[英]Kubernetes Access metrics server API externally
我正在嘗試在不使用kubectl proxy
的情況下訪問 k8s 集群的指標服務器。 在https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy找到教程后,我遇到了一個問題。
發出請求時curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header "Authorization: Bearer $TOKEN" --insecure | jq
curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header "Authorization: Bearer $TOKEN" --insecure | jq
我收到以下權限錯誤:
curl -X GET $APISERVER/apis/metrics.k8s.io/v1beta1/nodes --header "Authorization: Bearer $TOKEN" --insecure | jq 11:58AM
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 386 100 386 0 0 2064 0 --:--:-- --:--:-- --:--:-- 2064
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Failure",
"message": "nodes.metrics.k8s.io is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"nodes\" in API group \"metrics.k8s.io\" at the cluster scope",
"reason": "Forbidden",
"details": {
"group": "metrics.k8s.io",
"kind": "nodes"
},
"code": 403
}
我嘗試使用以下testaccount
創建自定義 ServiceAccount 測試帳戶:
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: test-admin
rules:
- apiGroups: [""]
resources: ["pods", "nodes"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: test-rbac
subjects:
- kind: ServiceAccount
name: testaccount
namespace: default
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
我已經嘗試使用包含的 ClusterRole 以及cluster-admin
集群角色。 使用這些更改后生成的令牌,我仍然得到相同的 curl 錯誤。
我發現需要修改的是apiGroups
。 以下 ClusterRole 和 ClusterRoleBinding 有效:
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: test-admin
rules:
- apiGroups: ["*"] # This was the change
resources: ["pods", "nodes"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: test-rbac
subjects:
- kind: ServiceAccount
name: testaccount
namespace: default
roleRef:
kind: ClusterRole
name: test-admin
apiGroup: rbac.authorization.k8s.io
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.