解决了

karbon的存储类用户

w
我正在尝试使用Karbon配置新的Kubernetes群集。当我进入配置存储类的阶段时，我会提示我获取用户名和密码。我不确定我应该在这里输入哪个用户，因为我尝试过的少数用户似乎不起作用。群集设置教程视频显示了用户名`admin'，这似乎建议使用非常特权的用户，这对我来说似乎是不必要的。如何使用存储类所需的最低特权创建用户？
图标

最好的答案vshuguet2019年8月27日，18：35

@wfhartford<\/user-mention> ,
\n
\nThe long term solution (no dates\/times, as all of those things changes) is to bring the Volumes API, which is what the CSI driver uses to provision a PVC, up to Prism Central level, and add RBAC to that.
\n
\nUntil that happen, we're using what is available on PE, which in this case is Cluster Admin.","className":"post__content__best_answer"}">
查看原件
该主题已关闭以供评论

5个答复

乔森纳克斯
秩
UserLevel 4
徽章 +5
您需要在Prism元素级别具有群集管理角色的用户。根据您将用于存储的PE群集，您将需要用户。
何塞·戈麦斯（Jose Gomez）|技术营销工程师|jose.gomez@nutanix.com |@pipoe2H
w
因此，存储类的最低特权用户可以完全控制集群吗？对我来说，这似乎是一种安全风险，是否有计划引入更多的颗粒状安全控制，以便一个受损的容器不能导致攻击者接管整个集群？
vshuguet
秩
Userlevel 1
徽章 +4
你好 @wfhartford，，，，

长期解决方案（没有日期/时间，所有这些事情都会发生变化）是带上卷API，这是CSI驱动程序用来提供PVC，直至Prism Central级别，并为此添加RBAC。

在此之前，我们正在使用PE上的可用内容，在这种情况下，这是群集管理员。
产品经理-Karbon Clusters＆Kubernetes @ nutanix
@wfhartford<\/user-mention> ,
\n
\nThe long term solution (no dates\/times, as all of those things changes) is to bring the Volumes API, which is what the CSI driver uses to provision a PVC, up to Prism Central level, and add RBAC to that.
\n
\nUntil that happen, we're using what is available on PE, which in this case is Cluster Admin.","quoteUsername":"vshuguet","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
w
好的，很高兴知道这里有计划。我是Nutanix的新手，因此管理的各种用户和地方有点令人困惑。听起来事情正朝着正确的方向发展。

谢谢
\n
\nThanks","quoteUsername":"wfhartford","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
vshuguet
秩
Userlevel 1
徽章 +4
为了给您一个想法，PE（Prism元素）是我们的单个群集管理平面。这是我们几年前开始的地方，但在角色/RBAC功能方面也受到限制。

PC（PRISM CENTRAL），我们的多群集管理平面，是我们正在移动所有管理功能以及所有新产品集成的地方。它具有高级RBAC功能。

目前的情况诞生了，这是因为过去曾在PE中居住在PC中的移动功能的过渡期。
产品经理-Karbon Clusters＆Kubernetes @ nutanix
\n
\nPC (Prism Central), our multi-cluster management plane, is where we're moving all of our management features and also where all of our new products integrate. It has advanced RBAC capabilities.
\n
\nThe current situation is born because of that transition period of moving functionalities that used to live in PE, up to PC.","quoteUsername":"vshuguet","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
条款和条件
Learn more about our cookies.<\/a>","cookiepolicy.button":"Accept cookies","cookiepolicy.button.deny":"Deny all","cookiepolicy.link":"Cookie settings","cookiepolicy.modal.title":"Cookie settings","cookiepolicy.modal.content":"We use 3 different kinds of cookies. You can choose which cookies you want to accept. We need basic cookies to make this site work, therefore these are the minimum you can select. Learn more about our cookies.<\/a>","cookiepolicy.modal.level1":"Basic
Functional","cookiepolicy.modal.level2":"Normal
Functional + analytics","cookiepolicy.modal.level3":"Complete
Functional + analytics + social media + embedded videos"}}}">
Baidu