CKAD-CN考试之路----10

1. 题目

您必须连接到正确的主机。不这样做可能导致零分。
[candidate@base] $ ssh ckad00028
Task
在名为 honeybee-deployment 的 Deployment 和 namespace gorilla 中的一个 Pod 正在记录错误.
1 查看日志以识别错误消息。
找出错误， 包括 User “system:serviceaccount:gorilla:default ”cannot list resource “serviceaccounts” […] in the namespace “gorilla”
2 更新 Deployment honeybee-deployment 以解决 Pod 日志中的错误。
您可以在/ckad/prompt-escargot/honeybee-deployment.yaml 中找到 honeybee-deployment 的清单文件

2. 解题

1. 登录环境 这步切勿忘记 否则可能做了也没分

ssh ckad00028

2. 查看错误信息

candidate@master01:~$ kubectl get pods -n gorilla 
NAME                                   READY   STATUS    RESTARTS         AGE
honeybee-deployment-58f59d4bf9-z6zkm   1/1     Running   12 (4h37m ago)   187d
candidate@master01:~$ kubectl logs -n gorilla honeybee-deployment-58f59d4bf9-z6zkm | tail -3
Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:gorilla:default" cannot list resource "serviceaccounts" in API group "" in the namespace "gorilla"
2025-09-08 05:35:11+00:00
Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:gorilla:default" cannot list resource "serviceaccounts" in API group "" in the namespace "gorilla"

错误表明当前使用的 ServiceAccount system:serviceaccount:gorilla:default（即命名空间 gorilla下的默认 ServiceAccount）没有权限（forbidden） 在 gorilla命名空间中 列出（list）serviceaccounts资源。

就是默认的 ServiceAccount 没有被授予在 gorilla命名空间中列出其他 ServiceAccount 的权限。

再确认下gorilla命名空间下有哪些sa

candidate@master01:~$ kubectl get sa -n gorilla 
NAME         SECRETS   AGE
boxweb-sa    0         187d
default      0         187d
gorilla-sa   0         187d

查看role

candidate@master01:~$ kubectl describe role -n gorilla  boxweb-role 
Name:         boxweb-role
Labels:       <none>
Annotations:  <none>
PolicyRule:Resources         Non-Resource URLs  Resource Names  Verbs---------         -----------------  --------------  -----pods              []                 []              [watch]serviceaccounts   []                 []              [watch]deployments.apps  []                 []              [watch]
candidate@master01:~$ kubectl describe role -n gorilla  gorilla-role 
Name:         gorilla-role
Labels:       <none>
Annotations:  <none>
PolicyRule:Resources         Non-Resource URLs  Resource Names  Verbs---------         -----------------  --------------  -----pods              []                 []              [get list]serviceaccounts   []                 []              [get list]deployments.apps  []                 []              [get list]

显然gorilla-role 是有权限去get 和list serviceaccounts的

再次确认gorilla-role被绑定到了gorilla-sa

candidate@master01:~$ kubectl get rolebindings.rbac.authorization.k8s.io -n gorilla gorilla-rolebinding 
NAME                  ROLE                AGE
gorilla-rolebinding   Role/gorilla-role   187d
candidate@master01:~$ kubectl describe rolebindings.rbac.authorization.k8s.io -n gorilla gorilla-rolebinding 
Name:         gorilla-rolebinding
Labels:       <none>
Annotations:  <none>
Role:Kind:  RoleName:  gorilla-role
Subjects:Kind            Name        Namespace----            ----        ---------ServiceAccount  gorilla-sa  gorilla

3. 将gorilla-sa 绑定给 honeybee-deployment

kubectl -n gorilla set serviceaccount deployment/honeybee-deployment gorilla-sa

这条命令如果不记得可以用-h获得帮助

candidate@master01:~$ kubectl -n gorilla set serviceaccount -h
Update the service account of pod template resources.Possible resources (case insensitive) can be:replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs), statefulsetAliases:
serviceaccount, saExamples:# Set deployment nginx-deployment's service account to serviceaccount1kubectl set serviceaccount deployment nginx-deployment serviceaccount1

执行没错误就可以.

3. 验证

1. 等待pod更新完毕

candidate@master01:~$ kubectl get pods -n gorilla 
NAME                                   READY   STATUS    RESTARTS   AGE
honeybee-deployment-5bcd579f9f-ffrcd   1/1     Running   0          3m10s

2. 确认是否还有错误日志

candidate@master01:~$ kubectl logs -n gorilla honeybee-deployment-5bcd579f9f-ffrcd | tail -4
NAME         SECRETS   AGE
boxweb-sa    0         187d
default      0         187d
gorilla-sa   0         187d

3. 确认logs里是否还有其他错误,没有返回就是正常

candidate@master01:~$ kubectl logs -n gorilla honeybee-deployment-5bcd579f9f-ffrcd | grep -i error
candidate@master01:~$ 

4. 测试脚本

#!/bin/bash# Get the ServiceAccount name used by the 'honeybee-deployment' in namespace 'gorilla'
DEPLOY_SA=$(kubectl get deployments.apps -n gorilla honeybee-deployment -o jsonpath='{.spec.template.spec.serviceAccount}')# Get the name of the last pod in the 'gorilla' namespace (assumes 'tail -1' gets the newest)
POD_NAME=$(kubectl get pods -n gorilla | tail -1 | awk '{print $1}')# Count the number of lines containing 'error' (case-insensitive) in the logs of the last pod
ERROR_LOGS=$(kubectl logs -n gorilla $POD_NAME | grep -i error | wc -l)# Check if the deployment is using the expected ServiceAccount 'gorilla-sa'
[ "$DEPLOY_SA" = "gorilla-sa" ] && echo 1/2 success || echo 1/2 error# Check if there are no error logs in the pod
[ $ERROR_LOGS -eq 0 ] && echo 2/2 success || echo 2/2 error

3. 授权并测试脚本

candidate@master01:~$ chmod +x check10.sh 
candidate@master01:~$ ./check10.sh
1/2 success
2/2 success

4. 退出 此步务必记得,否则可能影响后续做题

exit