只读 kubernetes 用户

Question

我正在尝试创建一个只读用户。我希望用户能够列出节点和 pod 并查看仪表板。我创建了证书并且可以连接，但出现以下错误。

$ kubectl --context minikube-ro get pods --all-namespaces
Error from server (Forbidden): pods is forbidden: User "erst-operation" cannot list pods at the cluster scope

我的集群角色...

$ cat helm/namespace-core/templates/pod-reader-cluster-role.yaml 
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: '*'
  name: pod-reader
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

我的集群角色绑定...

$ cat helm/namespace-core/templates/pod-reader-role-binding.yaml 
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
  - kind: User
    name: erst-operation
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

我知道上面的内容不应授予查看仪表板的权限，但如何让它仅列出 pod？

Answer 1

您的集群角色应包含核心组，因为资源pods在核心组中。

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: '*'
  name: pod-reader
rules:
- apiGroups: ["extensions", "apps", ""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]