kubernetes - 新用户禁止命名空间错误

Question

我添加了一个名为“hello”的新用户，以使用客户端证书数据和客户端 key 数据来创建集群。当我切换到它的上下文并按下命令时:

kubectl get ns development-hello

我得到:

来自服务器的错误(禁止):命名空间“development-hello”被禁止:用户“hello”无法在命名空间“development-hello”中的 API 组“”中获取资源“namespaces”

我没有这个用户的 clusterrolebinding。

这是 kubectl 配置 View 的快照

apiVersion: v1   
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://127.0.0.1:33445
  name: kind-kind
contexts:
- context:
    cluster: kind-kind
    user: hello
  name: hello-kind-kind
- context:
    cluster: kind-kind
    user: kind-kind
  name: kind-kind
current-context: hello-kind-kind
kind: Config
preferences: {}
users:
- name: hello
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: kind-kind
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

Answer 1

需要使用 admin 帐户为 hello 用户创建 ClusterRole 和 RoleBinding。

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ns-role
rules:
- apiGroups: [""]
  resources: ["namespace"]
  verbs: ["get", "watch", "list", "create", "delete"]    
---    
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ns-rolebinding
  namespace: development-hello
subjects:
- kind: User
  name: hello
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: ns-role
  apiGroup: rbac.authorization.k8s.io

可以使用以下命令检索具有管理员帐户的 kubeconfig 文件

docker exec -it <kind-control-plane-node-name>

sudo cat /etc/kubernetes/admin.conf