Kubernetes/kops:将EBS卷附加到实例时出错.您无权执行此操作.错误403

Question

我在kops配置的AWS集群上测试了kubernetes部署和EBS卷安装.这是部署yml文件:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: helloworld-deployment-volume
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: helloworld
    spec:
      containers:
      - name: k8s-demo
        image: wardviaene/k8s-demo
        ports:
        - name: nodejs-port
          containerPort: 3000
        volumeMounts:
        - mountPath: /myvol
          name: myvolume
      volumes:
      - name: myvolume
        awsElasticBlockStore:
          volumeID: <volume_id>

之后kubectl create -f <path_to_this_yml>,我在pod描述中收到以下消息:

Attach failed for volume "myvolume" : Error attaching EBS volume "XXX" to instance "YYY": "UnauthorizedOperation: You are not authorized to perform this operation. status code: 403

看起来这只是一个权限问题.好的,我检查了节点角色的策略IAM- > Roles- > nodes.<my_domain>,发现没有允许操作卷的ec2:DescribeInstances操作,默认只有动作.所以我添加AttachVolume并DetachVolume采取行动:

    {
        "Sid": "kopsK8sEC2NodePerms",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeInstances",
            "ec2:AttachVolume",
            "ec2:DetachVolume"
        ],
        "Resource": [
            "*"
        ]
    },

这没有用.我还是得到了这个错误:

Attach failed for volume "myvolume" : Error attaching EBS volume "XXX" to instance "YYY": "UnauthorizedOperation: You are not authorized to perform this operation.

我错过了什么吗？

Answer 1

我找到了解决方案.它在这里描述.

在kops 1.8.0-beta.1中,主节点要求您使用以下标记标记AWS卷:

KubernetesCluster: <clustername-here>

因此,有必要使用以下命令创建带有该标记的EBS卷awscli:

aws ec2 create-volume --size 10 --region eu-central-1 --availability-zone eu-central-1a --volume-type gp2 --tag-specifications 'ResourceType=volume,Tags=[{Key=KubernetesCluster,Value=<clustername-here>}]'

或者您可以在EC2- > Volumes- > Your volume- >中手动标记它Tags

而已.