Comment résoudre les problèmes d'autorisation liés au gestionnaire de modules complémentaires Amazon EKS lorsque j'installe le pilote CSI EBS ?
Je souhaite installer le pilote d’interface de stockage de conteneur (CSI) Amazon Elastic Block Store (Amazon EBS). Cependant, je reçois un message d'erreur lié aux autorisations provenant du gestionnaire de modules complémentaires pour Amazon Elastic Kubernetes Service (Amazon EKS).
Brève description
Si les autorisations du gestionnaire de modules complémentaires Amazon EKS sont incorrectement configurées, le message d'erreur suivant peut s'afficher lorsque vous tentez d'installer le pilote CSI Amazon EBS :
"Namespaces "kube-system" is forbidden: User "eks:addon-manager" cannot patch resource "namespaces" in API group "" in the namespace "kube-system"."
Ce message d'erreur s'affiche lorsque eks:addon-cluster-admin ClusterRoleBinding est manquant. Sans cette liaison, votre cluster Amazon EKS continue de fonctionner mais Amazon EKS ne peut gérer aucun module complémentaire. Pour plus d'informations, consultez la section Considérations.
Résolution
Il est recommandé de vérifier l’ensemble des rôles et des liaisons de contrôle d'accès basé sur des rôles (RBAC) associés.
Vous trouverez ci-dessous les rôles de cluster et leurs autorisations.
Pour ClusterRole cluster-admin :
PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- *.* [] [] [*] [*] [] [*]
Pour ClusterRole eks-addon-manager :
PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- customresourcedefinitions.apiextensions.k8s.io [] [eniconfigs.crd.k8s.amazonaws.com] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [aws-node] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-attacher-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-node-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-node-getter-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-provisioner-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-resizer-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [ebs-csi-snapshotter-binding] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [eks:kube-proxy] [create delete get list patch update watch] clusterrolebindings.rbac.authorization.k8s.io [] [system:coredns] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [aws-node] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-csi-node-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-attacher-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-provisioner-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-resizer-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [ebs-external-snapshotter-role] [create delete get list patch update watch] clusterroles.rbac.authorization.k8s.io [] [system:coredns] [create delete get list patch update watch] csidrivers.storage.k8s.io [] [ebs.csi.aws.com] [create delete get list patch update watch] persistentvolumes [] [] [create delete get list watch update patch] volumesnapshotcontents.snapshot.storage.k8s.io [] [] [create get list watch update delete patch] nodes [] [] [get list update watch] volumeattachments.storage.k8s.io [] [] [get list watch update patch] persistentvolumeclaims [] [] [get list watch update] namespaces [] [] [get list watch] pods [] [] [get list watch] replicasets.apps [] [] [get list watch] eniconfigs.crd.k8s.amazonaws.com [] [] [get list watch] csinodeinfos.csi.storage.k8s.io [] [] [get list watch] volumesnapshotclasses.snapshot.storage.k8s.io [] [] [get list watch] csinodes.storage.k8s.io [] [] [get list watch] storageclasses.storage.k8s.io [] [] [get list watch] secrets [] [] [get list] volumesnapshots.snapshot.storage.k8s.io [] [] [get list] leases.coordination.k8s.io [] [] [get watch list delete update create] events [] [] [list watch create patch update] events.events.k8s.io [] [] [list watch create patch update] endpoints [] [] [list watch] services [] [] [list watch] endpointslices.discovery.k8s.io [] [] [list watch] *.extensions [] [] [list watch] volumeattachments.storage.k8s.io/status [] [] [patch] persistentvolumeclaims/status [] [] [update patch] volumesnapshotcontents.snapshot.storage.k8s.io/status [] [] [update]
Procédez comme suit :
-
Vérifiez si les rôles ClusterRole et ClusterRoleBinding requis sont présents. Exécutez la commande suivante :
kubectl get clusterrole,clusterrolebinding | grep addonSortie :
clusterrole.rbac.authorization.k8s.io/eks:addon-manager clusterrolebinding.rbac.authorization.k8s.io/eks:addon-cluster-admin clusterrolebinding.rbac.authorization.k8s.io/eks:addon-manager -
Si le rôle eks:addon-cluster-admin est manquant, utilisez le manifeste .yaml suivant pour le créer :
cat << EOF > ClusterRoleBinding.yaml kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: eks:addon-cluster-admin subjects: - kind: User name: eks:addon-manager apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io EOF kubectl apply -f ClusterRoleBinding.yaml
- Sujets
- Containers
- Langue
- Français
Contenus pertinents
demandé il y a un an
demandé il y a 2 ans
- AWS OFFICIELA mis à jour il y a un an
- AWS OFFICIELA mis à jour il y a 8 mois