3

我在连接到 python kubernetes 客户端时遇到问题，但是我在运行时遇到了这个 404 url​​ not found 错误，curl -k https://ip-address:30000/pods这是我编写的用于连接到 kubernetes 和列出 pod 的端点。我正在通过 minikube 在本地运行它，有什么建议吗？

错误：

Reason: Unauthorized
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'Content-Length': '129', 'Date': 'Wed, 18 Jul 2018 01:08:30 GMT'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}

我如何连接到 api：

from kubernetes import config,client
from kubernetes.client import Configuration, ApiClient

config = Configuration()
config.api_key = {'authorization': 'Bearer my-key-here'}
config.ssl_ca_cert = '/etc/secret-volume/ca-cert'
config.cert_file = 'ca-cert.crt'
config.key_file = '/etc/secret-volume/secret-key'
config.assert_hostname = False
api_client = ApiClient(configuration=config)
v1 = client.CoreV1Api(api_client)

#I've also tried using below, but it gives sslcertifificate max retry error 
#so I opted for manual config above
try: 
   config.load_incluster_config()
except: 
   config.load_kube_config()
v1 = client.CoreV1Api()

我获取 api 密钥的方式是从我创建的服务帐户中获取解码的令牌，但是根据此处的文档， 它说

在配置了令牌身份验证并启用匿名访问的服务器上，提供无效承载令牌的请求将收到 401 Unauthorized 错误。不提供不记名令牌的请求将被视为匿名请求。

所以看起来我的 api 令牌在某种程度上是无效的？但是我按照步骤对它和所有内容进行了解码。我非常关注这个

我的 yaml 文件：

apiVersion: apps/v1beta1 
kind: Deployment
metadata:
  name: first-app
  namespace: test-ns
spec:
  selector:
    matchLabels:
      app: first-app
  replicas: 3 
  template: 
    metadata:
      labels:
        app: first-app
    spec:
      serviceAccountName: test-sa
      containers:
      - name: first-app
        image: first-app
        imagePullPolicy: IfNotPresent

        volumeMounts:
        - name: secret-volume
          mountPath: /etc/secret-volume
        ports: 
        - containerPort: 80
        env:
        - name: "SECRET_KEY"
          value: /etc/secret-volume/secret-key
        - name: "SECRET_CRT"
          value: /etc/secret-volume/secret-crt
        - name: "CA_CRT"
          value: /etc/secret-volume/ca-cert
      volumes:
        - name: secret-volume
          secret: 
            secretName: test-secret

---
apiVersion: v1
kind: Service
metadata:
  name: first-app
  namespace: test-ns
spec:
  type: NodePort
  selector:
    app: first-app
  ports:
  - protocol: TCP
    port: 443 
    nodePort: 30000

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test-ns

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: system:test-app
  namespace: test-ns
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  - services
  verbs:
  - '*'

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:test-app
  namespace: test-ns
subjects:
  - kind: ServiceAccount
    name: test-sa
    namespace: test-ns
roleRef:
  kind: ClusterRole
  name: system:test-app
  apiGroup: rbac.authorization.k8s.io
4

0 回答 0