Kubernetes 服务帐户角色绑定不适用于API访问

我正在开发与Kubernetes交互的工具。我使用允许所有身份验证提供程序设置了OpenShift。我可以像预期的那样登录到web控制台

我还可以设置一个服务帐户，并将集群角色绑定分配给服务帐户用户。尽管如此，当我使用该服务帐户的令牌访问RESTAPI时，我被禁止

以下是我尝试通过OpenShift命令设置角色绑定时发生的情况：

[root@host1 ~]# oadm policy add-cluster-role-to-user view em7 --namespace=default
[root@host1 ~]# oadm policy add-cluster-role-to-user cluster-admin em7 --namespace=default
[root@host1 ~]# oadm policy add-cluster-role-to-user cluster-reader em7 --namespace=default


[root@host1 ~]# oc get secrets | grep em7
em7-dockercfg-hnl6m         kubernetes.io/dockercfg               1         18h
em7-token-g9ujh             kubernetes.io/service-account-token   4         18h
em7-token-rgsbz             kubernetes.io/service-account-token   4         18h


TOKEN=`oc describe secret em7-token-g9ujh | grep token: | awk '{ print $2 }'`


[root@host1 ~]# curl -kD - -H "Authorization: Bearer $TOKEN" https://localhost:8443/api/v1/pods
HTTP/1.1 403 Forbidden
Cache-Control: no-store
Content-Type: application/json
Date: Tue, 19 Jun 2018 15:36:40 GMT
Content-Length: 260

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "User \"system:serviceaccount:default:em7\" cannot list all pods in the cluster",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403
}

我还可以尝试从（）使用yaml文件： #创建服务帐户“ns reader” 版本：v1 种类：服务帐户 元数据： 名称：ns阅读器 名称空间：默认值

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: global-reader
rules:
- apiGroups: [""]
  # add other rescources you wish to read
  resources: ["pods", "secrets"]
  verbs: ["get", "watch", "list"]

---
# This cluster role binding allows service account "ns-reader" to read pods in all available namespace
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-ns
subjects:
- kind: ServiceAccount
  name: ns-reader
  namespace: default
roleRef:
  kind: ClusterRole
  name: global-reader
  apiGroup: rbac.authorization.k8s.io

当我运行此操作时，会出现以下错误：

[root@host1 ~]# kubectl create -f stack_overflow_49667238.yaml
error validating "stack_overflow_49667238.yaml": error validating data: API version "rbac.authorization.k8s.io/v1" isn't supported, only supports API versions ["federation/v1beta1" "v1" "authentication.k8s.io/v1beta1" "componentconfig/v1alpha1" "policy/v1alpha1" "rbac.authorization.k8s.io/v1alpha1" "apps/v1alpha1" "authorization.k8s.io/v1beta1" "autoscaling/v1" "extensions/v1beta1" "batch/v1" "batch/v2alpha1"]; if you choose to ignore these errors, turn validation off with --validate=false

---

我从列表中尝试了几个不同的API版本，但它们都以类似的方式失败。

oadm策略将群集角色添加到用户视图em7授予名为

em7

您需要向服务帐户授予权限，例如，

oadm策略将群集角色添加到用户视图系统：servicecomport:default:em7

另请阅读以了解为应用程序启用restapi访问的详细信息。