Kubernetes RBAC配置后用户无资源访问权限问题排查与解决

问题场景 #

尝试通过RBAC为用户授予default命名空间下特定资源的访问权限，已在该命名空间定义Role和RoleBinding，且上下文指定了对应命名空间和用户，但用户仍无法访问目标资源。

相关配置文件 #

Role配置 #

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: l
rules:
- apiGroups: [v1]
  resources: [secrets]
  verbs: [get, list, create, update, patch, delete]
- apiGroups: [v1]
  resources: [pods]
  verbs: [get, watch, list]

RoleBinding配置 #

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: l
  namespace: default
subjects:
- kind: User
  name: l
  namespace: default
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: l
  apiGroup: rbac.authorization.k8s.io

上下文配置 #

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: xx
    server: xx
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: default
    user: l
  name: l
current-context: l
kind: Config
preferences: {}
users:
- name: l
  user:
    client-certificate-data: xx
    client-key-data: xx

权限验证结果 #

kubectl get pods --kubeconfig=l/l-k8s-config
Error from server (Forbidden): pods is forbidden: User "l" cannot list resource "pods" in API group "" in the namespace "default"
kubectl get secrets --kubeconfig=l/l-k8s-config
Error from server (Forbidden): secrets is forbidden: User "l" cannot list resource "secrets" in API group "" in the namespace "default"
kubectl auth can-i get secrets -n default --kubeconfig=l/l-k8s-config
no

解决方案 #

由于运行的是较旧版本的Kubernetes（1.21.10），将Role配置中每个apiGroups的值从[v1]修改为['']（空字符串数组）后，权限问题得以解决。修改后的Role规则示例：

rules:
- apiGroups: ['']
  resources: [secrets]
  verbs: [get, list, create, update, patch, delete]
- apiGroups: ['']
  resources: [pods]
  verbs: [get, watch, list]

内容的提问来源于stack exchange，提问作者Alistair McCutcheon