新用户的命名空间被禁止错误

Question

我使用客户端证书数据和客户端密钥数据添加了一个名为“hello”的新用户到 kind 集群。当我切换到它的上下文并按下命令时：

kubectl get ns development-hello

我明白了：

Error from server (Forbidden): namespaces "development-hello" is forbidden: User "hello" cannot get resource "namespaces" in API group "" in the namespace "development-hello"

我没有此用户的集群角色绑定。

这是来自 kubectl 配置视图的快照

apiVersion: v1   
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://127.0.0.1:33445
  name: kind-kind
contexts:
- context:
    cluster: kind-kind
    user: hello
  name: hello-kind-kind
- context:
    cluster: kind-kind
    user: kind-kind
  name: kind-kind
current-context: hello-kind-kind
kind: Config
preferences: {}
users:
- name: hello
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: kind-kind
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

Answer 1

需要使用admin 帐户为hello 用户创建ClusterRole 和RoleBinding。

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ns-role
rules:
- apiGroups: [""]
  resources: ["namespace"]
  verbs: ["get", "watch", "list", "create", "delete"]    
---    
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ns-rolebinding
  namespace: development-hello
subjects:
- kind: User
  name: hello
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: ns-role
  apiGroup: rbac.authorization.k8s.io

可以使用以下命令检索具有管理员帐户的 kubeconfig 文件

docker exec -it <kind-control-plane-node-name>

sudo cat /etc/kubernetes/admin.conf