即使在创建角色绑定后，Kubernetes 也无法在集群范围的 API 组" "中创建资源"namespaces"

Question

我正在运行一个创建kubernetes命名空间的管道，但当我运行它时，我得到：

Error from server (Forbidden): namespaces is forbidden: User "system:serviceaccount:gitlab-runner:default" cannot create resource "namespaces" in API group "" at the cluster scope

我创建了一个ClusterRole和ClusterRoleBinding，以允许gitlab-runner名称空间中的服务用户default使用创建名称空间

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: modify-namespace
rules:
- apiGroups: [""]
resources:
- namespace
verbs:
- create

和：

ind: ClusterRoleBinding
metadata:
name: modify-namespace-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: modify-namespace
subjects:
- kind: ServiceAccount
name: default
namespace: gitlab-runner

但这也给了我同样的错误。我做错了什么？

Answer 1

• 在clusterrole清单中，它应该只是""。因为["]将是apiGroups期望字符串的数组
• 在resources下应该是namespaces而不是namespace，因为：

kubectl api-resources | grep 'namespace|NAME'
NAME                              SHORTNAMES   APIVERSION                             NAMESPACED   KIND
namespaces                        ns           v1                                     false        Namespace

• 因此clusterrole清单应如下所示：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: modify-namespace
rules:
- apiGroups: ""
resources:
- namespaces
verbs:
- create

Answer 2

我在下面遇到了这个问题：

Namespaces is forbidden: User "system:serviceaccount:openshift-operators:minio-operator" cannot create resource "namespaces" in API group "" at the cluster scope

解决了以下问题：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cluster-role-cesar-3
rules:
- apiGroups: [""]
resources:
- namespaces
verbs:
- create    
---    
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: role-binding-cesar-3
namespace: openshift-operators
subjects:
- kind: ServiceAccount
name: minio-operator
namespace: openshift-operators
roleRef:
kind: ClusterRole
name: cluster-role-cesar-3
apiGroup: rbac.authorization.k8s.io