版本 "iam.cnrm.cloud.google.com/v1beta1" 中没有匹配的种类"IAMPolicy"

Question

我想使用工作负载标识访问服务帐户。

猫serviceaccount.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
annotations:
iam.gke.io/gcp-service-account: serviceaccount_key@PROJECT_ID.iam.gserviceaccount.com
name: rao-sa
namespace: test

我的yaml文件是policy.yaml

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicy
metadata:
name: iampolicy-workload-identity-sample
spec:
resourceRef:
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMServiceAccount
name: serviceaccount_key@PROJECT_ID.iam.gserviceaccount.com
bindings:
- role: roles/iam.workloadIdentityUser
members:
- serviceAccount:PROJECT_ID.svc.id.goog[test/rao-sa]

---

kubectl apply -f policy.yaml
error: unable to recognize "policy.yaml": no matches for kind "IAMPolicy" in version "iam.cnrm.cloud.google.com/v1beta1"

在YAML文件中出现错误:没有匹配的类型"IAMPolicy"在版本"iam.cnrm.cloud.google.com/v1beta1">

Answer 1

这是一个没有安装配置连接器的常见错误，请检查步骤7。

如何启用?

gcloud container clusters update CLUSTER_NAME 
--update-addons ConfigConnector=ENABLED

Answer 2

以下是IAM策略的一些资源以及如何启用GKE工作负载标识

https://medium.com/bluecore-engineering/the-infrastructure-triumvirate-continuous-service-and-infrastructure-delivery-with-argo-a33a3f76dc06https://cloud.google.com/config-connector/docs/reference/resource-docs/iam/iampolicyhttps://dzone.com/articles/enabling-gke-workload-identity

还在检查您的策略。我在Yaml文件中发现了一些放错地方的项目，请检查这是否有效。

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicy
metadata:
name: iampolicy-workload-identity-sample
namespace: rao-sa
spec:
resourceRef:
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMServiceAccount
name: serviceaccount_key@PROJECT_ID.iam.gserviceaccount.com
bindings:
members:
- serviceAccount:PROJECT_ID.svc.id.goog[test/rao-sa]
role: roles/iam.workloadIdentityUser