此配置适用于其他集群，但不适用于我部署的最后一个集群。 我的 RBAC 配置存在某种问题。
kubectl get pods -n ingress-controller
NAME READY STATUS RESTARTS AGE
haproxy-ingress-b4d969b8b-dw65k 0/1 CrashLoopBackOff 15 52m
ingress-default-backend-f5dfbf97-6t72p 1/1 Running 0 52m
kubectl logs -n ingress-controller -l run=haproxy-ingress
I0120 11:55:17.347244 6 launch.go:151]
Name: HAProxy
Release: v0.8
Build: git-1351a73
Repository: https://github.com/jcmoraisjr/haproxy-ingress
I0120 11:55:17.347337 6 launch.go:154] Watching for ingress class: haproxy
I0120 11:55:17.347664 6 launch.go:364] Creating API client for https://10.3.0.1:443
I0120 11:55:17.391439 6 launch.go:376] Running in Kubernetes Cluster version v1.16 (v1.16.4) - git (clean) commit 224be7bdce5a9dd0c2fd0d46b83865648e2fe0ba - platform linux/amd64
F0120 11:55:17.401773 6 launch.go:177] no service with name ingress-controller/ingress-default-backend found: services "ingress-default-backend" is forbidden: User "system:serviceaccount:ingress-controller:ingress-controller" cannot get resource "services" in API group "" in the namespace "ingress-controller": RBAC: clusterrole.rbac.authorization.k8s.io "ingress-controller" not found
kubectl get svc -n ingress-controller
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-default-backend ClusterIP 10.3.118.160 <none> 8080/TCP 55m
kubectl describe clusterrole ingress-controller
Name: ingress-controller
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration:
{"apiVersion":"rbac.authorization.k8s.io/v1beta1","kind":"ClusterRole","metadata":{"annotations":{},"name":"ingress-controller"},"rules":[...
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
events [] [] [create patch]
services [] [] [get list watch]
ingresses.extensions [] [] [get list watch]
nodes [] [] [list watch get]
configmaps [] [] [list watch]
endpoints [] [] [list watch]
pods [] [] [list watch]
secrets [] [] [list watch]
ingresses.extensions/status [] [] [update]
kubectl describe clusterrolebinding -n ingress-controller ingress-controller
Name: ingress-controller
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration:
{"apiVersion":"rbac.authorization.k8s.io/v1beta1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"ingress-controller"},"r...
Role:
Kind: ClusterRole
Name: ingress-controller
Subjects:
Kind Name Namespace
---- ---- ---------
ServiceAccount ingress-controller ingress-controller
User ingress-controller
kubectl auth can-i get services --as=ingress-controller
no - RBAC: clusterrole.rbac.authorization.k8s.io "ingress-controller" not found
任何帮助将不胜感激。
更新：
为入口控制器添加部署和 rbac：
https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/deployment/haproxy-ingress.yaml
https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/rbac/ingress-controller-rbac.yml
ClusterRoleBinding 绑定到服务帐户ingress-controller，它与守护程序示例一起使用，因为它使用serviceAccountName: ingress-controller
部署没有定义serviceAccountName，因此它使用default服务帐户(而不是ingress-controller。
因此，您可以通过绑定到如下所示default来修复群集角色绑定：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: ingress-controller
subjects:
- kind: ServiceAccount
name: default
namespace: ingress-controller
- apiGroup: rbac.authorization.k8s.io
kind: User
name: ingress-controller