创建 ServiceAccounts 以访问 Kubernetes 部署答案

【问题标题】：Create ServiceAccounts for access to the Kubernetes Deployments创建 ServiceAccounts 以访问 Kubernetes 部署
【发布时间】：2018-09-04 06:23:57
【问题描述】：

我想通过 api server 访问 kubernetes 部署对象。

我有一个如下所示的服务帐户文件。

apiVersion: v1
kind: ServiceAccount
metadata:
  name: name
  namespace: namespace

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: name
  namespace: namespace
rules:
- apiGroups: [""]
  resources: ["deployment"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["deployment/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["deployment/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: name
  namespace: namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: name
subjects:
- kind: ServiceAccount
  name: name

我在访问端点时收到 403 Forbidden 错误，此服务帐户所有者的令牌

/apis/apps/v1beta1/namespaces/namespace/deployments

【问题讨论】：

标签： kubernetes rbac

【解决方案1】：

您的所有角色规则都适用于核心（空）API group。但是，您尝试访问的 URL /apis/apps/v1beta1 位于“应用程序”API 组中（/apis 之后的路径部分）。因此，要访问该特定 API 路径，您需要将角色定义更改为

rules:
- apiGroups: ["apps"]
  resources: ["deployment"]
  verbs: ["create","delete","get","list","patch","update","watch"]
# and also the other deployment subpaths

【讨论】：