pods 被禁止：用户“system:serviceaccount:kubernetes-dashboard:admin-user”无法列出命名空间“default”中 API 组“”中的资源“pods”

Question

我正在尝试按照这篇文章在 Ubuntu 18.04 上设置 Kubernetes 。

一切正常，但是当我尝试访问本地 Kubernetes 仪表板时，它显示为空，并且没有像 Pod、服务和部署那样可见。

但是，当我运行时，$> kubectl get pods,svc,deployments它会显示以下输出。如果命令行显示所有详细信息，为什么我看到空的 Kubernetes 仪表板？

我已经运行了以下命令

$> kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta8/aio/deploy/recommended.yaml

$> kubectl proxy

我在这里缺少任何配置吗？有什么建议可以解决这个问题吗？

$> kubectl get pods --all-namespaces
NAMESPACE              NAME                                         READY   STATUS    RESTARTS   AGE

kubernetes-dashboard   dashboard-metrics-scraper-76585494d8-4rrdp   1/1     Running   3          46h
kubernetes-dashboard   kubernetes-dashboard-5996555fd8-sxgxf        1/1     Running   16         46h

查看通知部分后，发现这些错误

1. 事件被禁止：用户“system:serviceaccount:kubernetes-dashboard:admin-user”无法列出命名空间“default”中API组“”中的资源“events”

2. pods 被禁止：用户“system:serviceaccount:kubernetes-dashboard:admin-user”无法列出命名空间“default”中 API 组“”中的资源“pods”

---

更新 1：

它在应用 RBAC kubectl apply -f filename.yml后现在工作

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system

Answer 1

您可能需要将仪表板服务帐户绑定到集群管理员角色：

kubectl create clusterrolebinding dashboard-admin-sa --clusterrole=cluster-admin --serviceaccount=default:dashboard-admin-sa

否则，仪表板服务帐户无权访问将填充仪表板的数据。

Answer 2

我是根据我使用 K8s v1.20 的 v2.1.0 的经验来回答这个问题的。安装 kubernetes-dashboard 时，它创建了一个服务帐户和两个名为“kubernetes-dashboard”的角色，并将角色与仪表板命名空间绑定，另一个与集群范围的角色（但不是集群管理员）绑定。因此，不幸的是，权限不足以管理整个集群，如下所示：

从安装登录：

$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.1.0/aio/deploy/recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

查看您看到的权限：

$ kubectl describe clusterrole kubernetes-dashboard
Name:         kubernetes-dashboard
Labels:       k8s-app=kubernetes-dashboard
Annotations:  <none>
PolicyRule:
Resources             Non-Resource URLs  Resource Names  Verbs
 ---------             -----------------  --------------  -----
nodes.metrics.k8s.io  []                 []              [get list watch]
pods.metrics.k8s.io   []                 []              [get list watch]

$ kubectl describe role kubernetes-dashboard -n kubernetes-dashboard
Name:         kubernetes-dashboard
Labels:       k8s-app=kubernetes-dashboard
Annotations:  <none>
PolicyRule:
Resources       Non-Resource URLs  Resource Names                     Verbs
---------       -----------------  --------------                     -----
secrets         []                 [kubernetes-dashboard-certs]       [get update delete]
secrets         []                 [kubernetes-dashboard-csrf]        [get update delete]
secrets         []                 [kubernetes-dashboard-key-holder]  [get update delete]
configmaps      []                 [kubernetes-dashboard-settings]    [get update]
services/proxy  []                 [dashboard-metrics-scraper]        [get]
services/proxy  []                 [heapster]                         [get]
services/proxy  []                 [http:dashboard-metrics-scraper]   [get]
services/proxy  []                 [http:heapster:]                   [get]
services/proxy  []                 [https:heapster:]                  [get]
services        []                 [dashboard-metrics-scraper]        [proxy]
services        []                 [heapster]                         [proxy]

与其将 kubernetes-dashboard 服务帐户设置为集群管理员，因为该帐户用于数据收集，更好的方法是创建一个只有 Token 的新服务帐户，这样可以轻松撤销该帐户而不是权限更改为预先创建的帐户。

要创建一个名为“dashboard-admin”的新服务帐户并以声明方式应用：

$ nano dashboard-svcacct.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
name: dashboard-admin
namespace: kubernetes-dashboard

$ kubectl apply -f dashboard-svcacct.yaml
serviceaccount/dashboard-admin created

将该新服务帐户绑定到集群管理员角色：

$ nano dashboard-binding.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: dashboard-admin
  namespace: kubernetes-dashboard

$ kubectl apply -f dashboard-binding.yaml
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created

要从此服务帐户中提取可用于登录的令牌：

$ kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep dashboard-admin | awk '{print $1}')
Name:         dashboard-admin-token-4fxtt
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 9cd5bb80-7901-413b-9eac-7b72c353d4b9

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1066 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6Ikp3ZERpQTFPOV<REDACTED>

现在可以使用以“eyJ”开头的整个令牌登录：

但是，对令牌登录进行剪切和粘贴可能会在后面变得很痛苦，尤其是在默认超时的情况下。我更喜欢配置文件。对于此选项，将需要集群 CA 哈希。这个配置文件的集群部分和~/.kube/config下的配置文件是一样的。这个配置文件不需要加载到 kubernetes master，只需要在工作站上使用它来访问仪表板。我将它命名为 dashboard-config 并使用 VS Code 创建它（任何编辑器，只需要确保打开文本以确保哈希值中没有空格）。无需在用户下保留任何管理 CA 和私钥哈希：如果复制配置文件。

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <CLUSTER CA HASH HERE>
    server: https://<IP ADDR OF CLUSTER>:6443
  name: kubernetes #name of cluster
contexts:
- context:
   cluster: kubernetes
   user: dashboard-admin
  name: dashboard-admin@kubernetes
current-context: dashboard-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-dashboard
  user:
    token: <TOKEN HASH from above command e.g. eyJ>

它现在有效。