# 集群权限异常
 #### 问题现象
HSS提供的容器相关功能特性，已接入HSS的第三方云集群或自建集群存在没有权限使用的情况。
确认是否有权限的步骤如下：
1. [登录企业主机安全控制台](https://console.huaweicloud.com/hss/?locale=zh-cn)。
2. 在控制台左上角，单击![](https://support.huaweicloud.com/hss2.0_faq/zh-cn_image_0000002384023862.png)图标，选择区域或项目。
3. 在左侧导航栏，选择"安装与配置 \> 容器安装与配置"，进入"容器安装与配置"页面。
4. 选择"集群"页签。
5. 单击目标集群名称，进入集群节点详情页面，查看权限列表。 
   您所需使用的功能特性所在行的"是否有权限"列显示"否"，表示无权限使用该特性。
   
   
 
#### 问题根因
第三方云集群或自建集群接入HSS时使用的Kubeconfig文件，是选择的**为HSS生成的专用Kubeconfig文件**，在生成该文件过程中，您未严格按文档操作自行修改了某些参数。
#### 解决办法
1. 登录集群任一节点目录。
2. 创建hss-rbac.yaml文件，并将以下内容复制并保存至hss-rbac.yaml文件中。 
   ```
   {"metadata":{"namespace":"hss","name":"hssRole"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","rules":[{"resources":["configmaps"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":[""]},{"resources":["daemonsets","deployments","deployments/rollback","replicasets"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["apps"]},{"resources":["cronjobs","jobs"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["batch"]},{"resources":["ingresses"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["extensions"]},{"resources":["ingresses"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["networking.k8s.io"]}]}{"metadata":{"namespace":"hss","name":"hssRoleBinding"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","subjects":[{"kind":"ServiceAccount","name":"hss-user","namespace":"hss"}],"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"Role","name":"hssRole"}}{"metadata":{"name":"hssClusterRole"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","rules":[{"resources":["namespaces","pods","nodes","services","endpoints","configmaps","events","persistentvolumeclaims","persistentvolumes","podtemplates","replicationcontrollers","serviceaccounts","pods/log"],"verbs":["get","list"],"apiGroups":[""]},{"resources":["pods/status"],"verbs":["update"],"apiGroups":[""]},{"resources":["daemonsets","deployments","replicasets","statefulsets"],"verbs":["get","list"],"apiGroups":["apps"]},{"resources":["horizontalpodautoscalers"],"verbs":["get","list"],"apiGroups":["autoscaling"]},{"resources":["cronjobs","jobs"],"verbs":["get","list"],"apiGroups":["batch"]},{"resources":["endpointslices"],"verbs":["get","list"],"apiGroups":["discovery.k8s.io"]},{"resources":["events"],"verbs":["get","list"],"apiGroups":["events.k8s.io"]},{"resources":["ingresses"],"verbs":["get","list"],"apiGroups":["extensions"]},{"resources":["ingressclasses","ingresses","networkpolicies"],"verbs":["create","delete","update","get","list"],"apiGroups":["networking.k8s.io"]},{"resources":["clusterrolebindings","clusterroles","rolebindings","roles"],"verbs":["create","delete","deletecollection","patch","update","watch"],"apiGroups":["rbac.authorization.k8s.io"]},{"resources":["clusterrolebindings","clusterroles","rolebindings","roles"],"verbs":["get","list"],"apiGroups":["rbac.authorization.k8s.io"]},{"resources":["storageclasses","volumeattachments"],"verbs":["get","list"],"apiGroups":["storage.k8s.io"]}]}{"metadata":{"name":"hssClusterRoleBinding"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","subjects":[{"kind":"ServiceAccount","name":"hss-user","namespace":"hss"}],"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"hssClusterRole"}}
   ```
   
   
3. 执行以下命令，配置HSS所需的全量rbac权限 
   ```
   kubectl apply -f hss-rbac.yaml
   ```
   
   
4. 登录HSS控制台，查看权限列表中"是否有权限"列均为"是"，表示权限恢复正常，问题解决。 
   详细操作请参考[问题现象]中查看权限列表的操作。
   如果您一直停留在HSS权限列表页面，请在配置完成后刷新下页面。