Jenkins 管道 k8s 部署失败

Question

我正在尝试将我的应用程序部署到 EKS 集群中。当我在运行 jenkins 工作时，当我尝试通过 jenkins 部署 yaml 文件时，我可以同时获得 kubectl get pod 状态的运行详细信息，但出现以下错误：

+ kubectl create -f deployment.yaml
Error from server (Forbidden): error when creating "deployment.yaml": deployments.apps is forbidden: User "system:node:ip-10-2-3-4.eu-central-1.compute.internal" cannot create resource "deployments" in API group "apps" in the namespace "default"

创建 pod

+ kubectl '--kubeconfig=****' '--context=arn:aws:eks:eu-central-1:123456789101:cluster/my-cluster' sh "kubectl auth can-i list pods"
yes

创建部署

+ kubectl '--kubeconfig=****' '--context=arn:aws:eks:eu-central-1:123456789101:cluster/my-cluster' sh "kubectl auth can-i create deployment"
no

Answer 1

所以这意味着您拥有 read/list pods 数据的权限，但没有创建 deployment 对象的权限。

下面是2个例子，检查比较。

第一个只是阅读规则（你目前拥有的）

rules:
- apiGroups: [""]
  #
  # at the HTTP level, the name of the resource for accessing Pod
  # objects is "pods"
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

第二个是部署创建权限 (verbs: ["**create**"])。很可能你错过了这部分

rules:
- apiGroups: ["extensions", "apps"]
  #
  # at the HTTP level, the name of the resource for accessing Deployment
  # objects is "deployments"
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

更多选项、示例和解释请查看Using RBAC Authorization

Jenkins 管道 k8s 部署失败

Jenkins pipeline k8s deployment failed

kubernetes

amazon-eks