如何确定任何给定资源属于哪个apiGroup
?
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
namespace: default
name: thing
rules:
- apiGroups: ["<wtf goes here>"]
resources: ["deployments"]
verbs: ["get", "list"]
resourceNames: []
如何确定任何给定资源属于哪个apiGroup
?
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
namespace: default
name: thing
rules:
- apiGroups: ["<wtf goes here>"]
resources: ["deployments"]
verbs: ["get", "list"]
resourceNames: []
获取适用于您的 Kubernetes 集群的 API 资源:
kubectl api-resources -o wide
example:
NAME SHORTNAMES APIGROUP NAMESPACED KIND VERBS
deployments deploy apps true Deployment [create delete deletecollection get list patch update watch]
deployments deploy extensions true Deployment [create delete deletecollection get list patch update watch]
获取由您的Kubernetes集群支持的API版本:
kubectl api-versions
您可以验证例如部署:
kubectl explain deploy
KIND: Deployment
VERSION: extensions/v1beta1
DESCRIPTION:
DEPRECATED - This group version of Deployment is deprecated by
apps/v1beta2/Deployment.
此外,您可以使用api版本进行调查:
kubectl explain deploy --api-version apps/v1
你可以在 apiGroups 中指定:
apiGroups: ["extensions", "apps"]
您也可以通过在 kube-apiserver 中传递选项来配置群集的这些设置(例如测试是否与下一个 1.16 发布版 兼容),使用 --runtime-config
。
其他资源:
kubectl api-resources -o wide
提供了系统支持的API资源。
[suresh.vishnoi@xxx1309 ~]$ kubectl api-resources -o wide
NAME SHORTNAMES APIGROUP NAMESPACED KIND VERBS
bindings true Binding [create]
componentstatuses cs false ComponentStatus [get list]
configmaps cm true ConfigMap [create delete deletecollection get list patch update watch]
endpoints ep true Endpoints [create delete deletecollection get list patch update watch]
events ev true Event [create delete deletecollection get list patch update watch]
controllerrevisions apps true ControllerRevision [create delete deletecollection get list patch update watch]
daemonsets ds apps true DaemonSet [create delete deletecollection get list patch update watch]
deployments deploy apps true Deployment [create delete deletecollection get list patch update watch]
replicasets rs apps true ReplicaSet [create delete deletecollection get list patch update watch]
kubectl api-resources -o wide | grep -i deployment
将提供相关信息。
apps是deployment资源的apiGroup。
从v1.16开始,DaemonSet、Deployment、StatefulSet和ReplicaSet将不再从extensions/v1beta1、apps/v1beta1或apps/v1beta2中提供服务。请迁移到apps/v1 API,该API自v1.9起可用。现有的持久化数据可以通过apps/v1 API检索/更新。/api-deprecations-in-1-16
apiGroups
字段中使用吗?k api-resources -o wide | grep -i deployment
deployments deploy apps true Deployment [create delete deletecollection get list patch update watch]
deployments
- Cole BittelAPIGROUP
中,deployments
列出了extensions
和apps
两个选项。那我该选择哪一个?我怎么知道该选择哪一个? - Cole Bittelkubectl version --short
- Suresh Vishnoiapigroup
已被弃用,命令kubectl api-resources -o wide
将显示apiversion
,它是apigroup/version
的组合。因此,在部署从扩展 API 组中删除之前,您必须在角色中使用两个 API 组。
这些信息包含在在线 API 文档中。
在您的示例中,如果您点击并找到Role的文档,它会在侧边栏(“Role v1 rbac.authorization.k8s.io”)和实际 API 文档的第一行中列出组和版本。同样,Deployment位于组“apps”中,版本为“v1”。
在角色规范中,您只需放置组即可,它适用于所有版本。因此,要控制对 Deployments 的访问权限,您需要指定 apiGroups: [apps], resources: [deployments]
。(这实际上是 RBAC 文档中的一个示例。)
rbac.authorization.k8s.io
放在问题所在的 <wtf goes here>
位置。如果是这样,那就是不正确的。 - Cole BittelapiGroups:
值的具体提及。 - David Maze您可以运行以下命令获取apiVersion和其他详细信息。
kubectl explain <Resource Name>
kubectl explain deployment