主页 / server / 问题 / 1043177
Accepted
Zama Ques
Asked: 2020-11-20 02:41:56 +0800 CST

Velero 安装从 GCP 中的 VM 主机失败

  • 772

我正在尝试使用 以下步骤安装velero在GKE ClusterGCP Compute Engine Host

https://github.com/vmware-tanzu/velero-plugin-for-gcp

我正在使用以下命令velero从VM主机安装

 velero install --provider gcp --plugins velero/velero-plugin-for-gcp:v1.1.0 --bucket ${VELEROBUCKET} --secret-file ./credentials-velero

但它失败并出现以下错误

Error installing Velero. Use `kubectl logs deploy/velero -n velero` to check the deploy logs:
Error creating resource ClusterRoleBinding/velero: clusterrolebindings.rbac.authorization.k8s.io is forbidden: 
User "116865650821658545991" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s)

为了解决这个错误，我正在尝试这个

  kubectl create clusterrolebinding cluster-admin-binding --clusterrole cluster-admin --user velero

但这也因以下错误而失败

error: failed to create clusterrolebinding: clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "116865650821658545991" cannot create resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoleBindings.create"] permission(s).

上述场景的两个查询

  1. clusterrolebinding创建资源来解决我在安装时看到的错误是否正确velero？

  2. 如何识别第二个错误中看到的“116865650821658545991”的相应用户以及需要分配什么角色来创建clusterrolebinding资源？

google-cloud-platform google-kubernetes-engine google-iam

1 个回答

  1. Best Answer

    现在解决了。

    我确定了使用的服务VM帐户

       $ gcloud config list
   [core]
   account = [email protected]

    之后，我们将角色“Kubernetes Engine Admin”分配给上面Service account并velero使用以下命令成功安装

    VELERO_BUCKET=gkevelerobackup
velero install --provider gcp --plugins velero/velero-plugin-for-gcp:v1.1.0 --bucket ${VELEROBUCKET} --secret-file ./credentials-velero
    • 1

相关问题