Kubernetes 仪表板错误消息：configmaps 被禁止：用户“system:serviceaccount:kube-system:deployment-controller”无法列出资源

Question

Kubernetes 仪表板输出一堆错误消息。

你应该忽略他们吗？如果没有，你如何解决它们？

warning
configmaps is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "configmaps" in API group "" in the namespace "default"

warning
persistentvolumeclaims is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "persistentvolumeclaims" in API group "" in the namespace "default"

warning
secrets is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "secrets" in API group "" in the namespace "default"

warning
services is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "services" in API group "" in the namespace "default"

warning
ingresses.extensions is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "ingresses" in API group "extensions" in the namespace "default"

warning
daemonsets.apps is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "daemonsets" in API group "apps" in the namespace "default"

warning
events is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "events" in API group "" in the namespace "default"

warning
jobs.batch is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "jobs" in API group "batch" in the namespace "default"

warning
cronjobs.batch is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "cronjobs" in API group "batch" in the namespace "default"

warning
replicationcontrollers is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "replicationcontrollers" in API group "" in the namespace "default"

warning
statefulsets.apps is forbidden: User "system:serviceaccount:kube-system:deployment-controller" cannot list resource "statefulsets" in API group "apps" in the namespace "default"

Answer 1

您的集群似乎启用了 RBAC，并且部署控制器缺少在部署控制器 pod 中定义的服务帐户。您应该能够通过添加此 SA 及其角色/绑定来轻松缓解此问题。

有两种方法可以做到这一点。

您可以通过 CLI 或 YAML 方式使用简单的一行创建绑定：

$ kubectl create clusterrolebinding deployment-controller --clusterrole=cluster-admin --serviceaccount=kube-system:deployment-controller

如果您想在YAML文件中定义ClusterRoleBinding - 使用某个名称创建以下文件并执行特定命令：dashboard-rb.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: deployment-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: deployment-controller
  namespace: kube-system

 $ kubectl create -f dashboard-rb.yaml

看一下：kubernetes-dashboard-access-warnings、 accessing-rbac-enabled-kubernetes-dashboard、 k8s-crb-warning、kubernetes-dashboard-is-forbidden-all-over-the-site。