如何为Kubernetes ClusterRole添加Pod日志读取权限？

问题描述 #

我创建了绑定到ClusterRole的ServiceAccount，该ClusterRole配置如下：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devops-tools-role
  namespace: devops-tools
rules:
  - apiGroups:
        - ""
        - apps
        - autoscaling
        - batch
        - extensions
        - policy
        - rbac.authorization.k8s.io
        - networking.k8s.io
    resources:
      - pods
      - componentstatuses
      - configmaps
      - daemonsets
      - deployments
      - events
      - endpoints
      - horizontalpodautoscalers
      - ingress
      - ingresses
      - jobs
      - limitranges
      - namespaces
      - nodes
      - pods
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - replicasets
      - replicationcontrollers
      - serviceaccounts
      - services
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

执行Pod日志读取命令：

kubectl -n dfg02 logs postgres-69c7bb5cf7-dstzt

返回权限禁止错误：

Error from server (Forbidden): pods "postgres-69c7bb5cf7-dstzt" is forbidden: User "system:serviceaccount:devops-tools:bino" cannot get resource "pods/log" in API group "" in the namespace "dfg02"

尝试通过kubectl api-resources |grep log查找相关资源，但无结果返回。

解决方法 #

Kubernetes中，Pod日志对应的是**pods/log子资源**，它不属于独立的顶层API资源，因此无法通过kubectl api-resources直接查询到。需要在ClusterRole中显式添加该子资源的权限：

1. 更新ClusterRole配置，在resources列表中加入pods/log：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devops-tools-role
  namespace: devops-tools
rules:
  - apiGroups:
        - ""
        - apps
        - autoscaling
        - batch
        - extensions
        - policy
        - rbac.authorization.k8s.io
        - networking.k8s.io
    resources:
      - pods
      - pods/log  # 添加Pod日志子资源
      - componentstatuses
      - configmaps
      - daemonsets
      - deployments
      - events
      - endpoints
      - horizontalpodautoscalers
      - ingress
      - ingresses
      - jobs
      - limitranges
      - namespaces
      - nodes
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - replicasets
      - replicationcontrollers
      - serviceaccounts
      - services
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

2. 应用更新后的配置：

kubectl apply -f <你的ClusterRole配置文件路径>

3. 验证权限：重新执行日志读取命令，确认可以正常获取Pod日志。

可选：精细化权限控制 #

如果只需要日志读取权限，可单独为pods/log设置更严格的verbs，避免过度授权：

rules:
  # 保留原有资源权限规则...
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]

内容的提问来源于stack exchange，提问作者Bino Oetomo