AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
¿Cómo soluciono los problemas de permisos del administrador de complementos de Amazon EKS al instalar el controlador de CSI de EBS?
Quiero instalar el controlador de la interfaz de almacenamiento de contenedores (CSI) de Amazon Elastic Block Store (Amazon EBS). Sin embargo, recibo un mensaje de error de permisos en el administrador de complementos de Amazon Elastic Kubernetes Service (Amazon EKS).
Descripción corta
Si los permisos del administrador de complementos de Amazon EKS están mal configurados, es posible que recibas el siguiente mensaje de error al intentar instalar el controlador de CSI de Amazon EBS:
"Namespaces "kube-system" is forbidden: User "eks:addon-manager" cannot patch resource "namespaces" in API group "" in the namespace "kube-system"."
Recibes este mensaje de error cuando falta eks:addon-cluster-admin ClusterRoleBinding. Sin este enlace, tu clúster de Amazon EKS seguirá funcionando, pero Amazon EKS no puede administrar ningún complemento. Para obtener más información, consulta Consideraciones.
Resolución
Se recomienda comprobar todos los enlaces y roles de control de acceso basado en roles (RBAC) asociados.
Los siguientes son los roles del clúster y sus permisos.
Para ClusterRole cluster-admin:
PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- *.* [] [] [*] [*] [] [*]
Para ClusterRole eks-addon-manager:
PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- customresourcedefinitions.apiextensions.k8s.io [] [eniconfigs.crd.k8s.amazonaws.com] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [aws-node] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-attacher-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-node-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-node-getter-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-provisioner-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-resizer-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-snapshotter-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [eks:kube-proxy] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [system:coredns] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [aws-node] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-csi-node-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-attacher-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-provisioner-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-resizer-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-snapshotter-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [system:coredns] [create delete get list patch update watch] csidrivers.storage.k8s.io [] [ebs.csi.aws.com] [create delete get list patch update watch] persistentvolumes [] [] [create delete get list watch update patch] volumesnapshotcontents.snapshot.storage.k8s.io [] [] [create get list watch update delete patch] nodes [] [] [get list update watch] volumeattachments.storage.k8s.io [] [] [get list watch update patch] persistentvolumeclaims [] [] [get list watch update] namespaces [] [] [get list watch] pods [] [] [get list watch] replicasets.apps [] [] [get list watch] eniconfigs.crd.k8s.amazonaws.com [] [] [get list watch] csinodeinfos.csi.storage.k8s.io [] [] [get list watch] volumesnapshotclasses.snapshot.storage.k8s.io [] [] [get list watch] csinodes.storage.k8s.io [] [] [get list watch] storageclasses.storage.k8s.io [] [] [get list watch] secrets [] [] [get list] volumesnapshots.snapshot.storage.k8s.io [] [] [get list] leases.coordination.k8s.io [] [] [get watch list delete update create] events [] [] [list watch create patch update] events.events.k8s.io [] [] [list watch create patch update] endpoints [] [] [list watch] services [] [] [list watch] endpointslices.discovery.k8s.io [] [] [list watch] *.extensions [] [] [list watch] volumeattachments.storage.k8s.io/status [] [] [patch] persistentvolumeclaims/status [] [] [update patch] volumesnapshotcontents.snapshot.storage.k8s.io/status [] [] [update]
Sigue estos pasos:
-
Confirma si están presentes ClusterRole and ClusterRoleBinding. Ejecuta el siguiente comando:
kubectl get clusterrole,clusterrolebinding | grep addonResultado:
clusterrole.rbac.authorization.k8s.io/eks:addon-manager clusterrolebinding.rbac.authorization.k8s.io/eks:addon-cluster-admin clusterrolebinding.rbac.authorization.k8s.io/eks:addon-manager -
Si falta el rol eks:addon-cluster-admin, usa el siguiente manifiesto .yaml para crearlo:
cat << EOF > ClusterRoleBinding.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: eks:addon-cluster-admin subjects: - kind: User name: eks:addon-manager apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io EOF kubectl apply -f ClusterRoleBinding.yaml
- Temas
- Containers
- Etiquetas
- Amazon Elastic Kubernetes Service
- Idioma
- Español
Contenido relevante
preguntada hace 10 meses
preguntada hace 10 meses
preguntada hace un año
preguntada hace un año
