Question

AWS EKS群集角色面临的问题看起来像是绑定到服务帐户，它无法正常工作。

服务帐户

summarise

ClusterRole

apiVersion: v1
kind: ServiceAccount
metadata:
  name: operator
  namespace: operator

ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: operator
rules:
  - apiGroups: [""]
    resources: ["secrets", "configmaps", "services", "persistentvolumeclaims", "persistentvolumes", "pods"]
    verbs: ["create", "get", "list", "watch", "delete", "update", "patch"]

  - apiGroups: ["apps"]
    resources: ["statefulsets", "deployments"]
    verbs: ["create", "get", "list", "watch", "delete", "update", "patch"]

  - apiGroups: ["batch"]
    resources: ["cronjobs", "jobs"]
    verbs: ["create", "get", "list", "watch", "delete", "update", "patch"]

  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotclasses", "volumesnapshotcontents", "volumesnapshots", "volumesnapshotcontents/status", "volumesnapshots/status"]
    verbs: ["create", "get", "list", "watch", "delete", "update", "patch"]

集群服务器版本：v1.17.6-eks-4e7f64

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: operator
subjects:
- kind: ServiceAccount
  name: operator
  namespace: operator

Python客户端尝试使用kubernetes == 11.0.0以及kubernetes == 9.0.0和10。在pod和其他基本资源上执行操作正常。代码：

kubectl get deployments.apps -n operator operator -o yaml | grep service
  serviceAccount: operator
  serviceAccountName: operator

错误日志：

api_group = "snapshot.storage.k8s.io"
api_version = "v1beta1"
kind = "VolumeSnapshot"
namespace="default"
label_selector=""
api_response = client.CustomObjectsApi(api_client)\
     .list_namespaced_custom_object(api_group, api_version, namespace, kind,
                                    label_selector=label_selector)

也列出部署失败：

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.8/site-packages/kubernetes/client/api/custom_objects_api.py", line 1489, in list_namespaced_custom_object
    (data) = self.list_namespaced_custom_object_with_http_info(group, version, namespace, plural, **kwargs)  # noqa: E501
  File "/usr/local/lib/python3.8/site-packages/kubernetes/client/api/custom_objects_api.py", line 1595, in list_namespaced_custom_object_with_http_info
    return self.api_client.call_api(
  File "/usr/local/lib/python3.8/site-packages/kubernetes/client/api_client.py", line 340, in call_api
    return self.__call_api(resource_path, method,
  File "/usr/local/lib/python3.8/site-packages/kubernetes/client/api_client.py", line 172, in __call_api
    response_data = self.request(
  File "/usr/local/lib/python3.8/site-packages/kubernetes/client/api_client.py", line 362, in request
    return self.rest_client.GET(url,
  File "/usr/local/lib/python3.8/site-packages/kubernetes/client/rest.py", line 237, in GET
    return self.request("GET", url,
  File "/usr/local/lib/python3.8/site-packages/kubernetes/client/rest.py", line 231, in request
    raise ApiException(http_resp=r)
kubernetes.client.rest.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Audit-Id': '96d8e718-e6a8-45e5-a742-eb35dd65c8f8', 'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'X-Content-Type-Options': 'nosniff', 'Date': 'Wed, 29 Jul 2020 09:27:02 GMT', 'Content-Length': '411'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"VolumeSnapshot.snapshot.storage.k8s.io is forbidden: User \"system:serviceaccount:operator:operator\" cannot list resource \"VolumeSnapshot\" in API group \"snapshot.storage.k8s.io\" in the namespace \"default\"","reason":"Forbidden","details":{"group":"snapshot.storage.k8s.io","kind":"VolumeSnapshot"},"code":403}

任何受到高度赞赏的帮助，我真的很困惑。

Answer 1

我设法找到一种解决方案，该问题是那种类型的“ VolumeSnapshot”错误，我将其更正为kind =“ volumesnapshots”并且可以正常工作。总结一下，我可以说总是使用“群集”角色中定义的一种。小写！！

AWS EKS服务帐户集群角色绑定无法正常工作访问被禁止

1 个答案: