Kubernetes 403权限问题求助：匿名用户无法列出集群命名空间

Hey there, let's work through this 403 issue you're facing! The error message makes it crystal clear: you're accessing the cluster as the system:anonymous user, which has no permissions to list namespaces (or most cluster resources, by default). Here's how to get this sorted:

1. First, confirm your kubeconfig setup #

Kubectl relies on a config file (usually located at ~/.kube/config) to authenticate to the cluster. If this file is missing, invalid, or has expired/invalid credentials, you'll automatically fall back to anonymous access.

• Check your current config details with:

  kubectl config view
  

• If you're working directly on the cluster's control plane node, the admin config (with full cluster permissions) lives at /etc/kubernetes/admin.conf. Test it directly to confirm it works:

  kubectl --kubeconfig=/etc/kubernetes/admin.conf get pods --all-namespaces
  

  If this command succeeds, your issue is definitely tied to your local kubeconfig setup.

2. Create a dedicated user with proper permissions #

If you don't have access to the admin config, or need a restricted non-admin user, let's create a ServiceAccount and bind it to a role with the exact permissions you need:

Step 1: Create a ServiceAccount #

We'll make one in the default namespace (feel free to use any namespace you prefer):

kubectl create serviceaccount my-cluster-user --namespace=default

Step 2: Bind the ServiceAccount to a ClusterRole #

Choose a role based on your use case:

• For read-only access across the cluster (safe for most day-to-day tasks):

  kubectl create clusterrolebinding my-user-view-access \
    --clusterrole=view \
    --serviceaccount=default:my-cluster-user
  

• For full admin access (only use this if you fully trust the user—this grants unlimited cluster access!):

  kubectl create clusterrolebinding my-user-admin-access \
    --clusterrole=cluster-admin \
    --serviceaccount=default:my-cluster-user
  

Step 3: Fetch the ServiceAccount token and update your kubeconfig #

First, grab the secret that holds the user's authentication token:

SECRET_NAME=$(kubectl get serviceaccount my-cluster-user --namespace=default -o jsonpath='{.secrets[0].name}')
TOKEN=$(kubectl get secret $SECRET_NAME --namespace=default -o jsonpath='{.data.token}' | base64 --decode)

Then add this user to your local kubeconfig:

# Store the new user's credentials
kubectl config set-credentials my-cluster-user --token=$TOKEN

# Create a new context using this user
kubectl config set-context my-user-context --cluster=kubernetes --user=my-cluster-user

# Switch to the new authenticated context
kubectl config use-context my-user-context

3. Verify your authentication status #

After setting this up, confirm you're no longer accessing the cluster anonymously:

# Check your current active context
kubectl config current-context

# Check which user you're authenticated as
kubectl whoami

You should see your new username (not system:anonymous). Now run kubectl get pods --all-namespaces again—it should work without the 403 error!

4. For cloud-managed clusters (EKS, GKE, AKS) #

If you're using a cloud provider's Kubernetes service, you might just need to refresh your credentials via the cloud CLI:

• EKS: aws eks update-kubeconfig --region <your-region> --name <cluster-name>
• GKE: gcloud container clusters get-credentials <cluster-name> --region <your-region>
• AKS: az aks get-credentials --resource-group <rg-name> --name <cluster-name>

Quick best practice note #

Avoid granting cluster-admin access unless it's absolutely necessary. For most scenarios, using the built-in view role or creating a custom ClusterRole with only the specific permissions you need is far more secure.

内容的提问来源于stack exchange，提问作者eddeddy7