配置RBAC的CronJob Pod执行StatefulSet补丁遇禁止访问错误

错误信息 #

Error from server (Forbidden): statefulsets.apps "test-statefulset" is forbidden: User "system:serviceaccount:test-namespace:test-serviceaccount" cannot get resource "statefulsets" in API group "apps" in the namespace "test-namespace"

原始配置 #

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    env: test
  name: test-serviceaccount
  namespace: test-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    env: test
  name: test-role
  namespace: test-namespace
rules:
- apiGroups:
  - apps/v1
  resourceNames:
  - test-statefulset
  resources:
  - statefulsets
  verbs:
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
  name: test-binding
  namespace: test-namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-role
subjects:
- kind: ServiceAccount
  name: test-serviceaccount
  namespace: test-namespace
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  labels:
  name:test-job
  namespace: test-namespace
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  jobTemplate:
    metadata:
      labels:
        env: test
    spec:
      activeDeadlineSeconds: 900
      backoffLimit: 1
      parallelism: 1
      template:
        metadata:
          labels:
            env: test
        spec:
          containers:
          - args:
            - kubectl -n test-namespace patch statefulset test-statefulset -p '{"spec":{"replicas":0}}'
            - kubectl -n test-namespace patch statefulset test-statefulset -p '{"spec":{"replicas":1}}'
            command:
            - /bin/sh
            - -c
            image: bitnami/kubectl
          restartPolicy: Never
          serviceAccountName: test-serviceaccount
  schedule: '*/5 * * * *'
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  suspend: false

已完成的调试步骤 #

• 确认Pod与ServiceAccount关联正常，CronJob启动的Pod上挂载的Secret名称正确。
• 使用更简单的Role（apiGroups设为""即所有核心组）尝试在Pod中执行"get pods"操作，仍出现相同错误。

Role与RoleBinding详情 #

Role详情 #

Name:         test-role
Labels:       env=test
Annotations:  <none>
PolicyRule:
  Resources             Non-Resource URLs  Resource Names   Verbs
  ---------             -----------------  --------------   -----
  statefulsets.apps/v1  []                 [test-statefulset]  [patch]

RoleBinding详情 #

Name:         test-binding
Labels:       env=test
Annotations:  <none>
Role:
  Kind:  Role
  Name:  test-role
Subjects:
  Kind            Name                Namespace
  ----            ----                ---------
  ServiceAccount  test-serviceaccount  test-namespace

解决方案 #

1. 修正Role的API组配置 #

Role中apiGroups字段填写错误，应使用API组名apps而非带版本的apps/v1。API组和版本是独立定义的，正确写法为将apiGroups设为["apps"]。

2. 添加get权限 #

kubectl patch操作会先执行get请求获取资源当前状态，因此必须给Role添加get动词，否则会触发权限拒绝错误。

3. 修正CronJob的YAML语法错误 #

CronJob的metadata.name字段存在语法错误（name:test-job缺少空格），需修正为name: test-job，避免YAML解析失败。

修正后的完整配置 #

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    env: test
  name: test-serviceaccount
  namespace: test-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    env: test
  name: test-role
  namespace: test-namespace
rules:
- apiGroups:
  - apps
  resourceNames:
  - test-statefulset
  resources:
  - statefulsets
  verbs:
  - get
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    env: test
  name: test-binding
  namespace: test-namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-role
subjects:
- kind: ServiceAccount
  name: test-serviceaccount
  namespace: test-namespace
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  labels:
    env: test
  name: test-job
  namespace: test-namespace
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  jobTemplate:
    metadata:
      labels:
        env: test
    spec:
      activeDeadlineSeconds: 900
      backoffLimit: 1
      parallelism: 1
      template:
        metadata:
          labels:
            env: test
        spec:
          containers:
          - args:
            - kubectl -n test-namespace patch statefulset test-statefulset -p '{"spec":{"replicas":0}}'
            - kubectl -n test-namespace patch statefulset test-statefulset -p '{"spec":{"replicas":1}}'
            command:
            - /bin/sh
            - -c
            image: bitnami/kubectl
          restartPolicy: Never
          serviceAccountName: test-serviceaccount
  schedule: '*/5 * * * *'
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  suspend: false

内容的提问来源于stack exchange，提问作者Abhishek Malik