配置K8s ServiceAccount读取ClusterRoles？部署ingress-nginx遇权限问题

我在容器中运行Jenkins，尝试向Kubernetes 1.25.4集群部署ingress-nginx Helm chart。已经为Jenkins创建了ServiceAccount，目前能通过其token列出所有命名空间的Pod，但部署Helm chart时触发权限错误：

Error from server (Forbidden): clusterroles.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:devops-tools:jenkins-admin" cannot list resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope

当前使用的RBAC配置 #

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: jenkins-admin
rules:
  - apiGroups: [""]
    resources: ["*"]
    verbs: ["*"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins-admin
  namespace: devops-tools

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jenkins-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: jenkins-admin
subjects:
- kind: ServiceAccount
  name: jenkins-admin
  namespace: devops-tools

解决方案 #

当前ClusterRole仅覆盖了核心API组（""）的所有权限，缺少rbac.authorization.k8s.io API组中clusterroles资源的操作权限。需要扩展ClusterRole规则，添加对应权限：

修改后的完整RBAC配置：

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: jenkins-admin
rules:
  # 保留原核心API组的全权限
  - apiGroups: [""]
    resources: ["*"]
    verbs: ["*"]
  # 新增rbac API组的clusterroles资源权限，verbs可根据实际需求调整
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterroles"]
    verbs: ["list", "get", "watch"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins-admin
  namespace: devops-tools

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jenkins-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: jenkins-admin
subjects:
- kind: ServiceAccount
  name: jenkins-admin
  namespace: devops-tools

权限验证 #

执行以下命令确认权限是否配置成功：

kubectl auth can-i get clusterroles --as=system:serviceaccount:devops-tools:jenkins-admin -A

返回yes即表示权限生效，可重新尝试部署Helm chart。

内容的提问来源于stack exchange，提问作者mr.Gray