Question

我一直在尝试使MFA与kubectl一起使用，以确保对AWS中EKS主机的访问权限。文件似乎暗示这是可能的，但我遇到了问题，无法解决。

没有什么特别的事情，我可以连接到我的EKS集群：

kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   172.20.0.1   <none>        443/TCP   2d

如果我将MFA添加到AWS CLI，请遵循以下帖子：

How to use MFA with AWS CLI?

https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html

我像这样设置本地凭据：

[default]
aws_access_key_id = **********************
aws_secret_access_key = **********************
region = us-west-2

[default_role]
mfa_serial = arn:aws:iam::1234567890:mfa/spanktar
role_arn = arn:aws:iam::1234567890:role/test_assumeRole
source_profile = default

...然后我可以看到AWS CLI具有MFA：

aws sts get-caller-identity --profile default_role
Enter MFA code for arn:aws:iam::1234567890:mfa/spanktar: 123456
{
    "UserId": "**********************:botocore-session-1234567890",
    "Account": "1234567890",
    "Arn": "arn:aws:sts::1234567890:assumed-role/test_assumeRole/botocore-session-1234567890"
}

然后我可以验证：

aws sts assume-role --role-arn arn:aws:iam::1234567890:role/test_assumeRole --role-session-name default_role
{
    "Credentials": {
        "AccessKeyId": "**********************",
        "SecretAccessKey": "**********************",
        "SessionToken": "FOO",
        "Expiration": "2018-10-11T21:19:20Z"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "**********************:default_role",
        "Arn": "arn:aws:sts::1234567890:assumed-role/test_assumeRole/default_role"
    }
}

kubectl仍然可以正常使用，因为它尚未使用配置文件：

kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   172.20.0.1   <none>        443/TCP   2d

然后我按照this documentation

设置k8以使用配置文件

users:
- name: aws
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws-iam-authenticator
      env:
      - name: "AWS_PROFILE"
        value: "default_role"
      args:
        - "token"
        - "-i"
        - "test-eks-cluster"

因此，现在当我尝试kubectl时，它会要求MFA，但永远无法满足：

kubectl get svc
Assume Role MFA token code: 123456
Assume Role MFA token code: 123456
could not get token: AccessDenied: MultiFactorAuthentication failed with invalid MFA one time pass code.
    status code: 403, request id: 123456-cd93-11e8-80a5-1234567898765
E1011 13:22:07.385200   28191 exec.go:230] refreshing credentials: exec: exit status 1
No resources found.
error: You must be logged in to the server (Unauthorized)

AWS角色test_assumeRole如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::1234567890:user/spanktar"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

相关政策test_assumePolicy如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::1234567890:role/test_assumeRole"
        }
    ]
}

那么，这些问题：

我需要将其中任何一个附加到IAM用户吗？文档似乎没有建议。
我在这里想让它运行什么？看来几乎已正确连接。

Answer 1

我遇到了同样的问题，并通过在Kubectl配置文件中添加了-r选项来解决了这个问题。

在您的情况下，它看起来像这样：

users:
- name: aws
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws-iam-authenticator
      env:
      - name: "AWS_PROFILE"
        value: "default_role"
      args:
        - "token"
        - "-i"
        - "test-eks-cluster"
        - "-r"
        - "arn:aws:iam::1234567890:role/test_assumeRole"

我希望这对您也有用。

将MFA与EKS一起使用kubectl和aws-iam-authenticator

1 个答案: