無法使用KubernetesServiceAccount列出或洗掉ClusterRole或ClusterRoleBinding

我想創建一個 Kubernetes CronJob 來洗掉可能剩??余的資源（命名空間、ClusterRole、ClusterRoleBinding）（最初，標準將是“有標簽=某事”和“超過 30 分鐘”。（每個命名空間包含用于試運行）。

我創建了 CronJob、ServiceAccount、ClusterRole、ClusterRoleBinding，并將服務帳戶分配給 cronjob 的 pod。

cronjob 使用包含 kubectl 的映像和一些腳本來選擇正確的資源。

我的初稿是這樣的：

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app
  namespace: default
  labels:
    app: my-app

---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: my-app
  namespace: default
  labels:
    app: my-app
spec:
  concurrencyPolicy: Forbid
  schedule: "*/1 * * * *"
  jobTemplate:
    # job spec
    spec:
      template:
        # pod spec
        spec:
          serviceAccountName: my-app
          restartPolicy: Never
          containers:
          - name: my-app
            image: image-with-kubectl
            env:
            - name: MINIMUM_AGE_MINUTES
              value: '2'
            command: [sh, -c]
            args:
            # final script is more complex than this
            - |
              kubectl get namespaces
              kubectl get clusterroles
              kubectl get clusterrolebindings
              kubectl delete Namespace,ClusterRole,ClusterRoleBinding --all-namespaces --selector=bla=true

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-app
  labels:
    app: my-app
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: my-app
subjects:
  - kind: ServiceAccount
    name: my-app
    namespace: default
    apiGroup: ""

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-app
  labels:
    app: my-app
rules:
  - apiGroups: [""]
    resources:
      - namespaces
      - clusterroles
      - clusterrolebindings
    verbs: [list, delete]

cronjob 能夠列出和洗掉命名空間，但不能列出和洗掉集群角色或集群角色系結。我錯過了什么？

（實際上，我先用 Job 對此進行測驗，然后再轉向 CronJob）：

NAME              STATUS   AGE
cattle-system     Active   16d
default           Active   16d
fleet-system      Active   16d
gitlab-runner     Active   7d6h
ingress-nginx     Active   16d
kube-node-lease   Active   16d
kube-public       Active   16d
kube-system       Active   16d
security-scan     Active   16d
Error from server (Forbidden): clusterroles.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:default:my-app" cannot list resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope
Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:default:my-app" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope
Error from server (Forbidden): clusterroles.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:default:my-app" cannot list resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope
Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:default:my-app" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope`

uj5u.com熱心網友回復：

您需要像這樣更改 ClusterRole：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-app
  labels:
    app: my-app
rules:
  - apiGroups: [""]
    resources:
      - namespaces
    verbs: [list, delete]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources:
      - clusterroles
      - clusterrolebindings
    verbs: [list, delete]

資源現在位于正確的 apiGroup 中

標籤：

上一篇：如何使用帶有值檔案的Helm圖表在Prometheus中配置ingress-nginx-controller-metrics？

下一篇：如何配置EmbeddedInfinispan來處理K8s滾動更新？