kubernetes

2023-08-30 21:56| 来源: 网络整理| 查看: 265

I have a cluster with multiple namespaces. Let's call them: ns1 and ns2 I also have multiple service accounts, lets call them sa1 and sa2, all in one namespace - sa-ns.

Both users can access all resources within both namespaces, however they cannot list namespaces they are part of. kubectl get ns --as=sa1 returns:

Error from server (Forbidden): namespaces is forbidden: User "sa1" cannot list resource "namespaces" in API group "" at the cluster scope

It works only if I manually specify which namespace I want to list:

kubectl get ns ns1 --as=sa1

NAME STATUS AGE ns1 Active 6d6h

I need both users sa1 and sa2 be able to list all namespaces within cluster they have access to. In this case ns1 and ns2.

This behavior also probably wont allow me to list namespaces and it's resources in Lens dashboards. From the the namespace list I can list only the namespace sa-ns the users sa1 & sa2 are part of. Dashboards are however empty as you can seen on the image bellow.

enter image description here

I tried to add namespace the user has in fact access to via ACCESSIBLE NAMESPACES feature in Lens, but it doesn't work either.

enter image description here

I still don't see anything, only blank dashboards.

enter image description here

ServiceAccount:

apiVersion: v1 kind: ServiceAccount metadata: name: sa1 namespace: sa-ns --- apiVersion: v1 kind: ServiceAccount metadata: name: sa2 namespace: sa-ns

Role:

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: admin-role namespace: ns1 rules: - apiGroups: - "*" resources: - "*" verbs: - "*" --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: admin-role namespace: ns2 rules: - apiGroups: - "*" resources: - "*" verbs: - "*"

RoleBinding:

apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: admin-role-binding namespace: ns1 roleRef: kind: Role name: admin-role apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: sa1 namespace: sa-ns --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: admin-role-binding namespace: ns2 roleRef: kind: Role name: admin-role apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: sa2 namespace: sa-ns

I tried to use ClusterRoleinstead of Role but nothing has changed.

【本文地址】

公司简介

联系我们