Menu Close

Red Hat Training

A Red Hat training course is available for OpenShift Container Platform

16.3.2. 创建集群角色

配置 descheduler 在 pod 中正常工作所需的权限:

  1. 使用以下规则创建 集群角色

    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: descheduler-cluster-role
    rules:
    - apiGroups: [""]
      resources: ["nodes"]
      verbs: ["get", "watch", "list"] 1
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["get", "watch", "list", "delete"] 2
    - apiGroups: [""]
      resources: ["pods/eviction"] 3
      verbs: ["create"]
    1
    配置该角色以允许查看节点。
    2
    配置该角色以允许查看和删除容器集。
    3
    允许节点驱除绑定到其自身的 pod。
  2. 创建用于运行作业 的服务帐户

    # oc create sa <file-name>.yaml -n kube-system

    例如:

    # oc create sa descheduler-sa.yaml -n kube-system
  3. 将集群角色绑定到服务帐户:

    # oc create clusterrolebinding descheduler-cluster-role-binding \
        --clusterrole=<cluster-role-name> \
        --serviceaccount=kube-system:<service-account-name>

    例如:

    # oc create clusterrolebinding descheduler-cluster-role-binding \
        --clusterrole=descheduler-cluster-role \
        --serviceaccount=kube-system:descheduler-sa