Azure Pipelines部署K8s资源至Namespace B时遇Forbidden错误求助

背景 #

已在K8s的Namespace "A"中通过Azure-DevOps发布流水线部署了一套Deployment及相关资源，现在要将同一套资源部署到Namespace "B"，修改deployment.yaml和流水线参数后部署失败，报错如下：

Error from server (Forbidden): error when retrieving current configuration of:
Resource: "/v1, Resource=configmaps", GroupVersionKind: "/v1, Kind=ConfigMap"
Name: "XXXX-XXXX-XXX", Namespace: "B"

相关文件内容 #

deployment.yaml #

kind: ConfigMap
apiVersion: v1
metadata:
  name: XXXX
  namespace: B
data:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: XXXX
  namespace: B
spec:

apiVersion: v1
kind: Service
metadata:
  name: XXXX
  namespace: B
spec:

Azure-DevOps流水线配置 #

流水线配置截图说明：

• 采用Kubernetes部署任务，指定了目标K8s集群连接
• 部署命令使用kubectl apply，目标命名空间设置为B
• 部署清单文件指向上述deployment.yaml

排查与解决方向 #

• 权限问题：报错为Forbidden，说明Azure-DevOps连接K8s的服务账号在Namespace B中没有ConfigMap的读取/操作权限。需通过Role和RoleBinding给该服务账号配置对应权限：

  # 创建Role（Namespace B下）
  kind: Role
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    namespace: B
    name: configmap-deploy-role
  rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "create", "update", "patch"]
  
  # 绑定到Azure-DevOps使用的服务账号
  kind: RoleBinding
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: configmap-deploy-binding
    namespace: B
  subjects:
  - kind: ServiceAccount
    name: 你的Azure-DevOps服务账号名
    namespace: B
  roleRef:
    kind: Role
    name: configmap-deploy-role
    apiGroup: rbac.authorization.k8s.io
  

• YAML文件格式问题：当前deployment.yaml中多个资源未用---分隔，会导致K8s解析异常，需在每个资源块之间添加分隔符：

  kind: ConfigMap
  apiVersion: v1
  metadata:
    name: XXXX
    namespace: B
  data:
    # 补充你的配置数据，避免空字段
  
  ---
  
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: XXXX
    namespace: B
  spec:
    # 补充Deployment具体配置
  
  ---
  
  apiVersion: v1
  kind: Service
  metadata:
    name: XXXX
    namespace: B
  spec:
    # 补充Service具体配置
  

• 流水线参数校验：确认流水线中指定的命名空间为B，K8s上下文指向目标集群，且无其他参数覆盖YAML中的命名空间配置。

内容的提问来源于stack exchange，提问作者JeewanaSL