AWS EKS:第一个用户如何由EKS添加到system:masters组 [英] AWS EKS: How is the first user added to system:masters group by EKS

问题描述

EKS文档说

当您创建Amazon EKS集群时，会在集群的RBAC配置中自动向IAM实体(用户或角色)授予system:master权限".

"When you create an Amazon EKS cluster, the IAM entity (user or role) is automatically granted system:master permissions in the cluster's RBAC configuration".

但是在创建EKS集群之后，如果检查aws-auth配置映射，则它没有ARN映射到system:masters组.但是我能够通过kubectl访问集群.因此，如果aws-auth(heptio配置图)没有将我的ARN(我是创建EKS集群的ARN)映射到system:masters组，那么heptio aws身份验证器如何对我进行身份验证?

But after the EKS cluster creation, if you check the aws-auth config map, it does NOT have the ARN mapping to system:masters group. But I am able to access the cluster via kubectl. So if the aws-auth (heptio config map) DOES NOT have the my ARN (I was the one who created the EKS cluster) mapped to system:masters group, how does the heptio aws authenticator authenticate me?

推荐答案

我知道答案了.基本上在heptio服务器端组件上，system:master的静态映射是在/etc/kubernetes/aws-iam-authenticator/下完成的(

I got to know the answer. Basically on the heptio server side component, the static mapping for system:master is done under /etc/kubernetes/aws-iam-authenticator/ (https://github.com/kubernetes-sigs/aws-iam-authenticator#3-configure-your-api-server-to-talk-to-the-server) which is mounted into the heptio authenticator pod. Since you do not have access to this in EKS, you cant see it. However if you do invoke the /authenticate yourself with the pre-signed request, you should get the TokenReviewStatus response from heptio authenticator showing the mapping for ARN (who created the cluster) to system:master group!

这篇关于AWS EKS:第一个用户如何由EKS添加到system:masters组的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！