kubernetes forbidden: User "system:node:10.39.30.116" cannot list resource "secrets" in API group ""

た入场券 2022-04-23 08:46 40阅读 0赞

**系统**

[root@k8s-119 opt]# cat /etc/redhat-release 
    CentOS Linux release 7.6.1810 (Core)

**kubernetes 版本**

[root@k8s-116 opt]# kubectl version --short 
    Client Version: v1.13.1
    Server Version: v1.13.1

**docker版本**

[root@k8s-116 opt]# docker version 
    Client:
     Version:           18.09.1
     API version:       1.39
     Go version:        go1.10.6
     Git commit:        4c52b90
     Built:             Wed Jan  9 19:35:01 2019
     OS/Arch:           linux/amd64
     Experimental:      false
    
    Server: Docker Engine - Community
     Engine:
      Version:          18.09.1
      API version:      1.39 (minimum version 1.12)
      Go version:       go1.10.6
      Git commit:       4c52b90
      Built:            Wed Jan  9 19:06:30 2019
      OS/Arch:          linux/amd64
      Experimental:     false

**相关日志**  
![kubernetes][]

1月 29 18:07:53 k8s-119 kubelet[2085]: E0129 18:07:53.109599    2085 reflector.go:134] object-"kube-system"/"kube-proxy-token-4jz44": Failed to list *v1.Secret: secrets "kube-proxy-token-4jz44" is forbidden: User "system:node:10.39.30.116" cannot list resource "secrets" in API group "" in the namespace "kube-system": no path found to object
    1月 29 18:07:54 k8s-119 kubelet[2085]: E0129 18:07:54.111998    2085 reflector.go:134] object-"kube-system"/"kube-proxy-token-4jz44": Failed to list *v1.Secret: secrets "kube-proxy-token-4jz44" is forbidden: User "system:node:10.39.30.116" cannot list resource "secrets" in API group "" in the namespace "kube-system": no path found to object
    1月 29 18:07:55 k8s-119 kubelet[2085]: E0129 18:07:55.114409    2085 reflector.go:134] object-"kube-system"/"kube-proxy-token-4jz44": Failed to list *v1.Secret: secrets "kube-proxy-token-4jz44" is forbidden: User "system:node:10.39.30.116" cannot list resource "secrets" in API group "" in the namespace "kube-system": no path found to object
    1月 29 18:07:56 k8s-119 kubelet[2085]: E0129 18:07:56.116680    2085 reflector.go:134] object-"kube-system"/"kube-proxy-token-4jz44": Failed to list *v1.Secret: secrets "kube-proxy-token-4jz44" is forbidden: User "system:node:10.39.30.116" cannot list resource "secrets" in API group "" in the namespace "kube-system": no path found to object
    1月 29 18:07:57 k8s-119 kubelet[2085]: E0129 18:07:57.118871    2085 reflector.go:134] object-"kube-system"/"kube-proxy-token-4jz44": Failed to list *v1.Secret: secrets "kube-proxy-token-4jz44" is forbidden: User "system:node:10.39.30.116" cannot list resource "secrets" in API group "" in the namespace "kube-system": no path found to object
    1月 29 18:07:58 k8s-119 kubelet[2085]: E0129 18:07:58.121223    2085 reflector.go:134] object-"kube-system"/"kube-proxy-token-4jz44": Failed to list *v1.Secret: secrets "kube-proxy-token-4jz44" is forbidden: User "system:node:10.39.30.116" cannot list resource "secrets" in API group "" in the namespace "kube-system": no path found to object

**解决办法**  
通过clusterrolebinding绑定system:nodes组到system:node这个clusterrole就可以了

kubectl create clusterrolebinding system-node-role-bound --clusterrole=system:node --group=system:nodes

参考:  
[rbac][]

[kubernetes]: /images/20220322/53326771207a4d98bcb1c1802e067d00.png
[rbac]: https://kubernetes.io/docs/reference/access-authn-authz/rbac/