kubectl 获取机密：来自服务器的错误（禁止）

Question

我已经在本地安装了 Upbound CLI，从那时起，receiving Error from server (Forbidden)当我尝试使用以下命令执行不同的命令时，我（我认为）出现错误消息kubectl：

kubectl get secrets

Error from server (Forbidden): secrets is forbidden: User "upbound-cloud-impersonator" cannot list resource "secrets" in API group "" in the namespace "default"

kubectl get all

Error from server (Forbidden): replicationcontrollers is forbidden: User "upbound-cloud-impersonator" cannot list resource "replicationcontrollers" in API group "" in the namespace "default"
Error from server (Forbidden): services is forbidden: User "upbound-cloud-impersonator" cannot list resource "services" in API group "" in the namespace "default"
Error from server (Forbidden): daemonsets.apps is forbidden: User "upbound-cloud-impersonator" cannot list resource "daemonsets" in API group "apps" in the namespace "default"
Error from server (Forbidden): deployments.apps is forbidden: User "upbound-cloud-impersonator" cannot list resource "deployments" in API group "apps" in the namespace "default"
Error from server (Forbidden): replicasets.apps is forbidden: User "upbound-cloud-impersonator" cannot list resource "replicasets" in API group "apps" in the namespace "default"
Error from server (Forbidden): statefulsets.apps is forbidden: User "upbound-cloud-impersonator" cannot list resource "statefulsets" in API group "apps" in the namespace "default"
Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "upbound-cloud-impersonator" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "default"
Error from server (Forbidden): cronjobs.batch is forbidden: User "upbound-cloud-impersonator" cannot list resource "cronjobs" in API group "batch" in the namespace "default"
Error from server (Forbidden): jobs.batch is forbidden: User "upbound-cloud-impersonator" cannot list resource "jobs" in API group "batch" in the namespace "default"

似乎用户已更改为“upbound-cloud-impersonator”，但我不确定为什么以及如何将其切换回之前的状态。

如果有帮助的话，这些是命名空间：

crossplane-system   Active   2d21h
default             Active   2d21h
kube-node-lease     Active   2d21h
kube-public         Active   2d21h
kube-system         Active   2d21h
upbound-system      Active   2d21h
velero              Active   2d21h

以及用户列表kubectl config view -o jsonpath='{.users[*].name}'：
minikube upbound-3f93ea79-ba0e-4fdc-ae69-f2c562279579

Answer 1

• 用户upbound-cloud-impersonator没有足够的 RBAC 权限来获取机密。另一种解决方案是设置足够的 RBAC 权限。

您可以使用以下命令验证这一点：

kubectl auth can-i get secret --as upbound-cloud-impersonator

或者只是运行（因为您的上下文已经更改）：

kubectl auth can-i get secret

• 您当前的上下文已切换到其他内容。新的上下文正在使用upbound-cloud-impersonator. 您可以运行以下命令来列出当前上下文

  kubectl 配置当前上下文

要切换到另一个上下文，您可以首先运行以下命令来列出您的上下文列表。请注意*表示当前上下文的符号。请注意，此处使用的上下文名称只是示例，可能因您的集群而异。

kubectl config get-contexts
CURRENT   NAME                                 CLUSTER   AUTHINFO                     NAMESPACE
          default                              default   default
*         upbound-cloud-impersonator@default   default   upbound-cloud-impersonator

要切换到其他上下文，会将当前上下文更改为提供的上下文。使用适当的上下文进行切换。

 kubectl config use-context default

注意*标志：

kubectl config get-contexts
CURRENT   NAME                                 CLUSTER   AUTHINFO                     NAMESPACE
*         default                              default   default
          upbound-cloud-impersonator@default   default   upbound-cloud-impersonator

验证授权：

kubectl auth can-i get secret
yes