设置 Kubernetes Cronjob：无法在命名空间“staging”

问题描述

我尝试设置一个 cron 作业来修补水平 pod 自动缩放器，但该作业返回 horizontalpodautoscalers.autoscaling "my-web-service" is forbidden: User "system:serviceaccount:staging:sa-cron-runner" cannot get resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "staging"

我已尝试如下设置所有角色权限：

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
Metadata:
  namespace: staging
  name: cron-runner
rules:
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["patch"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
Metadata:
  name: cron-runner
  namespace: staging
subjects:
- kind: ServiceAccount
  name: sa-cron-runner
  namespace: staging
roleRef:
  kind: Role
  name: cron-runner
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: v1
kind: ServiceAccount
Metadata:
  name: sa-cron-runner
  namespace: staging
---

apiVersion: batch/v1beta1
kind: CronJob
Metadata:
  name: scale-up-job
  namespace: staging
spec:
  schedule: "16 20 * * 1-6"
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: sa-cron-runner
          containers:
          - name: scale-up-job
            image: bitnami/kubectl:latest
            command:
            - /bin/sh
            - -c
            - kubectl patch hpa my-web-service --patch '{\"spec\":{\"minReplicas\":6}}'
          restartPolicy: OnFailure

kubectl auth can-i patch horizontalpodautoscalers -n staging --as sa-cron-runner 也返回 no，因此无法正确设置权限。

我该如何调试？我看不出这是如何错误设置的

解决方法

我认为问题在于cronjob需要先获取资源，然后Patch相同。因此，您需要在 get 规范中明确指定对 Role 的权限。

该错误还提到了获取资源的身份验证问题：

horizontalpodautoscalers.autoscaling "my-web-service" is forbidden: User "system:serviceaccount:staging:sa-cron-runner" cannot get resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "staging"

尝试将 verbs 的 Role 部分修改为：

verbs: ["patch","get"]

您还可以根据在 cronjob 中运行的脚本中的要求包含 list 和 watch。

kubernetes kubernetes-cronjob roles