背景： 國內(nèi)使用阿里云慣了，點點就可以完成大部分的工作，國外的AWS 大都是命令行操作，且權(quán)限設(shè)置的特別細，在創(chuàng)建集群后，給用戶授權(quán)的工作中走了很多彎路，特記錄一下。

前置條件：

1. 安裝aws cli 、eksctl 命令行工具

案例: 授予用戶對EKS集群的管理員權(quán)限

1. 把用戶與k8s 中的Group組做映射

eksctl create iamidentitymapping \
    --cluster my-cluster \
    --region=region-code \
    --arn arn:aws:iam::111122223333:user/my-user \
    --group system:masters \
    --no-duplicate-arns

2.生成kubeconfig 文件

aws eks update-kubeconfig --name eks-cluster-name --region aws-region

3.驗證

# kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.100.0.1   <none>        443/TCP   45h

案例：授予role 對EKS集群的只讀權(quán)限

1.創(chuàng)建iam role 角色

a.創(chuàng)建信任策略

創(chuàng)建一個名為?eks-connector-agent-trust-policy.json?的文件，其中包含要用于 IAM 角色的以下 JSON。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SsmControlChannel",
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateControlChannel"
            ],
            "Resource": "arn:aws:eks:*:*:cluster/*"
        },
        {
            "Sid": "ssmDataplaneOperations",
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenDataChannel",
                "ssmmessages:OpenControlChannel"
            ],
            "Resource": "*"
        }
    ]
}

b.創(chuàng)建策略

創(chuàng)建一個名為?eks-connector-agent-policy.json?的文件，其中包含要用于 IAM 角色的以下 JSON。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SsmControlChannel",
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateControlChannel"
            ],
            "Resource": "arn:aws:eks:*:*:cluster/*"
        },
        {
            "Sid": "ssmDataplaneOperations",
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenDataChannel",
                "ssmmessages:OpenControlChannel"
            ],
            "Resource": "*"
        }
    ]
}

c.創(chuàng)建AmazonEKSConnectorAgentRole 角色

使用您在之前列表項中創(chuàng)建的信任策略和策略創(chuàng)建 Amazon EKS Connector 代理角色。

aws iam create-role \
     --role-name AmazonEKSConnectorAgentRole \
     --assume-role-policy-document file://eks-connector-agent-trust-policy.json

將該策略附加到 Amazon EKS Connector 代理角色。

aws iam put-role-policy \
     --role-name AmazonEKSConnectorAgentRole \
     --policy-name AmazonEKSConnectorAgentPolicy \
     --policy-document file://eks-connector-agent-policy.json

2. 創(chuàng)建k8s rbac 權(quán)限

? eks-console-full-access.yaml? 文件內(nèi)容如下：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: eks-console-dashboard-full-access-clusterrole
rules:
- apiGroups:
  - ""
  resources:
  - nodes
  - namespaces
  - pods
  - configmaps
  - endpoints
  - events
  - limitranges
  - persistentvolumeclaims
  - podtemplates
  - replicationcontrollers
  - resourcequotas
  - secrets
  - serviceaccounts
  - services
  verbs:
  - get
  - list
- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - statefulsets
  - replicasets
  verbs:
  - get
  - list
- apiGroups:
  - batch
  resources:
  - jobs
  - cronjobs
  verbs:
  - get
  - list
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - list
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
- apiGroups:
  - events.k8s.io
  resources:
  - events
  verbs:
  - get
  - list
- apiGroups:
  - extensions
  resources:
  - daemonsets
  - deployments
  - ingresses
  - networkpolicies
  - replicasets
  verbs:
  - get
  - list
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  - networkpolicies
  verbs:
  - get
  - list
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - get
  - list
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - rolebindings
  - roles
  verbs:
  - get
  - list
- apiGroups:
  - storage.k8s.io
  resources:
  - csistoragecapacities
  verbs:
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: eks-console-dashboard-full-access-binding
subjects:
- kind: Group
  name: eks-console-dashboard-full-access-group
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: eks-console-dashboard-full-access-clusterrole
  apiGroup: rbac.authorization.k8s.io

創(chuàng)建命令

kubectl apply -f eks-console-full-access.yaml

3. 把role角色與k8s集群做映射

eksctl create iamidentitymapping \
    --cluster my-cluster \
    --region=region-code \
    --arn arn:aws:iam::111122223333:role/AmazonEKSConnectorAgentRole \
    --group eks-console-dashboard-full-access-group \
    --no-duplicate-arns

案例：授予普通用戶對k8s的權(quán)限

1.把用戶與k8s集群做映射? ?示例中的--group? 對應(yīng)k8s中的ClusterRoleBinding的Group名稱

eksctl create iamidentitymapping \
    --cluster my-cluster \
    --region=region-code \
    --arn arn:aws:iam::111122223333:user/my-user \
    --group eks-console-dashboard-full-access-group \
    --no-duplicate-arns

2.更新本地k8s的config 文件

aws eks update-kubeconfig --name eks-cluster-name --region aws-region

3.執(zhí)行kubectl 命令驗證文章來源地址http://www.zghlxwxcb.cn/news/detail-467398.html

# kubectl get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.100.0.1   <none>        443/TCP   45h

到了這里，關(guān)于AWS eks 用戶授權(quán)的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！