Fehler beim Aushandeln einer API-Version bei Verwendung des Kubernetes RBAC-Autorisierungs-Plugins

Question

Ich folgte der Anweisung in reference document. Ich habe eine ClusterRole namens "admin-roles" erstellt, die Administratorrechte gewährt, und die Rolle an den Benutzer "tester" gebunden.

In K8S Master:

# curl localhost:8080/apis/rbac.authorization.k8s.io/v1alpha1/clusterroles 
{ 
    "kind": "ClusterRoleList", 
    "apiVersion": "rbac.authorization.k8s.io/v1alpha1", 
    "metadata": { 
    "selfLink": "/apis/rbac.authorization.k8s.io/v1alpha1/clusterroles", 
    "resourceVersion": "480750" 
    }, 
    "items": [ 
    { 
     "metadata": { 
     "name": "admins-role", 
     "selfLink": "/apis/rbac.authorization.k8s.io/v1alpha1/clusterroles/admins-role", 
     "uid": "88a58ac6-471a-11e6-9ad4-52545f942a3b", 
     "resourceVersion": "479484", 
     "creationTimestamp": "2016-07-11T03:49:56Z" 
     }, 
     "rules": [ 
     { 
      "verbs": [ 
      "*" 
      ], 
      "attributeRestrictions": null, 
      "apiGroups": [ 
      "*" 
      ], 
      "resources": [ 
      "*" 
      ] 
     } 
     ] 
    } 

# curl localhost:8080/apis/rbac.authorization.k8s.io/v1alpha1/clusterrolebindings 
{ 
    "kind": "ClusterRoleBindingList", 
    "apiVersion": "rbac.authorization.k8s.io/v1alpha1", 
    "metadata": { 
    "selfLink": "/apis/rbac.authorization.k8s.io/v1alpha1/clusterrolebindings", 
    "resourceVersion": "480952" 
    }, 
    "items": [ 
    { 
     "metadata": { 
     "name": "bind-admin", 
     "selfLink": "/apis/rbac.authorization.k8s.io/v1alpha1/clusterrolebindings/bind-admin", 
     "uid": "c53bbc34-471a-11e6-9ad4-52545f942a3b", 
     "resourceVersion": "479632", 
     "creationTimestamp": "2016-07-11T03:51:38Z" 
     }, 
     "subjects": [ 
     { 
      "kind": "User", 
      "name": "tester" 
     } 
     ], 
     "roleRef": { 
     "kind": "ClusterRole", 
     "name": "admins-role", 
     "apiVersion": "rbac.authorization.k8s.io/v1alpha1" 
     } 
    } 

Aber wenn kubectl get pods mit 'Tester' als Benutzer ausgeführt:

error: failed to negotiate an api version; server supports: map[], client supports: map[extensions/v1beta1:{} authentication.k8s.io/v1beta1:{} autoscaling/v1:{} batch/v1:{} federation/v1alpha1:{} v1:{} apps/v1alpha1:{} componentconfig/v1alpha1:{} policy/v1alpha1:{} rbac.authorization.k8s.io/v1alpha1:{} authorization.k8s.io/v1beta1:{} batch/v2alpha1:{}] 

Answer 1

Sie können nicht die Entdeckung API getroffen. Aktualisieren Sie Ihre ClusterRole, um "nonResourceURLs": ["*"] einzuschließen.

kind: ClusterRole 
apiVersion: rbac.authorization.k8s.io/v1alpha1 
metadata: 
    name: admins-role 
rules: 
    - apiGroups: ["*"] 
    resources: ["*"] 
    verbs: ["*"] 
    nonResourceURLs: ["*"]