Minikube中Traefik路由Ingress权限报错问题求助

我在本地Minikube上运行演示应用，尝试用Traefik将流量路由到app-1和app-2时，遇到如下权限错误：

E1118 08:29:28.397486 1 reflector.go:138] k8s.io/client-go@v0.22.1/tools/cache/reflector.go:167: Failed to watch *v1.Ingress: failed to list *v1.Ingress: ingresses.networking.k8s.io is forbidden: User "system:serviceaccount:demo:traefik-account" cannot list resource "ingresses" in API group "networking.k8s.io" at the cluster scope

已创建对应的ClusterRole、ClusterRoleBinding和ServiceAccount，且确认绑定存在，但错误依旧。

相关配置文件 #

ClusterRole与ClusterRoleBinding配置 #

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-role
rules:
  - apiGroups: [""]
    #- networking.k8s.io
    resources:
       - ingresses
       - secrets
       - services
       - endpoints
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-role-binding
subjects:
  - kind: ServiceAccount
    name: traefik-account
    namespace: {{ .Values.namespace }}
roleRef:
  kind: ClusterRole
  name: traefik-ingress-role
  apiGroup: rbac.authorization.k8s.io

ServiceAccount配置 #

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-account
  namespace: {{ .Values.namespace }}

绑定确认命令输出 #

-> % kubectl get clusterrole traefik-ingress-role -n demo        

NAME                   CREATED AT
traefik-ingress-role   2023-11-17T12:04:55Z

解决步骤 #

1. 修复ClusterRole的API组配置
   错误提示明确指出权限缺失在networking.k8s.io API组的ingresses资源，但当前ClusterRole仅在空API组（核心组）声明了权限。需要为networking.k8s.io组添加对应规则，修改后的ClusterRole规则如下：

   rules:
     - apiGroups: ["", "networking.k8s.io"]
       resources:
          - ingresses
          - secrets
          - services
          - endpoints
       verbs:
         - get
         - list
         - watch
   

   说明：secrets、services、endpoints属于空API组，ingresses属于networking.k8s.io组，因此需要同时包含两个API组。

2. 重新应用ClusterRole配置
   执行命令更新ClusterRole：

   kubectl apply -f <你的ClusterRole配置文件路径>
   

3. 验证权限有效性
   使用kubectl auth can-i命令检查ServiceAccount权限：

   kubectl auth can-i list ingresses.networking.k8s.io --as=system:serviceaccount:demo:traefik-account --all-namespaces
   

   返回yes则权限配置正确；返回no需检查ClusterRoleBinding是否正确关联ServiceAccount与ClusterRole。

4. 重启Traefik Pod
   权限更新后，重启Traefik Pod使新权限生效：

   kubectl rollout restart deployment traefik -n demo
   

内容的提问来源于stack exchange，提问作者Mike3355