小编Kee*_*ing的帖子

我正在尝试为需要持久卷的服务创建RBAC 角色/规则，但它仍然因禁止错误而失败。

这是我的角色配置：

kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: logdrop-user-full-access
  namespace: logdrop
rules:
- apiGroups: ["", "extensions", "apps", "autoscaling"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["batch"]
  resources:
  - jobs
  - cronjobs
  verbs: ["*"]

这是我缩减的PersistentVolume清单：

apiVersion: v1
kind: PersistentVolume
metadata:
  name: logdrop-pv
  namespace: logdrop
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  claimRef:
    namespace: logdrop
    name: logdrop-pvc
  hostPath:
    path: /efs/logdrop/logdrop-pv

当我尝试应用它时，我收到一个禁止错误。

$ kubectl --kubeconfig ~/logdrop/kubeconfig-logdrop.yml apply -f pv-test.yml 
Error from server (Forbidden): error when …

我们有一个GitLab CI构建/测试/部署管道，需要在部署到Test和升级到Prod之间插入手动批准。我不知道该怎么做。

stages:
  # lint, build, test, ...
  - deploy_test
  - approval
  - deploy_prod


deploy_test:
  stage: deploy_test
  only:
    refs:
      - prod

  script:
    ...

wait_for_approval:
  stage: approval
  # how do I do this???

deploy_prod:
  stage: deploy_prod
  only:
    refs:
      - prod

  script:
    ...