我一直在关注这篇文章，以创建对我的kubernetes集群(在AmazonEKS上运行(的用户访问权限。我确实创建了密钥csr，批准了请求，并为用户下载了证书。然后我用密钥和crt创建了一个kubeconfig文件。当我使用这个kubeconfig运行kubectl时，我被识别为system:anonymous。
$ kubectl --kubeconfig test-user-2.kube.yaml get pods
Error from server (Forbidden): pods is forbidden: User "system:anonymous" cannot list pods in the namespace "default"
我本以为用户会被识别，但却被拒绝访问。
$ kubectl --kubeconfig test-user-2.kube.yaml version
Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.1", GitCommit:"b1b29978270dc22fecc592ac55d903350454310a", GitTreeState:"clean", BuildDate:"2018-07-18T11:37:06Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.3", GitCommit:"2bba0127d85d5a46ab4b778548be28623b32d0b0", GitTreeState:"clean", BuildDate:"2018-05-28T20:13:43Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
$ kubectl --kubeconfig test-user-2.kube.yaml config view
apiVersion: v1
clusters:
- cluster:
insecure-skip-tls-verify: true
server: REDACTED
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: test-user-2
name: kubernetes
current-context: kubernetes
kind: Config
preferences: {}
users:
- name: test-user-2
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
# running with my other account (which uses heptio-authenticator-aws)
$ kubectl describe certificatesigningrequest.certificates.k8s.io/user-request-test-user-2
Name: user-request-test-user-2
Labels: <none>
Annotations: <none>
CreationTimestamp: Wed, 01 Aug 2018 15:20:15 +0200
Requesting User:
Status: Approved,Issued
Subject:
Common Name: test-user-2
Serial Number:
Events: <none>
我确实为该用户创建了一个具有admin(也尝试过cluster-admin(角色的ClusterRoleBinding，但这对本步骤来说并不重要。我不确定如何进一步调试1(是否创建了用户，或者2(是否错过了一些配置。
感谢您的帮助！
如本文所述：
创建Amazon EKS集群时，创建集群的IAM实体用户或角色(例如，联邦用户(将在集群的RBAC配置中自动授予system:master权限。要授予其他AWS用户或角色与集群交互的能力，您必须在Kubernetes中编辑AWS-auth-ConfigMap。
-
检查您的集群是否应用了aws-auth-ConfigMap：
kubectl describe configmap -n kube-system aws-auth -
如果存在ConfigMap，请跳过此步骤，继续执行步骤3。如果尚未应用ConfigMap，则应执行以下操作：
下载股票配置映射：
curl -O https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/aws-auth-cm.yaml
使用rolearn:中的NodeInstanceRole ARN进行调整。要获得NodeInstanceRole值，请查看本手册，您将在步骤3.8-3.10中找到它。
data:
mapRoles: |
- rolearn: <ARN of instance role (not instance profile)>
将此配置映射应用于集群：
kubectl apply -f aws-auth-cm.yaml
等待群集节点就绪：
kubectl get nodes --watch
编辑
aws-authConfigMap并根据以下示例向其添加用户：kubectl edit -n kube-system configmap/aws-auth # Please edit the object below. Lines beginning with a '#' will be ignored, # and an empty file will abort the edit. If an error occurs while saving this file will be # reopened with the relevant failures. # apiVersion: v1 data: mapRoles: | - rolearn: arn:aws:iam::555555555555:role/devel-worker-nodes-NodeInstanceRole-74RF4UBDUKL6 username: system:node:{{EC2PrivateDNSName}} groups: - system:bootstrappers - system:nodes mapUsers: | - userarn: arn:aws:iam::555555555555:user/admin username: admin groups: - system:masters - userarn: arn:aws:iam::111122223333:user/ops-user username: ops-user groups: - system:masters
保存并退出编辑器。
- 按照本手册为IAM用户创建kubeconfig
我今天从AWS支持部门得到了回复。
感谢您的耐心等待。我刚刚收到心电图小组的回复。他们已经确认aws-iam验证器必须与EKS一起使用，因此，无法使用证书进行身份验证。
我还没有听说这在未来是否会得到支持，但目前肯定已经崩溃了。
这似乎是EKS的一个限制。即使CSR获得批准，用户也无法进行身份验证。我在另一个kubernetes集群上使用了相同的过程，它运行得很好。