jialinz
1. 检查现有权限
首先，检查当前服务账户的权限，确认是否缺少必要的权限
kubectl auth can-i get deployments --as=system:serviceaccount:kubesphere-devops-worker:default -n paas
如果返回 no，说明权限不足。
2. 创建或更新 Role 和 RoleBinding
您需要为服务账户创建或更新一个 Role（角色），并将其绑定到服务账户。以下是一个示例 Role 和 RoleBinding 的配置
创建 Role
创建一个 Role，授予对 deployments 的访问权限：
vi deployment-reader.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: paas
name: deployment-reader
rules:
- apiGroups: ["apps"]
resources:
- '*'
verbs:
- '*'
kubectl apply -f deployment-reader.yaml
创建 RoleBinding
将 Role 绑定到服务账户：
vi deployment-reader-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: deployment-reader-binding
namespace: paas
subjects:
- kind: ServiceAccount
name: default
namespace: kubesphere-devops-worker
roleRef:
kind: Role
name: deployment-reader
apiGroup: rbac.authorization.k8s.io
kubectl apply -f deployment-reader-binding.yaml
3. 验证权限
再次检查权限是否生效：
kubectl auth can-i get deployments --as=system:serviceaccount:kubesphere-devops-worker:default -n paas
