k8s部署springcloud服务，使用k8s作为注册中心一些问题总结

启动报错

Description:

Parameter 2 of method configurationUpdateStrategy in org.springframework.cloud.kubernetes.config.reload.ConfigReloadAutoConfiguration$ConfigReloadAutoConfigurationBeans required a bean of type 'org.springframework.cloud.context.restart.RestartEndpoint' that could not be found.

The following candidates were found but could not be injected:
    - Bean method 'restartEndpoint' in 'RestartEndpointWithIntegrationConfiguration' not loaded because @ConditionalOnEnabledEndpoint no property management.endpoint.restart.enabled found so using endpoint default
    - Bean method 'restartEndpointWithoutIntegration' in 'RestartEndpointWithoutIntegrationConfiguration' not loaded because @ConditionalOnMissingClass found unwanted class 'org.springframework.integration.monitor.IntegrationMBeanExporter'

原因：
查看ConfigReloadAutoConfiguration$configurationUpdateStrategy，注入了RestartEndpoint,由于没有设置该端点，注入失败；在1.0.4版本添加了@Autowired(required = false)

image

解决方案1
添加配置

management:
  endpoint:
    restart:
      enabled: true

解决方案2（推荐）
升级spring-cloud-starter-kubernetes-all版本到1.0.4及以上

将spring-cloud-kubernetes部署到k8s中，此时访问服务列表会报以下错误

Failure executing: GET at: https://10.96.0.1/api/v1/namespaces/default/services. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. services is forbidden: User "system:serviceaccount:default:default" cannot list resource "services" in API group "" in the namespace "default".

当前的system:serviceaccount账号是没有权限通过API server访问"services"资源的，此时最快的解决办法是提升账号权限：

kubectl create clusterrolebinding permissive-binding \
  --clusterrole=cluster-admin \
  --user=admin \
  --user=kubelet \
  --group=system:serviceaccounts

注意：以上办法只能用于开发和测试环境，不要用在生产环境，在生产环境应该参考Kubernetes的RBAC授权相关设置来处理。

在生产环境中可以创建一个拥有最小可读权限的角色，将账户绑定到该角色：

# 创建在pod只读角色
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader-cluster
rules:
  - apiGroups: [""] # "" 指定核心 API 组
    resources: ["pods","endpoints","services","configmaps"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
# 此角色绑定使得用户 "jane" 能够读取 "default" 命名空间中的 Pods
kind: ClusterRoleBinding
metadata:
  name: read-pods-cluster
subjects:
  - kind: Group
    name: system:serviceaccounts
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole #this must be Role or ClusterRole
  name: pod-reader-cluster # 这里的名称必须与你想要绑定的 Role 或 ClusterRole 名称一致
  apiGroup: rbac.authorization.k8s.io

最后编辑于：2020.10.14 15:52:23