是否可以在不访问集群范围内的列表命名空间的情况下设置和应用 hal 配置？如果是，请告诉我步骤。

下面我提一下命令供引用:

hal deploy apply
+ Get current deployment
  Success
- Prep deployment
  Failure
Problems in default.provider.kubernetes.my-k8s-account:
! ERROR Unable to communicate with your Kubernetes cluster: Failure
  executing: GET at: https://<company>/api/v1/namespaces. Message:
  Forbidden! User apc doesn't have permission. namespaces is forbidden: User
  "system:anonymous" cannot list namespaces at the cluster scope..
? Unable to authenticate with your Kubernetes cluster. Try using
  kubectl to verify your credentials.

- Failed to prep Spinnaker deployment

$ kubectl get ns
No resources found.
Error from server (Forbidden): namespaces is forbidden: User "ds:uid:2319639648" cannot list namespaces at the cluster scope

问候，
阿贾兹

Answer 1

简短的回答:没有。

您可以尝试让您的管理员授予您访问 ClusterRole 的权限+ RoleBinding有权访问命名空间读取。

像这样的东西:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: namespace-reader
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "watch", "list"]

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-all-namespaces
subjects:
- kind: User
  name: your-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: namespace-reader
  apiGroup: rbac.authorization.k8s.io