kubernetes - “服务被禁止：用户 \"system:serviceaccount:tick:external-dns\" 无法在集群范围内列出 API 组 \"\" 中的资源 \"services\"”

Question

我一直在按照演练为我的应用程序创建一个 AWS ALB 入口控制器，该控制器也部署在 EKS 集群上。
一切似乎都很好，与演练类似的答案，但是在设置外部 DNS 时，我得到了错误：

kubectl logs -f $(kubectl get po | egrep -o 'external-dns[A-Za-z0-9-]+')

time="2020-02-20T16:21:57Z" level=error msg="services is disabled: User \"system:serviceaccount:tick:external-dns\" cannot list resource \"services\" in API group \" \" 在集群范围内" time="2020-02-20T16:22:58Z" level=error msg="services is disabled: User \"system:serviceaccount:tick:external-dns\" cannot list resource \"services \" 在 API 组中 \"\" 在集群范围内"

每隔一分钟。我确保所有权限都是必需的，所以不应该是因为这个。

我从这里尝试了解决方案，但没有任何帮助，我找不到任何其他解决方案。

这个错误实际上意味着什么？我应该怎么做才能修复它？

更新编辑我的external-dns配置看起来像：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: external-dns
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::*my*account*id*:role/EKSRole
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: external-dns
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get","watch","list"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get","watch","list"]
- apiGroups: ["extensions"]
  resources: ["ingresses"]
  verbs: ["get","watch","list"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: external-dns-viewer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: external-dns
subjects:
- kind: ServiceAccount
  name: external-dns
  namespace: tick
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns
spec:
  selector:
    matchLabels:
      app: external-dns
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: external-dns
      annotations:
        iam.amazonaws.com/role: arn:aws:iam::*my*account*id*:role/EKSRole
    spec:
      serviceAccountName: external-dns
      containers:
      - name: external-dns
        image: registry.opensource.zalan.do/teapot/external-dns:v0.5.9
        args:
        - --source=service
        - --source=ingress
        - --domain-filter=external-dns-test.my-org.com   #external-dns-test.my-org.com # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
        - --provider=aws
        - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
        - --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
        - --registry=txt
        - --txt-owner-id=my-identifier
      securityContext:
        fsGroup: 65534

标签： kuberneteskubernetes-ingressaws-albexternal-dns

Answer 1

您的错误表明名称空间中的服务帐户external-dns无法tick执行某些操作。在这种情况下，它是列表服务。要解决此问题，您可以应用以下内容：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: external-dns
  namespace: tick
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: external-dns-role
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get","watch","list"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get","watch","list"]
- apiGroups: ["extensions"]
  resources: ["ingresses"]
  verbs: ["get","watch","list"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: external-dns-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: external-dns-role
subjects:
- kind: ServiceAccount
  name: external-dns
  namespace: tick

请注意，ClusterRole 中的第一条规则是授予正确权限以在“” apiGroup 中列出服务，这解决了您在问题中报告的错误。