如何允许联邦用户访问k8s集群

Question

用户正在使用 saml federated 访问 aws。我需要给他 K9s 访问权限。 IAM 角色具有可信实体，并且 k8s 读取策略与 accessKubernetesApi。 IAM 角色

IAM 角色 arn：arn:aws:iam::123456789:role/CT/PUsers

政策：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "eks:ListFargateProfiles",
                "eks:ListNodegroups",
                "eks:ListTagsForResource",
                "eks:DescribeIdentityProviderConfig",
                "eks:ListUpdates",
                "eks:DescribeUpdate",
                "eks:AccessKubernetesApi",
                "eks:ListAddons",
                "eks:DescribeCluster",
                "eks:ListIdentityProviderConfigs"
            ],
            "Resource": [
                "arn:aws:eks:us-east-1:123456789:cluster/cluster-name",
                "arn:aws:eks:*:123456789:identityproviderconfig/*/*/*/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "eks:ListClusters",
                "eks:DescribeAddonVersions"
            ],
            "Resource": "*"
        }
    ]

错误：kubectl version

客户端版本：version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.1", GitCommit:"5e58841cce77d4bc13713ad2b91fa0d961e69192", GitTreeState:"archive", BuildDate:"1980-01-01T00 :00:00Z", GoVersion:"go1.16.4", 编译器:"gc", 平台:"darwin/amd64"} 错误：您必须登录到服务器（服务器已要求客户端提供凭据）

他的 kubeconfig

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: xxxxxxx
    server: https://xxxxxx.gr7.us-east-1.eks.amazonaws.com
  name: arn:aws:eks:us-east-1:123456789:cluster/amp-eks18
contexts:
- context:
    cluster: arn:aws:eks:us-east-1:123456789:cluster/cluster-name
    user: arn:aws:eks:us-east-1:123456789:cluster/cluster-name
  name: stage18
current-context: stage18
kind: Config
preferences: {}
users:
- name: arn:aws:eks:us-east-1:123456789:cluster/amp-eks18
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - us-east-1
      - eks
      - get-token
      - --cluster-name
      - cluster-name
      command: aws
      env: null

aws sts 获取调用者身份

{
    "UserId": "xxxxxxxxxxxxxx:name@xxx.com",
    "Account": "123456789",
    "Arn": "arn:aws:sts::123456789:assumed-role/PUsers/name@xxx.com"
}

RBAC

Data
====
mapRoles:
----

- groups:
  - xx:developers
  rolearn: arn:aws:sts::123456789:assumed-role/PUsers/name@xxx.com
  username: name@xxx.com

IAM 凭证是从 https://github.com/Nike-Inc/gimme-aws-creds 生成的

[DEFAULT]
okta_org_url = https://xxxx.okta.com
okta_auth_server =
client_id =
gimme_creds_server = appurl
aws_appname =
aws_rolename =
write_aws_creds = True
cred_profile = ihm
okta_username = xxxx@xxx.com
app_url = https://xxxx.okta.com/home/amazon_aws/xxxxx/272
resolve_aws_alias = True
include_path = True
preferred_mfa_type = push
remember_device = True
aws_default_duration = 28800
device_token =
output_format = export

谁能指出我错过了什么。

Answer 1

您需要在集群中创建 RBAC 并将其映射到用户所承担的 IAM 角色。你可以阅读更多here