企业主机安全 HSS
企业主机安全 HSS
- 最新动态
- 功能总览
- 服务公告
- 技术画册
- 产品介绍
- 计费说明
- 快速入门
- 用户指南
- 最佳实践
- API参考
- SDK参考
-
常见问题
- 产品咨询
-
Agent相关
- 购买HSS会自动安装Agent吗?
- Agent是否和其他安全软件有冲突?
- 如何卸载Agent?
- Agent安装失败应如何处理?
- Agent状态异常应如何处理?
- Agent的默认安装路径是什么?
- Agent检测时占用多少CPU和内存资源?
- 购买不同版本HSS,可以共用同一Agent吗?
- 如何查看未安装Agent的主机?
- Agent如何升级?
- 企业主机安全升级失败怎么处理?
- 服务器安装Agent后会访问哪些资源?
- 如何使用镜像批量安装Agent?
- 无法访问Windows或Linux版本Agent下载链接?
- 升级Agent失败,提示“替换文件失败”
- 批量安装Agent失败,提示“网络不通”
- 如何验证主机与HSS服务端的网络是否打通成功?
- 防护相关
- 漏洞管理
- 检测与响应
- 异常登录
- 账户暴力破解
- 基线检查
- 网页防篡改
- 容器安全
- 勒索防护
- 区域和可用区
- 安全配置
- 防护配额
- 计费、续费与退订
- 其他
- 视频帮助
-
更多文档
- 用户指南(安卡拉区域)
- 用户指南(阿布扎比区域)
- 用户指南(巴黎区域)
- 通用参考
链接复制成功!
集群权限异常
问题现象
HSS提供的容器相关功能特性,已接入HSS的第三方云集群或自建集群存在没有权限使用的情况。
确认是否有权限的步骤如下:
- 登录管理控制台。
- 在页面左上角选择“区域”,单击
,选择“安全与合规 > 企业主机安全”,进入主机安全平台界面。
- 在左侧导航栏,选择“安装与配置 > 容器安装与配置”,进入“容器安装与配置”页面。
- 选择“集群”页签。
- 单击目标集群名称,进入集群节点详情页面,查看权限列表。
您所需使用的功能特性所在行的“是否有权限”列显示“否”,表示无权限使用该特性。
问题根因
第三方云集群或自建集群接入HSS时使用的Kubeconfig文件,是选择的为HSS生成的专用Kubeconfig文件,在生成该文件过程中,您未严格按文档操作自行修改了某些参数。
解决办法
- 登录集群任一节点目录。
- 创建hss-rbac.yaml文件,并将以下内容复制并保存至hss-rbac.yaml文件中。
{"metadata":{"namespace":"hss","name":"hssRole"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","rules":[{"resources":["configmaps"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":[""]},{"resources":["daemonsets","deployments","deployments/rollback","replicasets"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["apps"]},{"resources":["cronjobs","jobs"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["batch"]},{"resources":["ingresses"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["extensions"]},{"resources":["ingresses"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"],"apiGroups":["networking.k8s.io"]}]}{"metadata":{"namespace":"hss","name":"hssRoleBinding"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","subjects":[{"kind":"ServiceAccount","name":"hss-user","namespace":"hss"}],"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"Role","name":"hssRole"}}{"metadata":{"name":"hssClusterRole"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","rules":[{"resources":["namespaces","pods","nodes","services","endpoints","configmaps","events","persistentvolumeclaims","persistentvolumes","podtemplates","replicationcontrollers","serviceaccounts","pods/log"],"verbs":["get","list"],"apiGroups":[""]},{"resources":["pods/status"],"verbs":["update"],"apiGroups":[""]},{"resources":["daemonsets","deployments","replicasets","statefulsets"],"verbs":["get","list"],"apiGroups":["apps"]},{"resources":["horizontalpodautoscalers"],"verbs":["get","list"],"apiGroups":["autoscaling"]},{"resources":["cronjobs","jobs"],"verbs":["get","list"],"apiGroups":["batch"]},{"resources":["endpointslices"],"verbs":["get","list"],"apiGroups":["discovery.k8s.io"]},{"resources":["events"],"verbs":["get","list"],"apiGroups":["events.k8s.io"]},{"resources":["ingresses"],"verbs":["get","list"],"apiGroups":["extensions"]},{"resources":["ingressclasses","ingresses","networkpolicies"],"verbs":["create","delete","update","get","list"],"apiGroups":["networking.k8s.io"]},{"resources":["clusterrolebindings","clusterroles","rolebindings","roles"],"verbs":["create","delete","deletecollection","patch","update","watch"],"apiGroups":["rbac.authorization.k8s.io"]},{"resources":["clusterrolebindings","clusterroles","rolebindings","roles"],"verbs":["get","list"],"apiGroups":["rbac.authorization.k8s.io"]},{"resources":["storageclasses","volumeattachments"],"verbs":["get","list"],"apiGroups":["storage.k8s.io"]}]}{"metadata":{"name":"hssClusterRoleBinding"},"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","subjects":[{"kind":"ServiceAccount","name":"hss-user","namespace":"hss"}],"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"hssClusterRole"}}
- 执行以下命令,配置HSS所需的全量rbac权限
kubectl apply -f hss-rbac.yaml
- 登录HSS控制台,查看权限列表中“是否有权限”列均为“是”,表示权限恢复正常,问题解决。
详细操作请参考问题现象中查看权限列表的操作。
如果您一直停留在HSS权限列表页面,请在配置完成后刷新下页面。
父主题: 容器安全