相关疑难解决方法(0)

我在Google Kubernetes引擎上使用Kubernetes 1.8.6并且有一个运行Alpine的pod作为一部分StatefulSet.

我已使用登录到我的pod kubectl exec -it my-pod-0 -- /bin/sh,然后在提示符处运行以下命令:

$ CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
$ TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
$ NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
$ curl --cacert $CA_CERT -H "Authorization: Bearer $TOKEN" "https://kubernetes
/api/v1/namespaces/$NAMESPACE/services/"

不幸的是,返回了403 Forbidden错误:

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "services is forbidden: User \"system:serviceaccount:default:default\" cannot list services in the namespace \"default\": Unknown user \"system:serviceaccount:default:default\"",
  "reason": "Forbidden",
  "details": {
    "kind": "services"
  },
  "code": 403

我究竟做错了什么？