如何解决安装 EBS CSI 驱动程序时 Amazon EKS 插件管理器的权限问题？

简短描述

如果 Amazon EKS 插件管理器权限配置错误，则在尝试安装 Amazon EBS CSI 驱动程序时可能会收到以下错误消息：

"Namespaces "kube-system" is forbidden: User "eks:addon-manager" cannot patch resource "namespaces" in API group "" in the namespace "kube-system"."

当 eks:addon-cluster-admin ClusterRoleBinding 缺失时，您会收到此错误消息。如果没有这种绑定，您的 Amazon EKS 集群将继续运行，但 Amazon EKS 无法管理任何插件。有关详细信息，请参阅注意事项。

解决方法

最佳做法是检查所有关联的基于角色的访问控制 (RBAC) 角色和绑定。

以下是集群角色及其权限。

对于 ClusterRole cluster-admin：

PolicyRule:

Resources  Non-Resource URLs Resource Names Verbs
 --------- ----------------- -------------- -----
    *.*            []               []       [*]
                   [*]              []       [*]

对于 ClusterRole eks-addon-manager：

PolicyRule:

  Resources                                              Non-Resource URLs  Resource Names                      Verbs
  ---------                                              -----------------  --------------                      -----
  customresourcedefinitions.apiextensions.k8s.io         []                 [eniconfigs.crd.k8s.amazonaws.com]  [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [aws-node]                          [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-attacher-binding]          [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-node-binding]              [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-node-getter-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-provisioner-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-resizer-binding]           [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-snapshotter-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [eks:kube-proxy]                    [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [system:coredns]                    [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [aws-node]                          [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-csi-node-role]                 [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-attacher-role]        [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-provisioner-role]     [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-resizer-role]         [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-snapshotter-role]     [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [system:coredns]                    [create delete get list patch update watch]
  csidrivers.storage.k8s.io                              []                 [ebs.csi.aws.com]                   [create delete get list patch update watch]
  persistentvolumes                                      []                 []                                  [create delete get list watch update patch]
  volumesnapshotcontents.snapshot.storage.k8s.io         []                 []                                  [create get list watch update delete patch]
  nodes                                                  []                 []                                  [get list update watch]
  volumeattachments.storage.k8s.io                       []                 []                                  [get list watch update patch]
  persistentvolumeclaims                                 []                 []                                  [get list watch update]
  namespaces                                             []                 []                                  [get list watch]
  pods                                                   []                 []                                  [get list watch]
  replicasets.apps                                       []                 []                                  [get list watch]
  eniconfigs.crd.k8s.amazonaws.com                       []                 []                                  [get list watch]
  csinodeinfos.csi.storage.k8s.io                        []                 []                                  [get list watch]
  volumesnapshotclasses.snapshot.storage.k8s.io          []                 []                                  [get list watch]
  csinodes.storage.k8s.io                                []                 []                                  [get list watch]
  storageclasses.storage.k8s.io                          []                 []                                  [get list watch]
  secrets                                                []                 []                                  [get list]
  volumesnapshots.snapshot.storage.k8s.io                []                 []                                  [get list]
  leases.coordination.k8s.io                             []                 []                                  [get watch list delete update create]
  events                                                 []                 []                                  [list watch create patch update]
  events.events.k8s.io                                   []                 []                                  [list watch create patch update]
  endpoints                                              []                 []                                  [list watch]
  services                                               []                 []                                  [list watch]
  endpointslices.discovery.k8s.io                        []                 []                                  [list watch]
  *.extensions                                           []                 []                                  [list watch]
  volumeattachments.storage.k8s.io/status                []                 []                                  [patch]
  persistentvolumeclaims/status                          []                 []                                  [update patch]
  volumesnapshotcontents.snapshot.storage.k8s.io/status  []                 []                                  [update]

完成以下步骤：

1. 确认所需的 ClusterRole 和 ClusterRoleBinding 是否存在。运行以下命令：

   kubectl get clusterrole,clusterrolebinding | grep addon

   输出：

   clusterrole.rbac.authorization.k8s.io/eks:addon-manager
   clusterrolebinding.rbac.authorization.k8s.io/eks:addon-cluster-admin
   clusterrolebinding.rbac.authorization.k8s.io/eks:addon-manager

2. 如果 eks:addon-cluster-admin 角色缺失，请使用以下 .yaml 清单来创建它：

   cat << EOF > ClusterRoleBinding.yaml
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: eks:addon-cluster-admin
   subjects:
   - kind: User
     name: eks:addon-manager
     apiGroup: rbac.authorization.k8s.io
   roleRef:
     kind: ClusterRole
     name: cluster-admin
     apiGroup: rbac.authorization.k8s.io
   EOF
   
   kubectl apply -f ClusterRoleBinding.yaml