Question

我想在无业游民的部署过程中从aws-auth编辑配置映射，以使无业游民的用户可以访问EKS集群。我需要向现有的aws-auth配置图中添加一个代码段。我如何以编程方式执行此操作？

如果您执行kubectl edit -n kube-system configmap/aws-auth，您将会得到

apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::123:role/nodegroup-abc123
      username: system:node:{{EC2PrivateDNSName}}
kind: ConfigMap
metadata:
  creationTimestamp: "2019-05-30T03:00:18Z"
  name: aws-auth
  namespace: kube-system
  resourceVersion: "19055217"
  selfLink: /api/v1/namespaces/kube-system/configmaps/aws-auth
  uid: 0000-0000-0000

我需要以某种方式在其中输入该位。

  mapUsers: |
    - userarn: arn:aws:iam::123:user/sergeant-poopie-pants
      username: sergeant-poopie-pants
      groups:
      - system:masters

我尝试做一个cat <<EOF > {file} EOF，然后从文件打补丁。但是，该选项仅在patch上下文中不存在于create中。

我还发现了这一点：How to patch a ConfigMap in Kubernetes

但是它似乎没有用。也许我不是很了解建议的解决方案。

Answer 1

有几种使事情自动化的方法。直接的方法是class Page2(QtWidgets.QWizardPage): def __init__(self, parent=None): QtWidgets.QWizardPage.__init__(self, parent) layout = QtWidgets.QGridLayout() self.setLayout(layout) self.tree = QtWidgets.QTreeView() layout.addWidget(self.tree) self.model = QtGui.QStandardItemModel() self.tree.setModel(self.model) self.model.dataChanged.connect(self.setCurrentState) self.addCheckItem = QtGui.QStandardItem('item') self.model.appendRow(self.addCheckItem) # remember the default flags self.defaultFlags = self.addCheckItem.flags() # set the current "add_checkbox" value to None, which means that it # has *no* state set at all, not even an Unchecked one self.currentState = None def setCurrentState(self, topLeft, bottomRight): # remember the new check state self.currentState = self.addCheckItem.checkState() def initializePage(self): if self.field('add_checkbox'): # apply the new flags to allow the user to set the check state self.addCheckItem.setFlags( self.defaultFlags | QtCore.Qt.ItemIsUserCheckable) # set the state if it has been previously set if self.currentState is None: self.addCheckItem.setCheckState(QtCore.Qt.Unchecked) else: self.addCheckItem.setCheckState(self.currentState) else: # prevent notifying setCurrentState() slot that we're changing the # value, while still remembering the check state; # note that blogking model signals is not a good practice, as it # prevents the view to receive model changes, which usually results # in painting, size, scrolling and mouse interaction issues, but we # can ignore that in this case, since those changes are only taken # into account once the view is shown, assuming that the view will # update once it will be shown, and that will only happen *after* # initializePage returns self.model.blockSignals(True) self.addCheckItem.setData(None, QtCore.Qt.CheckStateRole) self.model.blockSignals(False)或类似的东西。您可能希望使用脚本来解析和修改YAML数据，而不是使用文字修补程序，以使其不那么脆弱。您也可以做类似kubectl get configmap -o yaml ... > cm.yml && patch ... < cm.yml > cm2.yml && kubectl apply -f cm2.yml的事情，但这比我想做的要聪明。

Answer 2

首先，请注意，mapRoles和mapUsers实际上是字符串，即使它是结构化数据（yaml）。

尽管jsonpatch可以解决此问题，但像这样使用jq和kubectl apply则容易得多：

kubectl get cm aws-auth -o json \
  | jq --arg add "`cat add.yaml`" '.data.mapUsers = $add' \
  | kubectl apply -f -

add.yaml是这样的（请注意，没有多余的缩进）：

- userarn: arn:aws:iam::123:user/sergeant-poopie-pants
  username: sergeant-poopie-pants
  groups:
  - system:masters

另请参见https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html。

从文件或使用json修补configmap

2 个答案: