无法更新锁：configmaps 禁止：用户“system:serviceaccount:ingress

Question

出现以下错误：-

Failed to update lock: configmaps "ingress-controller-leader-internal-nginx-internal" is forbidden: User "system:serviceaccount:ingress-nginx-internal:ingress-nginx-internal" cannot update resource "configmaps" in API group "" in the namespace "ingress-nginx-internal"

我在我的设置中使用多个入口控制器和两个不同的命名空间。入口-Nginx-内部 入口-Nginx-外部

安装后一切正常，直到 15 小时，出现上述错误。

Ingress-nginx-internal.yaml

https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-0.32.0/deploy/static/provider/aws/deploy.yaml

在上面的deploy.YAML中，我替换了。sed's/ingress-Nginx/ingress-Nginx-internal/g'deploy.yaml

以下命令的输出：-

# kubectl describe cm ingress-controller-leader-internal-nginx-internal -n ingress-nginx-internal
Name:         ingress-controller-leader-internal-nginx-internal
Namespace:    ingress-nginx-internal
Labels:       <none>
Annotations:  control-plane.alpha.kubernetes.io/leader:
                {"holderIdentity":"ingress-nginx-internal-controller-657","leaseDurationSeconds":30,"acquireTime":"2020-07-24T06:06:27Z","ren...

Data
====
Events:  <none>

服务：-

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    helm.sh/chart: ingress-nginx-internal-2.0.3
    app.kubernetes.io/name: ingress-nginx-internal
    app.kubernetes.io/instance: ingress-nginx-internal
    app.kubernetes.io/version: 0.32.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-internal
  namespace: ingress-nginx-internal

Answer 1

从这里的文档

要运行多个 NGINX 入口控制器（例如，一个服务于公共流量，一个服务于“内部”流量），--ingress-class必须将该选项更改为复制控制器定义内的集群唯一的值。这是一个部分示例：

spec:
  template:
     spec:
       containers:
         - name: nginx-ingress-internal-controller
           args:
             - /nginx-ingress-controller
             - '--election-id=ingress-controller-leader-internal'
             - '--ingress-class=nginx-internal'
             - '--configmap=ingress/nginx-ingress-internal-controller'

当您为内部创建入口资源时，您需要指定上面指定的入口类，即nginx-internal

使用以下命令检查服务帐户的权限。它返回no然后创建角色和角色绑定。

kubectl auth can-i update configmaps --as=system:serviceaccount:ingress-nginx-internal:ingress-nginx-internal -n ingress-nginx-internal

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cm-role
  namespace: ingress-nginx-internal
rules:
- apiGroups:
  - ""
  resources:
  - configmap
  verbs:
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cm-rolebinding
  namespace: ingress-nginx-internal
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cm-role
subjects:
- kind: ServiceAccount
  name: ingress-nginx-internal
  namespace: ingress-nginx-internal