如何解决授予事件查看Terraform的权限
我们有由Rancher管理的本地Kubernetes集群,我们使用Terraform在代码中进行配置。但是,我似乎无法向我的群组devops
授予查看集群中事件的权限。
这些是角色和角色绑定:
resource "rancher2_role_template" "events-view" {
name = "Cluster Events View"
description = "Terraform role template to see cluster events"
rules {
api_groups = ["*"]
resources = ["events"]
verbs = ["get","watch"]
}
}
resource "rancher2_cluster_role_template_binding" "events-view" {
name = "events-view"
cluster_id = rancher2_cluster.rancher_cluster.id
role_template_id = rancher2_role_template.events-view.id
group_principal_id = lookup(var.projects["devops"],"ldap_cn")
depends_on = [
rancher2_role_template.events-view
]
}
这是devops
的定义:
projects = {
devops = {
ldap_cn = "activedirectory_group://CN=devops,OU=Distribution Groups,OU=My,DC=Company",name = "devops",# ...more attributes
},# ...more projects
}
运行terraform apply
时,我看到角色和角色绑定已创建:
rancher2_role_template.events-view: Creating...
rancher2_role_template.events-view: Creation complete after 0s [id=rt-h7xt4]
rancher2_cluster_role_template_binding.events-view: Creating...
rancher2_cluster_role_template_binding.events-view: Creation complete after 2s [id=c-6bdtb:events-view]
kubectl
显示集群角色和角色绑定(显示默认名称空间,但在所有名称空间中也重复):
$ kubectl describe clusterrole rt-h7xt4
Name: rt-h7xt4
Labels: cattle.io/creator=norman
Annotations: authz.cluster.cattle.io/clusterrole-owner: rt-h7xt4
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
events.* [] [] [get watch]
$ kubectl describe clusterrolebinding clusterrolebinding-hkc9b
Name: clusterrolebinding-hkc9b
Labels: authz.cluster.cattle.io/rtb-owner=6f990492-8f60-4950-bb8e-cfa4a9760c01
cattle.io/creator=norman
Annotations: <none>
Role:
Kind: ClusterRole
Name: rt-h7xt4
Subjects:
Kind Name Namespace
---- ---- ---------
Group activedirectory_group://CN=devops,DC=Company
我的用户是devops
AD组的成员,并且在terraform apply
日志中,我看到角色和绑定模板已创建,但是当我登录Rancher并单击{{ 1}}我看不到任何名称空间的事件:
Launch kubectl
我曾尝试在> kubectl get events
Error from server (Forbidden): events is forbidden: User "u-w8rp43jtbn" cannot list resource "events" in API group "" in the namespace "default"
> kubectl get events -n devops
Error from server (Forbidden): events is forbidden: User "u-w8rp44jtbn" cannot list resource "events" in API group "" in the namespace "devops"
以及Kubernetes和Rancher API组中放入空字符串,但是似乎没有任何作用。
解决方法
问题是我制作了群集角色模板而不是项目角色模板。
在rancher2_role_template
资源中,我添加了context = "project"
并将rancher2_cluster_role_template_binding
更改为rancher2_project_role_template_binding
。
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。