使用eksctl部署EKS群集后无法获取群集资源

时间:2019-10-15 11:29:49

标签: kubernetes eks eksctl

我正尝试使用eksctl部署Kubernetes集群,

该集群已创建,但是我发现我遇到了权限问题,并且无法从我的控制平面服务器访问Kubernetes资源。 这是我得到的错误:

eksctl get iamidentitymapping --region us-east-1 --name management
[✖]  getting auth ConfigMap: configmaps "aws-auth" is forbidden: User "system:node:ip-10-100-2-68.ec2.internal" cannot get resource "configmaps" in API group "" in the namespace "kube-system": no path found to object

我已经使用eksctl的配置文件部署了集群:

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: Management
  region: us-east-1
vpc:
  id: "vpc-581111"
  cidr: "10.100.0.0/16"
  subnets:
    private:
      us-east-1d:
        id: "subnet-5f566317"
        cidr: "10.100.1.0/24"
      us-east-1e:
        id: "subnet-0140f96070e359d90"
        cidr: "10.100.2.0/24"
iam:
  serviceRoleARN: "arn:aws:iam::444444444444:role/Prod-Builder-Role"

nodeGroups:
  - name: worker-1

    instanceType: t3.medium
    desiredCapacity: 1
    iam:
      instanceProfileARN: "arn:aws:iam::444444444444:instance-profile/Panpwr-Management-BuilderInstanceProfile-Y5WPPKASB38K"
      instanceRoleARN: "arn:aws:iam::444444444444:role/Prod-Builder-Role"
    privateNetworking: true
    securityGroups:
      withShared: true
      withLocal: true
      attachIDs: ['sg-07b5fc3403e0d76e0', 'sg-ad9d6bdf']
    tags:
      'environment:': 'management'

serviceRoleARN:“ arn:aws:iam :: 444444444444:role / Prod-Builder-Role” 从AWS的角度来看,它具有所有必需的权限,我看到我需要更改aws-auth config-map,但是我没有访问configmap的权限。

任何帮助都会得到批准。

1 个答案:

答案 0 :(得分:0)

forbidden: User "system:node:ip-10-100-2-68.ec2.internal" cannot get resource "configmaps" in API group ""

基本上,您的用户(system:node:ip-10-10 ..)没有API组。 同一集群上的超级用户(具有system:master组)应通过设置--group system:masters

在master组中添加“ system:node:ip-10-100-2-68.ec2.internal”