时间戳

首页 > 解决方案 > 服务帐号无法与另一个项目中的 GKE 集群交互

kubernetes - 服务帐号无法与另一个项目中的 GKE 集群交互

问题描述

$SERVICE_ACCOUNT_A来自一个 Google Cloud Platform (GCP) 项目 ( $PROJECT_A)的服务帐户 ( )无法与$GKE_CLUSTER_B另一个 GCP 项目 ( $PROJECT_B) 中的 Google Kubernetes Engine (GKE) 集群 () 交互；在哪里：

$SERVICE_ACCOUNT_A$GKE_CLUSTER_B 尽管拥有角色以$PROJECT_B包含应允许它这样做的权限，但无法与它进行交互。

即，首先我创建了一个自定义角色$ROLE：

gcloud iam roles create $ROLE \
--description="$ROLE_DESCRIPTION" \
--permissions=container.clusters.get,container.clusters.list \
--project=$PROJECT_B \
--title='$ROLE_TITLE'

#=>

Created role [$ROLE].
description: $ROLE_DESCRIPTION
etag: . . .
includedPermissions:
- container.clusters.get
- container.clusters.list
name: projects/$PROJECT_B/roles/$ROLE
stage: . . .
title: $ROLE_TITLE

然后我将$ROLE, from $PROJECT_B, 与$SERVICE_ACCOUNT_A:

gcloud projects add-iam-policy-binding $PROJECT_B \
--member=serviceAccount:$SERVICE_ACCOUNT_A \
--role=projects/$PROJECT_B/roles/$ROLE

#=>

Updated IAM policy for project [$PROJECT_B].
auditConfigs:
. . .

我可以在$ROLE下面看到$SERVICE_ACCOUNT_A：

gcloud projects get-iam-policy $PROJECT_B \
--flatten='bindings[].members' \
--format='value(bindings.role)' \
--filter="bindings.members:${SERVICE_ACCOUNT_A}"

#=>

projects/$PROJECT_B/roles/$ROLE

具有适当的权限：

gcloud iam roles describe $ROLE \
--flatten='includedPermissions' \
--format='value(includedPermissions)' \
--project=$PROJECT_B

#=>

container.clusters.get
container.clusters.list

但仍然无法$SERVICE_ACCOUNT_A与之互动$GKE_CLUSTER_B。

为什么？

标签： kubernetesgoogle-cloud-platformgoogle-kubernetes-engineservice-accountsgoogle-iam

解决方案

即使没有或不需要 GKE 集群，您也需要启用 Kubernetes Engine API（在此处找到） 。$PROJECT_A$PROJECT_A

您可以通过为以下内容创建新的 JSON 密钥来确认这一点$SERVICE_ACCOUNT_A：

gcloud iam service-accounts keys create \
./some-key.json \
--iam-account="${SERVICE_ACCOUNT_A}" \
--key-file-type="json"

#=>

created key [$KEY_ID] of type [json] as [./some-key.json] for [$SERVICE_ACCOUNT_A]

激活服务帐户：

gcloud auth activate-service-account \
"${SERVICE_ACCOUNT_A}" \
--key-file=./some-key.json

#=>

Activated service account credentials for: [$SERVICE_ACCOUNT_A]

确认它是活跃的：

cloud auth list
                        Credentialed Accounts
ACTIVE  ACCOUNT
        . . .
*       $SERVICE_ACCOUNT_A
        your@account.user
        . . .

To set the active account, run:
    $ gcloud config set account `ACCOUNT`

并尝试与$GKE_CLUSTER_B：

gcloud container clusters list --project=$PROJECT_B

#=>

ERROR: (gcloud.container.clusters.list) ResponseError: code=403, message=Kubernetes Engine API has not
been used in project $PROJECT_A_ID before or it is disabled. Enable it by visiting
https://console.developers.google.com/apis/api/container.googleapis.com/overview?project=$PROJECT_A_ID
then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our
systems and retry.

其中$PROJECT_A_ID是形式的数字 id：xxxxxxxxxxxxx。

访问与403上述（此处）一起返回的地址并启用 Kubernetes Engine API。 $SERVICE_ACCOUNT_A 现在应该能够与 GKE 集群交互$PROJECT_B：

gcloud container clusters list \
--project=$PROJECT_B \
--format='value(name)

#=>

. . .
some_cluster
. . .

包括$GKE_CLUSTER_B.

推荐阅读