7

此配置适用于其他集群，但不适用于我部署的最后一个集群。我的 RBAC 配置存在某种问题。

kubectl get pods -n ingress-controller

NAME                                     READY   STATUS             RESTARTS   AGE
haproxy-ingress-b4d969b8b-dw65k          0/1     CrashLoopBackOff   15         52m
ingress-default-backend-f5dfbf97-6t72p   1/1     Running            0          52m

kubectl logs -n ingress-controller -l run=haproxy-ingress

I0120 11:55:17.347244       6 launch.go:151] 
Name:       HAProxy
Release:    v0.8
Build:      git-1351a73
Repository: https://github.com/jcmoraisjr/haproxy-ingress
I0120 11:55:17.347337       6 launch.go:154] Watching for ingress class: haproxy
I0120 11:55:17.347664       6 launch.go:364] Creating API client for https://10.3.0.1:443
I0120 11:55:17.391439       6 launch.go:376] Running in Kubernetes Cluster version v1.16 (v1.16.4) - git (clean) commit 224be7bdce5a9dd0c2fd0d46b83865648e2fe0ba - platform linux/amd64
F0120 11:55:17.401773       6 launch.go:177] no service with name ingress-controller/ingress-default-backend found: services "ingress-default-backend" is forbidden: User "system:serviceaccount:ingress-controller:ingress-controller" cannot get resource "services" in API group "" in the namespace "ingress-controller": RBAC: clusterrole.rbac.authorization.k8s.io "ingress-controller" not found

kubectl get svc -n ingress-controller

NAME                      TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
ingress-default-backend   ClusterIP   10.3.118.160   <none>        8080/TCP   55m

kubectl describe clusterrole ingress-controller

Name:         ingress-controller
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"rbac.authorization.k8s.io/v1beta1","kind":"ClusterRole","metadata":{"annotations":{},"name":"ingress-controller"},"rules":[...
PolicyRule:
  Resources                    Non-Resource URLs  Resource Names  Verbs
  ---------                    -----------------  --------------  -----
  events                       []                 []              [create patch]
  services                     []                 []              [get list watch]
  ingresses.extensions         []                 []              [get list watch]
  nodes                        []                 []              [list watch get]
  configmaps                   []                 []              [list watch]
  endpoints                    []                 []              [list watch]
  pods                         []                 []              [list watch]
  secrets                      []                 []              [list watch]
  ingresses.extensions/status  []                 []              [update]

kubectl describe clusterrolebinding -n ingress-controller ingress-controller

Name:         ingress-controller
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"rbac.authorization.k8s.io/v1beta1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"ingress-controller"},"r...
Role:
  Kind:  ClusterRole
  Name:  ingress-controller
Subjects:
  Kind            Name                Namespace
  ----            ----                ---------
  ServiceAccount  ingress-controller  ingress-controller
  User            ingress-controller

kubectl auth can-i get services --as=ingress-controller

no - RBAC: clusterrole.rbac.authorization.k8s.io "ingress-controller" not found

任何帮助将不胜感激。

更新：

为 ingress-controller 添加部署和 rbac：

https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/deployment/haproxy-ingress.yaml

https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/rbac/ingress-controller-rbac.yml

4

1 回答 1

0

ClusterRoleBinding 绑定到服务帐户ingress-controller，它与 daemonset 示例一起使用，因为它使用serviceAccountName: ingress-controller

部署没有定义serviceAccountName，所以它使用defaultserviceaccount （而不是ingress-controller.

所以你可以通过绑定来修复集群角色绑定default：


apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingress-controller
subjects:
  - kind: ServiceAccount
    name: default
    namespace: ingress-controller
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: ingress-controller
于 2020-09-26T13:12:41.297 回答