在 openshift 中上传具有集群策略绑定的 yml 时出错"已存在"

Question

当我尝试执行此操作时：

oc create -f custom_clusterPolicyBinding.yml
Error from server: error when creating "custom_clusterPolicyBinding.yml": clusterpolicybindings ":default" already exists
oc version
oc v1.4.1
kubernetes v1.4.0+776c994
features: Basic-Auth GSSAPI Kerberos SPNEGO

这是 custom_clusterPolicyBinding.yml

apiVersion: v1
kind: ClusterPolicyBinding
metadata:
name: custom
policyRef:
name: custom
roleBindings:
- name: custom:label-nodos
roleBinding:
groupNames:
- pachi
metadata:
name: custom:label-nodos
roleRef:
name: custom:label-nodos
subjects:
- kind: Group
name: pachi
userNames: null

集群角色绑定自定义：标签节点已存在

oc get clusterroleBinding | grep custom:label-nodos
custom:label-nodos                              /custom:label-nodos     

而集群角色绑定yaml的内容是：

apiVersion: v1
groupNames: null
kind: ClusterRoleBinding
metadata:
name: custom:label-nodos
roleRef:
name: custom:label-nodos
subjects: []
userNames: null

知道吗？

Answer 1

不要直接编辑策略。 只有一个群集策略和群集策略绑定。

相反，您可能希望创建一个包含类似以下内容的clusterrole(编辑它以授予您要授予的权限)：

apiVersion: v1
kind: ClusterRole
metadata:
name: some-user
rules:
- apiGroups:
- project.openshift.io
- ""
resources:
- projects
verbs:
- list

还有一个包含如下内容的clusterrolebinding(编辑它以绑定到正确的主题)：

apiVersion: v1
kind: ClusterRoleBinding
metadata:
name: some-users
roleRef:
name: some-user
subjects:
- kind: User
name: foo

还可以使用oadm policy add-*role-to-*命令来帮助绑定角色：

add-cluster-role-to-group
add-cluster-role-to-user
add-role-to-group
add-role-to-user