Kubernetes rbac pod/exec create 操作被禁止

Question

我正在研究运算符并使用 operator-sdk 进行运算符开发。我正在为某些业务逻辑执行 pod exec，但它一直失败并出现以下错误：

Failed to cleanup testst StatefulSet StatefulSet.Name : devst{"Instance.Namespace": "default", "Instance.Name": "testst-sample", "error": "pods \"testst-0\" is forbidden: User \"system:serviceaccount:test-db:default\" cannot create resource \"pods/exec\" in API group \"\" in the namespace \"default\""}

以下是定义角色：

Name:         manager-role
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"annotations":{},"creationTimestamp":null,"name":"manager-ro...
PolicyRule:
  Resources                                  Non-Resource URLs  Resource Names  Verbs
  ---------                                  -----------------  --------------  -----
  statefulsets.''/finalizers                 []                 []              [create delete get list patch update watch]
  configmaps                                 []                 []              [create delete get list patch update watch]
  persistentvolumeclaims                     []                 []              [create delete get list patch update watch]
  secrets                                    []                 []              [create delete get list patch update watch]
  services                                   []                 []              [create delete get list patch update watch]
  statefulsets.apps                          []                 []              [create delete get list patch update watch]
  teststapps.example.com                     []                 []              [create delete get list patch update watch]
  teststapps.example.com/finalizers          []                 []              [create delete get patch update]
  pods/exec                                  []                 []              [create get]
  pods/log                                   []                 []              [get list watch]
  pods                                       []                 []              [get list watch]
  teststapps.example.com/status              []                 []              [get patch update]

角色绑定定义

kubectl describe clusterrolebinding.rbac.authorization.k8s.io/manager-rolebinding
Name:         manager-rolebinding
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"manager-rolebinding"},"roleR...
Role:
  Kind:  ClusterRole
  Name:  manager-role
Subjects:
  Kind            Name     Namespace
  ----            ----     ---------
  ServiceAccount  default  system

请告知我做错了什么。

Answer 1

根据 RoleBinding，您已将 ClusterRole manager-role 关联到 system 命名空间中的 ServiceAccount default，但由于错误，ServiceAccount 在 test-db 命名空间中是 default。

如果您在 RoleBinding 中将命名空间 system 更改为 test-db，它应该可以工作。还要确保在 test-db 命名空间而不是 system 命名空间中创建 RoleBinding。