Flux 好像不能应用 Kustomization

Question

我最近一直在尝试使用助焊剂来处理我从头开始制作的 AKS。 使用我制作的这个脚本：

 $rg = "fluxtestingaks" $aks = "fluxaks" $acr = "fluxaksacr" $location = "uksouth" $tenant = "" $output = az login --tenant $tenant if (!$output) { Write-Error "Error loging in to azure" return } $output = az group create --name $rg --location $location if (!$output) { Write-Error "Error creating resource group" return } $output = az acr create --resource-group $rg --name $acr --sku Basic if (!$output) { Write-Error "Error creating azure container repository" return } $output = az aks create -g $rg -n $aks --load-balancer-managed-outbound-ip-count 1 --enable-managed-identity --node-vm-size Standard_B2s --node-count 1 --generate-ssh-keys if (!$output) { Write-Error "Error creating azure kube.netes cluster" return } $output = az aks update -g $rg -n $aks --enable-managed-identity if (!$output) { Write-Error "Error creating azure system identity" return }

然后我按照这个文档将助焊剂安装到 AKS 上： https://fluxcd.io/flux/guides/image-update/

我必须手动运行此命令以将助焊剂安装到 AKS 上： flux install --components-extra="image-reflector-controller,image-automation-controller"

一切顺利，直到我尝试应用或协调 Kustomization 我一直在使用此命令： flux reconcile kustomization flux-system --with-source

但我收到此错误： ✗ Kustomization reconciliation failed: Namespace/flux-system dry-run failed, reason: Forbidden, error: namespaces "flux-system" is forbidden: User "system:serviceaccount:flux-system:flux-applier" cannot patch resource "namespaces" in API group "" in the namespace "flux-system"

我花了一些时间研究这可能是什么，并得出结论，我需要一个 RBAC 策略来满足 flux-system 用户的需求，所以我制作了这个 YAML 文件：

 apiVersion: v1 kind: ServiceAccount metadata: name: flux-applier namespace: flux-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: flux-permissions rules: - apiGroups: ["", "extensions", "apps"] resources: ["deployments", "replicasets", "pods"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: flux-permissions namespace: flux-system subjects: - kind: ServiceAccount name: flux-applier apiGroup: "" roleRef: kind: Role name: flux-permissions apiGroup: ""

我已将其应用于 Azure Kube.netes 集群，但我仍然遇到同样的愚蠢错误。 任何帮助都会非常感谢。

Answer 1

发布此内容后，我找出了问题所在。 我走在正确的轨道上，发生的事情是我忘记在角色绑定的资源部分中包含resources: "namespace" 。

如果有人对此有疑问，这是我的完整代码以供将来参考。

 apiVersion: v1 kind: ServiceAccount metadata: name: flux-applier namespace: flux-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: flux-permissions rules: - apiGroups: ["", "extensions", "apps"] resources: ["deployments", "replicasets", "pods", "namespaces"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: flux-permissions namespace: flux-system subjects: - kind: ServiceAccount name: flux-applier apiGroup: "" roleRef: kind: Role name: flux-permissions apiGroup: ""