使用 Helm 安裝 nginx-ingress 返回“錯誤：呈現的清單包含已存在的資源”

Question

我有一個 GitLab 管道，用於在 Azure 上使用 Terraform 部署 Kube.netes 集群。我第一次使用管道時一切順利。 完成測試后，我運行了銷毀階段，所有東西都被銷毀了。 昨天我重新運行管道來創建集群，除了最后一個階段使用 helm 安裝 nginx-ingress 之外，所有階段都進行得很順利。

install_nginx_ingress:
  stage: install_dependencies
  image:  alpine/helm:3.1.1
  script:
    - helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
    - helm repo update
    - >
      helm install nginx-ingress ingress-nginx/ingress-nginx
      --namespace default
      --set controller.replicaCount=2
  dependencies:
    - apply
  rules:
    - if: $CI_COMMIT_BRANCH ==  $CI_DEFAULT_BRANCH && $PHASE == "DEPLOY"

執行此階段時，這就是我在 GitLab 控制台中的內容：

$ helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
"ingress-nginx" has been added to your repositories
$ helm repo update
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "ingress-nginx" chart repository
Update Complete. ⎈ Happy Helming!⎈ 
$ helm install nginx-ingress ingress-nginx/ingress-nginx --namespace default --set controller.replicaCount=2
Error: rendered manifests contain a resource that already exists. 
Unable to continue with install: could not get information about the resource: poddisruptionbudgets.policy "nginx-ingress-ingress-nginx-controller" is forbidden: User "system:serviceaccount:gitlab-managed-apps:default" cannot get resource "poddisruptionbudgets" in API group "policy" in the namespace "default"
Cleaning up project directory and file based variables
ERROR: Job failed: command terminated with exit code 1

怎么了？？

Answer 1

檢查此錯誤行。 這就說明了問題。

Unable to continue with install: could not get information about the resource: poddisruptionbudgets.policy "nginx-ingress-ingress-nginx-controller" is forbidden: User "system:serviceaccount:gitlab-managed-apps:default" cannot get resource "poddisruptionbudgets" in API group "policy" in the namespace "default"

您的nginx-ingress-ingress-nginx-controller沒有對poddisruptionbudgets資源進行get操作的 RBAC 權限。

看起來kube.netes/ingress-nginx圖表定義了PodDisruptionBudget ，但ClusterRole不包含對poddisruptionbudgets資源的任何權限。