介绍
【说明】:支持 K8s 1.12 以上的版本。AWS 的 eks 通过一个公开的 OIDC(Open ID Connect Provider)支持细粒度的权限管理和控制(在OIDC里面,通过 STS 去 take IAM Role 来实现)。
有关 EKS IRSA 实现原理,请参考我的博文 https://blog.51cto.com/wzlinux/2463715
创建和配置 IAM 角色
我们用 AmazonS3ReadOnlyAccess
作为这个动手实验的例子,我们要附加一个 “AmazonS3ReadOnlyAccess” 的 aws 管理的 policy 给 iamserviceaccount。
1.创建IAM Role
创建IAM Role并绑定
eksctl create iamserviceaccount \
--name iam-test \
--namespace default \
--cluster my-cluster \
--attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess \
--approve \
--override-existing-serviceaccounts
2.确认关联IAM Role和Service Account
此处我们确认之前的步骤已经完成:
kubectl get sa iam-test
查看详细内容
kubectl describe sa iam-test
确认结果如下:
Name: iam-test
Namespace: default
Labels: app.kubernetes.io/managed-by=eksctl
Annotations: eks.amazonaws.com/role-arn: arn:aws:iam::921283538843:role/eksctl-my-cluster-addon-iamserviceaccount-de-Role1-1NV2KI61Y2NX
Image pull secrets: <none>
Mountable secrets: iam-test-token-fjn6s
Tokens: iam-test-token-fjn6s
Events: <none>
部署Pod测试
我们将进行两项测试
- job-s3.yaml,将返回执行
aws s3 ls
的结果,这个执行将成功 - job-ec2.yaml,将返回执行
aws ec2 describe-instances --region ${AWS_REGION}
的结果,这个执行将失败,因为我们没有授权
1.测试列出S3存储桶
代码如下
mkdir -p ~/environment/iam-sa/ && cd ~/environment/iam-sa/
cat <<eof> job-s3.yaml
apiVersion: batch/v1
kind: Job
metadata:
name: eks-iam-test-s3
spec:
template:
metadata:
labels:
app: eks-iam-test-s3
spec:
serviceAccountName: iam-test
containers:
- name: eks-iam-test
image: amazon/aws-cli:latest
args: ["s3", "ls"]
restartPolicy: Never
EoF
kubectl apply -f job-s3.yaml
kubectl get job -l app=eks-iam-test-s3
查询执行状态(成功)
NAME COMPLETIONS DURATION AGE
eks-iam-test-s3 1/1 11s 26s
跟踪日志
kubectl logs -l app=eks-iam-test-s3
会发现类似如下的内容(S3桶列表)
2019-10-15 07:44:15 wz-audios
2020-11-05 04:37:19 wzlinux-datalake
2020-08-14 06:40:34 wzlinux-resized-images
2020-09-02 12:15:30 wzlinux-translated-input-bucket
2020-09-02 12:14:42 wzlinux-translated-output-bucket
2020-08-14 06:29:38 wzlinx-image-resizing-de-serverlessdeploymentbuck-1nab7m0ka5ouk
2.测试列出EC2
代码如下
cd ~/environment/iam-sa
cat <<eof> job-ec2.yaml
apiVersion: batch/v1
kind: Job
metadata:
name: eks-iam-test-ec2
spec:
template:
metadata:
labels:
app: eks-iam-test-ec2
spec:
serviceAccountName: iam-test
containers:
- name: eks-iam-test
image: amazon/aws-cli:latest
args: ["ec2", "describe-instances", "--region", "eu-west-1"]
restartPolicy: Never
backoffLimit: 0
EoF
kubectl apply -f job-ec2.yaml
kubectl get job -l app=eks-iam-test-ec2
查询执行状态(会一直卡在这里,不会执行成功的,因为没有权限)
NAME COMPLETIONS DURATION AGE
eks-iam-test-ec2 0/1 26s 26s
通过跟踪日志
kubectl logs -l app=eks-iam-test-ec2
我们会发现报错如下
An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
清理环境
当你不需要时候,可以通过如下方式删除此环境
cd ~/environment/iam-sa
kubectl delete -f job-s3.yaml
kubectl delete -f job-ec2.yaml
eksctl delete iamserviceaccount \
--name iam-test \
--namespace default \
--cluster my-cluster \
--wait
欢迎大家扫码关注,获取更多信息
![](https://i-blog.csdnimg.cn/blog_migrate/5fc05734367aed6da30074f7cd9c9487.jpeg)