需要有关Kubernetes的卷挂载问题的帮助 [英] Need help on volume mount issue with kubernetes
问题描述
我使用以下方法创建了启用RBAC的kubernetes集群 kops版本 1.8.0-beta.1 ,我正在尝试运行nginx容器,该容器应附加预先创建的EBS卷,并且容器应该开始.但是,即使我是 admin 用户,也会遇到未经授权的问题.任何帮助将不胜感激.
I have RBAC enabled kubernetes cluster created using kops version 1.8.0-beta.1, I am trying to run a nginx pod which should attach pre-created EBS volume and pod should start. But getting issue as not authorized even though i am a admin user. Any help would be highly appreciated.
kubectl version Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.3", GitCommit:"f0efb3cb883751c5ffdbe6d515f3cb4fbe7b7acd", GitTreeState:"clean", BuildDate:"2017-11-09T07:27:47Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.3", GitCommit:"f0efb3cb883751c5ffdbe6d515f3cb4fbe7b7acd", GitTreeState:"clean", BuildDate:"2017-11-08T18:27:48Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
namespace:default
cat test-ebs.yml
cat test-ebs.yml
apiVersion: v1
kind: Pod
metadata:
name: test-ebs
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- mountPath: /test-ebs
name: test-volume
volumes:
- name: test-volume
awsElasticBlockStore:
volumeID: <vol-IDhere>
fsType: ext4
我收到以下错误:
Warning FailedMount 8m attachdetach AttachVolume.Attach failed for volume "test-volume" : Error attaching EBS volume "<vol-ID>" to instance "<i-instanceID>": "UnauthorizedOperation: You are not authorized to perform this operation
推荐答案
在kops 1.8.0-beta.1中,主节点要求您使用以下命令标记AWS卷:
In kops 1.8.0-beta.1, master node requires you to tag the AWS volume with:
KubernetesCluster: <clustername-here>
如果您使用像这样的kops创建了k8s集群:
If you have created the k8s cluster using kops like so:
kops create cluster --name=k8s.yourdomain.com [other-args-here]
您在EBS卷上的标签必须为
your tag on the EBS volume needs to be
KubernetesCluster: k8s.yourdomain.com
master上的策略将包含一个块,其中将包含:
And the policy on master would contain a block which would contain:
{
"Sid": "kopsK8sEC2MasterPermsTaggedResources",
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteRoute",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DetachVolume",
"ec2:RevokeSecurityGroupIngress"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/KubernetesCluster": "k8s.yourdomain.com"
}
}
}
该条件表明master-policy有权仅附加包含正确标签的卷.
The condition indicates that master-policy has privilege to only attach volumes which contain the right tag.
这篇关于需要有关Kubernetes的卷挂载问题的帮助的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!