我有一个Azure Kubernetes集群，设置身份验证和授权设置为“Azure AD Authentication with Kubernetes Rbac”。我希望能够同时使用AAD进行身份验证，而且还可以使用集群中的常规服务帐户。
虽然它似乎在我的命名空间内工作，但看起来好像我不能授予服务帐户访问集群范围的资源：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dummy-admin
---
apiVersion: rbac.authorization.k8s.io/v1
# This cluster role binding allows anyone in the "manager" group to
# read secrets in any namespace.
kind: RoleBinding
metadata:
  name: exmple-binding
subjects:
  - kind: User
    name: dummy-admin  # Name is case sensitive
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: example-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: example-role
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
---
apiVersion: v1
kind: Pod
metadata:
  name: kubectl
spec:
  serviceAccountName: dummy-admin
  containers:
  - name: kubectl
    image: bitnami/kubectl
   # Just spin & wait forever
    command: [ "/bin/bash", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]

字符串
应用此配置，运行kubectl exec -ti pod/kubectl -- /bin/bash并尝试列出节点，给予我这个错误：

I have no name!@kubectl:/$ kubectl get all
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "pods" in API group "" in the namespace "jaiv"
Error from server (Forbidden): replicationcontrollers is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "replicationcontrollers" in API group "" in the namespace "jaiv"
Error from server (Forbidden): services is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "services" in API group "" in the namespace "jaiv"
Error from server (Forbidden): daemonsets.apps is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "daemonsets" in API group "apps" in the namespace "jaiv"
Error from server (Forbidden): deployments.apps is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "deployments" in API group "apps" in the namespace "jaiv"
Error from server (Forbidden): replicasets.apps is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "replicasets" in API group "apps" in the namespace "jaiv"
Error from server (Forbidden): statefulsets.apps is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "statefulsets" in API group "apps" in the namespace "jaiv"
Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "jaiv"
Error from server (Forbidden): cronjobs.batch is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "cronjobs" in API group "batch" in the namespace "jaiv"
Error from server (Forbidden): jobs.batch is forbidden: User "system:serviceaccount:jaiv:dummy-admin" cannot list resource "jobs" in API group "batch" in the namespace "jaiv"

型
在这种情况下，我看到我是正确的身份，并希望被允许在我的命名空间中列出资源。