0

我正在尝试从一个监听 webhook 并运行 tkn 的 continer 中创建一个 PipeLineRun/PipeLineRun - 但我需要 RBAC 权限。我尝试将角色绑定角色：tekton-pipelines-controller 设置为默认服务帐户：

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: webhook
  namespace: tekton-pipelines
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tekton-pipelines-controller
subjects:
  - kind: ServiceAccount
    name: default
    namespace: default

但我仍然不能这样做：

kubectl auth can-i create taskrun -n default --as=system:serviceaccount:default:default

no

我还尝试为资源创建角色：

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: webhook-create-taskrun
  namespace: tekton-pipelines
rules:
  - apiGroups: ["tekton.dev/v1beta1"]
    resources: ["taskrun"]
    verbs: ["get", "create", "list"]
# [ delete deletecollection get list patch create update watch ]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: webhook-create-taskrun
  namespace: tekton-pipelines
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: webhook-create-taskrun
subjects:
  - kind: ServiceAccount
    name: default
    namespace: default

不幸的是仍然无法访问

我还在 tekton-pipelines 的所有 RoleBindings 中查找了任何“taskrun”，但一无所获

        ns := "tekton-pipelines"
    rbacClientSet := clientSet.RbacV1()
    rolebindings, _ := rbacClientSet.RoleBindings(ns).List(context.Background(), metav1.ListOptions{})

    for _, element := range rolebindings.Items {
        fmt.Println(element)
    }
4

1 回答 1

0

您的 ServiceAccount 应该被授予类似于 EventListener（Tekton 触发器）的权限。

你可以在那里找到一个示例角色：https ://github.com/tektoncd/triggers/blob/main/config/200-clusterrole.yaml#L64-L87 ：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-triggers-eventlistener-roles
  labels:
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-triggers
rules:
  - apiGroups: ["triggers.tekton.dev"]
    resources: ["eventlisteners", "triggerbindings", "triggertemplates", "triggers"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["tekton.dev"]
    resources: ["pipelineruns", "pipelineresources", "taskruns"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["serviceaccounts"]
    verbs: ["impersonate"]
  - apiGroups: ["policy"]
    resources: ["podsecuritypolicies"]
    resourceNames: ["tekton-triggers"]
    verbs: ["use"]

您使用的那个（tekton-pipelines-controller）并不意味着创建 PipelineRuns。

您尝试自己编写的那个允许创建 TaskRuns，但您仍然缺少 PipelineRuns。

如果您要实现自己的触发器，您可能不需要完整的 tekton-triggers-eventlistener-roles 权限。创建管道运行可能就足够了。

于 2021-10-24T09:02:51.250 回答