Wie behebe ich Berechtigungsprobleme für den Amazon EKS-Add-On-Manager, wenn ich den EBS-CSI-Treiber installiere?

Kurzbeschreibung

Wenn die Amazon EKS-Add-On-Manager-Berechtigungen falsch konfiguriert sind, erhältst du möglicherweise die folgende Fehlermeldung, wenn du versuchst, den Amazon EBS-CSI-Treiber zu installieren:

"Namespaces "kube-system" is forbidden: User "eks:addon-manager" cannot patch resource "namespaces" in API group "" in the namespace "kube-system"."

Du erhältst diese Fehlermeldung, wenn die eks:addon-cluster-admin ClusterRoleBinding fehlt. Ohne diese Bindung funktioniert dein Amazon EKS-Cluster weiterhin, Amazon EKS kann jedoch keine Add-Ons verwalten. Weitere Informationen findest du unter Überlegungen.

Lösung

Es hat sich bewährt, alle zugehörigen Rollen und Bindungen für die rollenbasierte Zugriffskontrolle (RBAC) zu überprüfen.

Im Folgenden sind die Cluster-Rollen und ihre Berechtigungen aufgeführt.

Für ClusterRole cluster-admin:

PolicyRule:

Resources  Non-Resource URLs Resource Names Verbs
 --------- ----------------- -------------- -----
    *.*            []               []       [*]
                   [*]              []       [*]

Für ClusterRole eks-addon-manager:

PolicyRule:

  Resources                                              Non-Resource URLs  Resource Names                      Verbs
  ---------                                              -----------------  --------------                      -----
  customresourcedefinitions.apiextensions.k8s.io         []                 [eniconfigs.crd.k8s.amazonaws.com]  [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [aws-node]                          [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-attacher-binding]          [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-node-binding]              [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-node-getter-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-provisioner-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-resizer-binding]           [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-snapshotter-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [eks:kube-proxy]                    [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [system:coredns]                    [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [aws-node]                          [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-csi-node-role]                 [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-attacher-role]        [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-provisioner-role]     [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-resizer-role]         [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-snapshotter-role]     [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [system:coredns]                    [create delete get list patch update watch]
  csidrivers.storage.k8s.io                              []                 [ebs.csi.aws.com]                   [create delete get list patch update watch]
  persistentvolumes                                      []                 []                                  [create delete get list watch update patch]
  volumesnapshotcontents.snapshot.storage.k8s.io         []                 []                                  [create get list watch update delete patch]
  nodes                                                  []                 []                                  [get list update watch]
  volumeattachments.storage.k8s.io                       []                 []                                  [get list watch update patch]
  persistentvolumeclaims                                 []                 []                                  [get list watch update]
  namespaces                                             []                 []                                  [get list watch]
  pods                                                   []                 []                                  [get list watch]
  replicasets.apps                                       []                 []                                  [get list watch]
  eniconfigs.crd.k8s.amazonaws.com                       []                 []                                  [get list watch]
  csinodeinfos.csi.storage.k8s.io                        []                 []                                  [get list watch]
  volumesnapshotclasses.snapshot.storage.k8s.io          []                 []                                  [get list watch]
  csinodes.storage.k8s.io                                []                 []                                  [get list watch]
  storageclasses.storage.k8s.io                          []                 []                                  [get list watch]
  secrets                                                []                 []                                  [get list]
  volumesnapshots.snapshot.storage.k8s.io                []                 []                                  [get list]
  leases.coordination.k8s.io                             []                 []                                  [get watch list delete update create]
  events                                                 []                 []                                  [list watch create patch update]
  events.events.k8s.io                                   []                 []                                  [list watch create patch update]
  endpoints                                              []                 []                                  [list watch]
  services                                               []                 []                                  [list watch]
  endpointslices.discovery.k8s.io                        []                 []                                  [list watch]
  *.extensions                                           []                 []                                  [list watch]
  volumeattachments.storage.k8s.io/status                []                 []                                  [patch]
  persistentvolumeclaims/status                          []                 []                                  [update patch]
  volumesnapshotcontents.snapshot.storage.k8s.io/status  []                 []                                  [update]

Führe die folgenden Schritte aus:

1. Bestätige, ob die erforderlichen ClusterRole und ClusterRoleBinding vorhanden sind. Führe den folgenden Befehl aus:

   kubectl get clusterrole,clusterrolebinding | grep addon

   Ausgabe:

   clusterrole.rbac.authorization.k8s.io/eks:addon-manager
   clusterrolebinding.rbac.authorization.k8s.io/eks:addon-cluster-admin
   clusterrolebinding.rbac.authorization.k8s.io/eks:addon-manager

2. Wenn die Rolle eks:addon-cluster-admin fehlt, verwende das folgende .yaml-Manifest, um sie zu erstellen:

   cat << EOF > ClusterRoleBinding.yaml
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: eks:addon-cluster-admin
   subjects:
   - kind: User
     name: eks:addon-manager
     apiGroup: rbac.authorization.k8s.io
   roleRef:
     kind: ClusterRole
     name: cluster-admin
     apiGroup: rbac.authorization.k8s.io
   EOF
   
   kubectl apply -f ClusterRoleBinding.yaml