K8S - RoleBinding - 无法从服务帐户 cert-manager-webhook-ovh 访问机密答案

【问题标题】：K8S - RoleBinding - Unable to access secrets from service account cert-manager-webhook-ovhK8S - RoleBinding - 无法从服务帐户 cert-manager-webhook-ovh 访问机密
【发布时间】：2021-07-14 08:24:55
【问题描述】：

我想使用 cert-manager OVH's webhook 来提供 https 通配符证书，但我仍然无法弄清楚为什么 cert-manager 无法访问 OVH 凭据密钥（在 OVH 中创建 DNS 条目所必需的）

ovh-credentials 秘密已在 default 命名空间上创建

证书管理器位于 cert-manager 命名空间中，cert-manager-webhook-ovh 位于 default 命名空间中

我有一个ClusterIssuer，它正在调用cert-manager-webhook-ovh

我已经定义了一个cert-manager-webhook-ovh:secret-reader ClusterRole

以及cert-manager-webhook-ovh 服务帐户和ClusterRole 之间的绑定

cert-manager-webhook-ovh:secret-readerClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-webhook-ovh:secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["ovh-credentials"]
  verbs: ["get", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-webhook-ovh:secret-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-webhook-ovh:secret-reader
subjects:
- apiGroup: ""
  kind: ServiceAccount
  name: cert-manager-webhook-ovh
  namespace: cert-manager

这是我的豆荚

➜  alaya-studio git:(main) ✗ kubectl get pods --namespace=cert-manager
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-6588898cb4-nfn7p              1/1     Running   1          27d
cert-manager-cainjector-7bcbdbd99f-tgllj   1/1     Running   5          27d
cert-manager-webhook-5fd9f9dd86-csjzq      1/1     Running   0          27d
➜  alaya-studio git:(main) ✗ kubectl get pods
NAME                                                  READY   STATUS    RESTARTS   AGE
cert-manager-webhook-ovh-77f9c7cc7b-xfdfx             1/1     Running   4          15d
express-59df84c766-8wjxw                              1/1     Running   0          27d
express-59df84c766-l4cf8                              1/1     Running   0          27d
express-59df84c766-w6hbt                              1/1     Running   0          27d
ngingress-ingress-nginx-controller-5586599f89-5fsgn   1/1     Running   0          28d

创建挑战时出现此错误

  Type     Reason        Age              From          Message
  ----     ------        ----             ----          -------
  Normal   Started       9s               cert-manager  Challenge scheduled for processing
  Warning  PresentError  5s (x3 over 7s)  cert-manager  Error presenting challenge: secrets "ovh-credentials" is forbidden: User "system:serviceaccount:default:cert-manager-webhook-ovh" cannot get resource "secrets" in API group "" in the namespace "cert-manager"

【问题讨论】：

标签： kubernetes webhooks rbac kubernetes-secrets cert-manager

【解决方案1】：

向default 命名空间的ServiceAccount cert-manager-webhook-ovh 指示的错误消息。您已授予 cert-manager 命名空间的 ServiceAccount 权限。

secrets "ovh-credentials" is forbidden: User "system:serviceaccount:default:cert-manager-webhook-ovh" cannot get resource "secrets" in API group "" in the namespace "cert-manager"

【讨论】：

感谢您的帮助，所以我已将 ServiceAccount CusterRoleBinding 中的名称空间更改为 default cert-manager-webhook-ovh 但现在错误已更改为：Warning PresentError 5s ( x4 over 30s) cert-manager 提出挑战时出错：找不到秘密“ovh-credentials”
你能确保秘密存在吗？可能 cert-manager 日志会有所帮助。
好吧，我只是将 ovh-credentials 密码移动到命名空间 cert-manager 并将命名空间 cert-manager 放入角色绑定中。我仍然有一个错误，但我继续前进，我会检查我的信用：**Warning PresentError 3s (x3 over 5s) cert-manager Error presenting challenge: OVH API call failed: GET /domain/zone/alaya.studio/status -错误 403：“此凭据无效”** 所以我想这与我的凭据有关，并认为问题已解决。谢谢