kubernetes RBAC 角色动词执行到 pod

Question

我的 1.9 集群为 dev 用户创建了这个部署角色。部署按预期工作。现在我想为开发人员提供 exec 和 logs 访问权限。我需要为 exec 添加什么角色到 pod？

kind: Role
name: deployment-manager
  rules:
  - apiGroups: ["", "extensions", "apps"]
    resources: ["deployments", "replicasets", "pods"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

错误信息:

kubectl exec nginx -it -- sh  

Error from server (Forbidden): pods "nginx" is forbidden: User "dev" cannot create pods/exec in the namespace "dev"

谢谢
SR

Answer 1

RBAC docs say that

Most resources are represented by a string representation of their name, such as “pods”, just as it appears in the URL for the relevant API endpoint. However, some Kubernetes APIs involve a “subresource”, such as the logs for a pod. [...] To represent this in an RBAC role, use a slash to delimit the resource and subresource.

要允许一个主题同时读取 pod 和 pod 日志，并能够执行到 pod 中，您可以编写:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: pod-and-pod-logs-reader
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]

一些客户端库可能会先执行 http GET 来协商 websocket，这将需要“get”动词。 kubectl 改为发送一个 http POST，这就是为什么在这种情况下它需要“创建”动词。