![如何使用服务账户在 Kubernetes 中部署对象(部署、配置图等)](https://linux22.com/image/785632/%E5%A6%82%E4%BD%95%E4%BD%BF%E7%94%A8%E6%9C%8D%E5%8A%A1%E8%B4%A6%E6%88%B7%E5%9C%A8%20Kubernetes%20%E4%B8%AD%E9%83%A8%E7%BD%B2%E5%AF%B9%E8%B1%A1%EF%BC%88%E9%83%A8%E7%BD%B2%E3%80%81%E9%85%8D%E7%BD%AE%E5%9B%BE%E7%AD%89%EF%BC%89.png)
我在 Azure devops 中有一个部署管道。我正在使用它来将一些对象部署到我们的 k8s 集群 (microk8s)。我借助使用 kube-config 的服务连接连接到集群。
现在我想转到使用环境。但是使用环境时,我无法使用服务连接,也无法使用 kube 配置,我必须使用一种称为服务帐户的东西。
我尝试添加服务帐户,但尝试连接时失败:
来自服务器的错误(BadRequest):服务器由于未知原因拒绝了我们的请求E0501 20:23:58.096274 11988 request.go:977] 读取响应正文时出现意外错误:读取 tcp 10.53.225.240:63434->10.161.64.124:16443:wsarecv:远程主机强制关闭现有连接。
我猜我没有正确设置服务帐户。以下是角色、服务帐户和角色绑定的 yaml:
apiVersion: v1
kind: ServiceAccount
metadata:
name: app1serviceaccount
namespace: elinstallation
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: elinstallation
name: pod-creator
rules:
- apiGroups: [""]
resources: ["*"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: pod-creator
namespace: elinstallation
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: pod-creator
subjects:
- kind: ServiceAccount
name: app1serviceaccount
namespace: elinstallation
还为服务帐户创建了一个秘密:
apiVersion: v1
kind: Secret
metadata:
name: app1serviceaccount-secret
namespace: elinstallation
annotations:
kubernetes.io/service-account.name: app1serviceaccount
type: kubernetes.io/service-account-token
然后我复制此命令的输出:
kubectl 获取机密 app1serviceaccount-secret -n elinstallation -o json
并将其粘贴到环境的 secret 字段中。输出如下所示:
{
"apiVersion": "v1",
"data": {
"ca.crt": "LS0tLxxxxS0tLS0tCg==",
"namespace": "ZWxpbnN0YWxsYXRpb24=",
"token": "ZXlKaGJxxxxx"
},
"kind": "Secret",
"metadata": {
"annotations": {
"kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Secret\",\"metadata\":{\"annotations\":{\"kubernetes.io/service-account.name\":\"app1serviceaccount\"},\"name\":\"app1serviceaccount-secret\",\"namespace\":\"elinstallation\"},\"type\":\"kubernetes.io/service-account-token\"}\n",
"kubernetes.io/service-account.name": "app1serviceaccount",
"kubernetes.io/service-account.uid": "0b62b400-a0a9-4b27-822b-05d12b1c0930"
},
"creationTimestamp": "2023-04-30T07:11:53Z",
"name": "app1serviceaccount-secret",
"namespace": "elinstallation",
"resourceVersion": "12050395",
"uid": "f3b6d9d3-be29-4a85-9ee2-8fe72fca1dd2"
},
"type": "kubernetes.io/service-account-token"
}
令我感到困惑的一件事是,输入以下命令时:
kubectl get serviceAccounts -n elinstallation
NAME SECRETS AGE
default 0 3d10h
elinstallation-serviceaccount 0 37h
app1serviceaccount 0 36h
test 0 8m46s
它说没有服务帐户有秘密。
我究竟做错了什么?
子问题,在 k8s(microk8s)中是否有某个地方我可以读取访问日志,以查看有关无法连接的更多详细信息?