使用RBAC访问Web UI仪表板时出错

Question

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: try-usr
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "services \"https:kubernetes-dashboard:\" is forbidden: User \"xyz\" cannot get services/proxy in the namespace \"kube-system\"",
  "reason": "Forbidden",
  "details": {
    "name": "https:kubernetes-dashboard:",
    "kind": "services"
  },
  "code": 403
}

Answer 1

根据kubernetes的版本，仪表板将根据文档要求不同的权限

V1.7

• 为kube中的机密创建和监视权限-system命名空间需要创建和监视kubernetes-dashboard-key-holder机密的更改。
• 获取、更新和删除kube-system命名空间中名为kubernetes-dashboard-key-holder和kubernetes-dashboard-certs的机密的权限。
• 对kube-system命名空间中的堆服务器服务的代理权限，以允许从堆服务器获取指标。

null