安裝 EBS CSI 驅動程式時，如何解決 Amazon EKS 附加元件管理器的權限問題？

簡短描述

如果 Amazon EKS 附加元件管理器權限設定錯誤，則當您嘗試安裝 Amazon EBS CSI 驅動程式時，可能會收到下列錯誤訊息：

"Namespaces "kube-system" is forbidden: User "eks:addon-manager" cannot patch resource "namespaces" in API group "" in the namespace "kube-system"."

當缺少 eks:addon-cluster-admin ClusterRoleBinding 時，就會收到此錯誤訊息。如果沒有此繫結，您的 Amazon EKS 叢集將繼續執行，但 Amazon EKS 將無法管理任何附加元件。如需詳細資訊，請參閱考量事項。

解決方法

最佳實務是檢查所有相關的角色型存取控制 (RBAC) 角色和繫結。

以下是叢集角色及其權限。

對於 ClusterRole cluster-admin：

PolicyRule:

Resources  Non-Resource URLs Resource Names Verbs
 --------- ----------------- -------------- -----
    *.*            []               []       [*]
                   [*]              []       [*]

對於 ClusterRole eks-addon-manager：

PolicyRule:

  Resources                                              Non-Resource URLs  Resource Names                      Verbs
  ---------                                              -----------------  --------------                      -----
  customresourcedefinitions.apiextensions.k8s.io         []                 [eniconfigs.crd.k8s.amazonaws.com]  [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [aws-node]                          [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-attacher-binding]          [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-node-binding]              [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-node-getter-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-provisioner-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-resizer-binding]           [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [ebs-csi-snapshotter-binding]       [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [eks:kube-proxy]                    [create delete get list patch update watch]
  clusterrolebindings.rbac.authorization.k8s.io          []                 [system:coredns]                    [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [aws-node]                          [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-csi-node-role]                 [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-attacher-role]        [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-provisioner-role]     [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-resizer-role]         [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [ebs-external-snapshotter-role]     [create delete get list patch update watch]
  clusterroles.rbac.authorization.k8s.io                 []                 [system:coredns]                    [create delete get list patch update watch]
  csidrivers.storage.k8s.io                              []                 [ebs.csi.aws.com]                   [create delete get list patch update watch]
  persistentvolumes                                      []                 []                                  [create delete get list watch update patch]
  volumesnapshotcontents.snapshot.storage.k8s.io         []                 []                                  [create get list watch update delete patch]
  nodes                                                  []                 []                                  [get list update watch]
  volumeattachments.storage.k8s.io                       []                 []                                  [get list watch update patch]
  persistentvolumeclaims                                 []                 []                                  [get list watch update]
  namespaces                                             []                 []                                  [get list watch]
  pods                                                   []                 []                                  [get list watch]
  replicasets.apps                                       []                 []                                  [get list watch]
  eniconfigs.crd.k8s.amazonaws.com                       []                 []                                  [get list watch]
  csinodeinfos.csi.storage.k8s.io                        []                 []                                  [get list watch]
  volumesnapshotclasses.snapshot.storage.k8s.io          []                 []                                  [get list watch]
  csinodes.storage.k8s.io                                []                 []                                  [get list watch]
  storageclasses.storage.k8s.io                          []                 []                                  [get list watch]
  secrets                                                []                 []                                  [get list]
  volumesnapshots.snapshot.storage.k8s.io                []                 []                                  [get list]
  leases.coordination.k8s.io                             []                 []                                  [get watch list delete update create]
  events                                                 []                 []                                  [list watch create patch update]
  events.events.k8s.io                                   []                 []                                  [list watch create patch update]
  endpoints                                              []                 []                                  [list watch]
  services                                               []                 []                                  [list watch]
  endpointslices.discovery.k8s.io                        []                 []                                  [list watch]
  *.extensions                                           []                 []                                  [list watch]
  volumeattachments.storage.k8s.io/status                []                 []                                  [patch]
  persistentvolumeclaims/status                          []                 []                                  [update patch]
  volumesnapshotcontents.snapshot.storage.k8s.io/status  []                 []                                  [update]

請完成下列步驟：

1. 確認所需的 ClusterRole 和 ClusterRoleBinding 是否存在。執行以下命令：

   kubectl get clusterrole,clusterrolebinding | grep addon

   輸出：

   clusterrole.rbac.authorization.k8s.io/eks:addon-manager
   clusterrolebinding.rbac.authorization.k8s.io/eks:addon-cluster-admin
   clusterrolebinding.rbac.authorization.k8s.io/eks:addon-manager

2. 如果缺少 eks:addon-cluster-admin 角色，請使用以下 .yaml 資訊清單來建立該角色：

   cat << EOF > ClusterRoleBinding.yaml
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: eks:addon-cluster-admin
   subjects:
   - kind: User
     name: eks:addon-manager
     apiGroup: rbac.authorization.k8s.io
   roleRef:
     kind: ClusterRole
     name: cluster-admin
     apiGroup: rbac.authorization.k8s.io
   EOF
   
   kubectl apply -f ClusterRoleBinding.yaml