背景： 国内使用阿里云惯了，点点就可以完成大部分的工作，国外的AWS 大都是命令行操作，且权限设置的特别细，在创建集群后，给用户授权的工作中走了很多弯路，特记录一下。
前置条件：
1. 安装aws cli 、eksctl 命令行工具
案例: 授予用户对EKS集群的管理员权限
1. 把用户与k8s 中的Group组做映射
eksctl create iamidentitymapping \
--cluster my-cluster \
--region=region-code \
--arn arn:aws:iam::111122223333:user/my-user \
--group system:masters \
--no-duplicate-arns
2.生成kubeconfig 文件
aws eks update-kubeconfig --name eks-cluster-name --region aws-region3.验证
# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.100.0.1 <none> 443/TCP 45h案例：授予role 对EKS集群的只读权限
1.创建iam role 角色
a.创建信任策略
创建一个名为 eks-connector-agent-trust-policy.json 的文件，其中包含要用于 IAM 角色的以下 JSON。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "SsmControlChannel",
"Effect": "Allow",
"Action": [
"ssmmessages:CreateControlChannel"
],
"Resource": "arn:aws:eks:*:*:cluster/*"
},
{
"Sid": "ssmDataplaneOperations",
"Effect": "Allow",
"Action": [
"ssmmessages:CreateDataChannel",
"ssmmessages:OpenDataChannel",
"ssmmessages:OpenControlChannel"
],
"Resource": "*"
}
]
}b.创建策略
创建一个名为 eks-connector-agent-policy.json 的文件，其中包含要用于 IAM 角色的以下 JSON。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "SsmControlChannel",
"Effect": "Allow",
"Action": [
"ssmmessages:CreateControlChannel"
],
"Resource": "arn:aws:eks:*:*:cluster/*"
},
{
"Sid": "ssmDataplaneOperations",
"Effect": "Allow",
"Action": [
"ssmmessages:CreateDataChannel",
"ssmmessages:OpenDataChannel",
"ssmmessages:OpenControlChannel"
],
"Resource": "*"
}
]
}c.创建AmazonEKSConnectorAgentRole 角色
使用您在之前列表项中创建的信任策略和策略创建 Amazon EKS Connector 代理角色。
aws iam create-role \
--role-name AmazonEKSConnectorAgentRole \
--assume-role-policy-document file://eks-connector-agent-trust-policy.json将该策略附加到 Amazon EKS Connector 代理角色。
aws iam put-role-policy \
--role-name AmazonEKSConnectorAgentRole \
--policy-name AmazonEKSConnectorAgentPolicy \
--policy-document file://eks-connector-agent-policy.json2. 创建k8s rbac 权限
eks-console-full-access.yaml 文件内容如下：
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: eks-console-dashboard-full-access-clusterrole
rules:
- apiGroups:
- ""
resources:
- nodes
- namespaces
- pods
- configmaps
- endpoints
- events
- limitranges
- persistentvolumeclaims
- podtemplates
- replicationcontrollers
- resourcequotas
- secrets
- serviceaccounts
- services
verbs:
- get
- list
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- statefulsets
- replicasets
verbs:
- get
- list
- apiGroups:
- batch
resources:
- jobs
- cronjobs
verbs:
- get
- list
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- get
- list
- apiGroups:
- events.k8s.io
resources:
- events
verbs:
- get
- list
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- ingresses
- networkpolicies
- replicasets
verbs:
- get
- list
- apiGroups:
- networking.k8s.io
resources:
- ingresses
- networkpolicies
verbs:
- get
- list
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- get
- list
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
- roles
verbs:
- get
- list
- apiGroups:
- storage.k8s.io
resources:
- csistoragecapacities
verbs:
- get
- list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: eks-console-dashboard-full-access-binding
subjects:
- kind: Group
name: eks-console-dashboard-full-access-group
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: eks-console-dashboard-full-access-clusterrole
apiGroup: rbac.authorization.k8s.io创建命令
kubectl apply -f eks-console-full-access.yaml3. 把role角色与k8s集群做映射
eksctl create iamidentitymapping \
--cluster my-cluster \
--region=region-code \
--arn arn:aws:iam::111122223333:role/AmazonEKSConnectorAgentRole \
--group eks-console-dashboard-full-access-group \
--no-duplicate-arns
案例：授予普通用户对k8s的权限
1.把用户与k8s集群做映射 示例中的--group 对应k8s中的ClusterRoleBinding的Group名称
eksctl create iamidentitymapping \
--cluster my-cluster \
--region=region-code \
--arn arn:aws:iam::111122223333:user/my-user \
--group eks-console-dashboard-full-access-group \
--no-duplicate-arns
2.更新本地k8s的config 文件文章来源：https://www.toymoban.com/news/detail-467398.html
aws eks update-kubeconfig --name eks-cluster-name --region aws-region3.执行kubectl 命令验证文章来源地址https://www.toymoban.com/news/detail-467398.html
# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.100.0.1 <none> 443/TCP 45h到了这里，关于AWS eks 用户授权的文章就介绍完了。如果您还想了解更多内容，请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章，希望大家以后多多支持TOY模板网！
