Come posso risolvere i problemi di autorizzazione del gestore di componenti aggiuntivi per Amazon EKS quando installo il driver EBS CSI?
Desidero installare il driver Amazon Elastic Block Store (Amazon EBS) Container Storage Interface (CSI). Tuttavia, ricevo un messaggio di errore relativo alle autorizzazioni del gestore dei componenti aggiuntivi per Amazon Elastic Kubernetes Service (Amazon EKS).
Breve descrizione
Se le autorizzazioni del gestore di componenti aggiuntivi per Amazon EKS non sono configurate correttamente, potresti ricevere il seguente messaggio di errore quando provi a installare il driver Amazon EBS CSI:
"Namespaces "kube-system" is forbidden: User "eks:addon-manager" cannot patch resource "namespaces" in API group "" in the namespace "kube-system"."
Ricevi questo messaggio di errore quando manca l'associazione ClusterRoleBinding eks:addon-cluster-admin. Senza questa associazione, il cluster Amazon EKS continua a funzionare ma Amazon EKS non è in grado di gestire alcun componente aggiuntivo. Per ulteriori informazioni, consulta Considerazioni.
Risoluzione
È consigliabile controllare tutti i ruoli e le associazioni relativi al controllo degli accessi basato sui ruoli (RBAC).
Di seguito sono riportati i ruoli del cluster e le relative autorizzazioni.
Per ClusterRole cluster-admin:
PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- *.* [] [] [*] [*] [] [*]
Per ClusterRole eks-addon-manager:
PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- customresourcedefinitions.apiextensions.k8s.io [] [eniconfigs.crd.k8s.amazonaws.com] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [aws-node] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-attacher-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-node-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-node-getter-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-provisioner-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-resizer-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-snapshotter-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [eks:kube-proxy] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [system:coredns] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [aws-node] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-csi-node-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-attacher-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-provisioner-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-resizer-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-snapshotter-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [system:coredns] [create delete get list patch update watch] csidrivers.storage.k8s.io [] [ebs.csi.aws.com] [create delete get list patch update watch] persistentvolumes [] [] [create delete get list watch update patch] volumesnapshotcontents.snapshot.storage.k8s.io [] [] [create get list watch update delete patch] nodes [] [] [get list update watch] volumeattachments.storage.k8s.io [] [] [get list watch update patch] persistentvolumeclaims [] [] [get list watch update] namespaces [] [] [get list watch] pods [] [] [get list watch] replicasets.apps [] [] [get list watch] eniconfigs.crd.k8s.amazonaws.com [] [] [get list watch] csinodeinfos.csi.storage.k8s.io [] [] [get list watch] volumesnapshotclasses.snapshot.storage.k8s.io [] [] [get list watch] csinodes.storage.k8s.io [] [] [get list watch] storageclasses.storage.k8s.io [] [] [get list watch] secrets [] [] [get list] volumesnapshots.snapshot.storage.k8s.io [] [] [get list] leases.coordination.k8s.io [] [] [get watch list delete update create] events [] [] [list watch create patch update] events.events.k8s.io [] [] [list watch create patch update] endpoints [] [] [list watch] services [] [] [list watch] endpointslices.discovery.k8s.io [] [] [list watch] *.extensions [] [] [list watch] volumeattachments.storage.k8s.io/status [] [] [patch] persistentvolumeclaims/status [] [] [update patch] volumesnapshotcontents.snapshot.storage.k8s.io/status [] [] [update]
Completa i seguenti passaggi:
-
Verificare se sono presenti il ruolo ClusterRole e l'associazione ClusterRoleBinding richiesti. Esegui questo comando:
kubectl get clusterrole,clusterrolebinding | grep addonOutput:
clusterrole.rbac.authorization.k8s.io/eks:addon-manager clusterrolebinding.rbac.authorization.k8s.io/eks:addon-cluster-admin clusterrolebinding.rbac.authorization.k8s.io/eks:addon-manager -
Se manca il ruolo eks:addon-cluster-admin, utilizza il seguente manifesto .yaml per crearlo:
cat << EOF > ClusterRoleBinding.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: eks:addon-cluster-admin subjects: - kind: User name: eks:addon-manager apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io EOF kubectl apply -f ClusterRoleBinding.yaml
- Argomenti
- Containers
- Lingua
- Italiano
