使用RBAC的EKS Kubernetes用户被视为system:anonymous

时间:2018-08-01 14:16:21

标签: kubernetes kubernetes-security amazon-eks

我一直关注this post,以创建对我的kubernetes集群的用户访问权限(在Amazon EKS上运行)。我确实创建了密钥csr,批准了请求并为用户下载了证书。然后,我确实使用密钥和crt创建了一个kubeconfig文件。当我使用此kubeconfig运行kubectl时,我被识别为system:anonymous

$ kubectl --kubeconfig test-user-2.kube.yaml get pods
Error from server (Forbidden): pods is forbidden: User "system:anonymous" cannot list pods in the namespace "default"

我希望该用户能够被识别,但被拒绝访问。

$ kubectl --kubeconfig test-user-2.kube.yaml version
Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.1", GitCommit:"b1b29978270dc22fecc592ac55d903350454310a", GitTreeState:"clean", BuildDate:"2018-07-18T11:37:06Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.3", GitCommit:"2bba0127d85d5a46ab4b778548be28623b32d0b0", GitTreeState:"clean", BuildDate:"2018-05-28T20:13:43Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}


$ kubectl --kubeconfig test-user-2.kube.yaml config view
apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: REDACTED
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: test-user-2
  name: kubernetes
current-context: kubernetes
kind: Config
preferences: {}
users:
- name: test-user-2
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

# running with my other account (which uses heptio-authenticator-aws)
$ kubectl describe certificatesigningrequest.certificates.k8s.io/user-request-test-user-2
Name:               user-request-test-user-2
Labels:             <none>
Annotations:        <none>
CreationTimestamp:  Wed, 01 Aug 2018 15:20:15 +0200
Requesting User:
Status:             Approved,Issued
Subject:
         Common Name:    test-user-2
         Serial Number:
Events:  <none>

我确实为此用户创建了一个具有admin(也尝试过cluster-admin)角色的ClusterRoleBinding,但这并不重要。我不确定如何进一步调试1)是否创建了用户或2)如果错过了一些配置。

感谢您的帮助!

3 个答案:

答案 0 :(得分:1)

我今天从AWS支持部门得到了回报。

  

感谢您的耐心配合。我刚刚收到EKS团队的回音。他们已经确认aws-iam-authenticator必须与EKS一起使用,因此,无法使用证书进行认证。

我还没有听说过将来是否会支持这种方法,但是目前肯定已经解决了。

答案 1 :(得分:0)

这似乎是EKS的局限性。即使批准了CSR,用户也无法进行身份验证。我在另一个kubernetes集群上使用了相同的过程,并且运行良好。

答案 2 :(得分:0)

如本article中所述:

  

创建Amazon EKS集群时,会自动在集群的RBAC配置中为创建集群的IAM实体用户或角色(例如,针对联合用户)授予system:master权限。要授予其他AWS用户或角色与集群交互的能力,您必须在Kubernetes中编辑aws-auth ConfigMap。

  1. 检查是否对群集应用了aws-auth ConfigMap:

    kubectl describe configmap -n kube-system aws-auth
    
  2. 如果存在ConfigMap,请跳过此步骤并继续执行步骤3。 如果尚未应用ConfigMap,则应执行以下操作:

下载常规ConfigMap:

curl -O https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/aws-auth-cm.yaml

使用rolearn:中的NodeInstanceRole ARN进行调整。要获取NodeInstanceRole值,请检出this manual,您将在步骤3.8-3.10中找到它。

data:
  mapRoles: |
    - rolearn: <ARN of instance role (not instance profile)>

将此配置映射应用于集群:

kubectl apply -f aws-auth-cm.yaml

等待群集节点准备就绪:

kubectl get nodes --watch
  1. 根据以下示例编辑aws-auth ConfigMap并将用户添加到其中:

    kubectl edit -n kube-system configmap/aws-auth
    
    # Please edit the object below. Lines beginning with a '#' will be ignored,
    # and an empty file will abort the edit. If an error occurs while saving this file will be
    # reopened with the relevant failures.
    #
    apiVersion: v1
    data:
      mapRoles: |
        - rolearn: arn:aws:iam::555555555555:role/devel-worker-nodes-NodeInstanceRole-74RF4UBDUKL6
          username: system:node:{{EC2PrivateDNSName}}
          groups:
            - system:bootstrappers
            - system:nodes
      mapUsers: |
        - userarn: arn:aws:iam::555555555555:user/admin
          username: admin
          groups:
            - system:masters
        - userarn: arn:aws:iam::111122223333:user/ops-user
          username: ops-user
          groups:
            - system:masters
    

保存并退出编辑器。

  1. 按照this manual为您的IAM用户创建kubeconfig。