kubernetes - 创建集群范围的服务帐户以连接 gitlab

Question

我有一个自托管的 gitlab，我想部署应用程序。我正在尝试部署一个运行者，以便 gitlab 可以连接到 kubernetes 集群。我的 kubernetes 集群启用了 RBAC。

这是我为运行者准备的 gitlab-ci.yml:

services:
  - docker:18-dind
    
stages:
  - deploy
      
deploy:
  image:
    name: thorstenhans/helm3:latest
    entrypoint: ["/bin/sh", "-c"]
  stage: deploy
  environment:
    name: staging
    kubernetes:
      namespace: runners
  script:
    - echo ${CI_JOB_NAME}
    - helm version
    - kubectl version
    - helm repo add gitlab https://charts.gitlab.io/
    - helm install gitlab/gitlab-runner --version 0.20.0 -f values.yml

这是 values.yml 文件:

## The GitLab Server URL (with protocol) that want to register the runner against
## ref: https://docs.gitlab.com/runner/commands/README.html#gitlab-runner-register
##
gitlabUrl: https://gitlab.mydomain.com/
    
## The registration token for adding new Runners to the GitLab server. This must
## be retrieved from your GitLab instance.
## ref: https://docs.gitlab.com/ee/ci/runners/
##
runnerRegistrationToken: "registration code here"
    
## Set the certsSecretName in order to pass custom certificates for GitLab Runner to use
## Provide resource name for a Kubernetes Secret Object in the same namespace,
## this is used to populate the /etc/gitlab-runner/certs directory
## ref: https://docs.gitlab.com/runner/configuration/tls-self-signed.html#supported-options-for-self-signed-certificates
##
#certsSecretName:
    
## Configure the maximum number of concurrent jobs
## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section
##
concurrent: 10
    
## Defines in seconds how often to check GitLab for a new builds
## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section
##
checkInterval: 30
    
## For RBAC support:
rbac:
  create: false
    
  ## Run the gitlab-bastion container with the ability to deploy/manage containers of jobs
  ## cluster-wide or only within namespace
  clusterWideAccess: true
    
  ## If RBAC is disabled in this Helm chart, use the following Kubernetes Service Account name.
  ##
  # serviceAccountName: default
    
## Configuration for the Pods that the runner launches for each new job
##
runners:
  ## Default container image to use for builds when none is specified
  ##
  image: ubuntu:18.04
    
  ## Run all containers with the privileged flag enabled
  ## This will allow the docker:stable-dind image to run if you need to run Docker
  ## commands. Please read the docs before turning this on:
  ## ref: https://docs.gitlab.com/runner/executors/kubernetes.html#using-docker-dind
  ##
  privileged: false
    
  ## Namespace to run Kubernetes jobs in (defaults to 'default')
  ##
  # namespace:
    
  ## Build Container specific configuration
  ##
  builds:
    # cpuLimit: 200m
    # memoryLimit: 256Mi
    cpuRequests: 100m
    memoryRequests: 128Mi
    
  ## Service Container specific configuration
  ##
  services:
    # cpuLimit: 200m
    # memoryLimit: 256Mi
    cpuRequests: 100m
    memoryRequests: 128Mi
    
  ## Helper Container specific configuration
  ##
  helpers:
    # cpuLimit: 200m
    # memoryLimit: 256Mi
    cpuRequests: 100m
    memoryRequests: 128Mi

如何为 gitlab 创建服务帐户，以便它可以在集群范围内部署应用程序？

Answer 1

您可以在 gitlab documentation 中找到此信息.

Enabling RBAC support

If your cluster has RBAC enabled, you can choose to either have the chart create its own service account or provide one on your own.

To have the chart create the service account for you, set rbac.create to true:

rbac:
  create: true

To use an already existing service account, use:

rbac:
  create: false
  serviceAccountName: your-service-account

---

因此您必须将 values.yaml 更改为

rbac:
  create: false
  clusterWideAccess: true
  serviceAccountName: your-service-account

---

关于rbac和service accounts有相关文档。

• https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions
• https://unofficial-kubernetes.readthedocs.io/en/latest/admin/authorization/rbac/
• https://www.magalix.com/blog/kubernetes-authorization

还有另一个 stackoverflow 帖子和一个 gitlab 问题应该有助于为您的用例创建服务帐户。

• https://gitlab.com/gitlab-org/gitlab-runner/-/issues/3841
• how can I create a service account for all namespaces in a kubernetes cluster?