外部机密 AccessDenied 错误中的 aws eks答案

【问题标题】：aws eks in external-secret AccessDenied error外部机密 AccessDenied 错误中的 aws eks
【发布时间】：2022-02-16 02:59:38
【问题描述】：

那里。
Eks 正在尝试使用 external-secret，但发生了相关错误。

{"level":50,"message_time":"2021-08-17T14:01:55.862Z","pid":17,"hostname":"knowre-kubernetes-external-secrets-68dff667d9-t9zvs" ,"有效负载":{"消息":"丢失配置中的凭据，如果使用 AWS_CONFIG_FILE，请设置 AWS_SDK_LOAD_CONFIG=1","code":"CredentialsError","time":"2021-08-17T14:01:55.862Z","requestId":"44fceebd-67df-47d6-89a7-8d8470326d87","statusCode": 403,"retryable":false,"retryDelay":71.51677548097439,"originalError":{"message":"可以不加载凭据 ChainableTemporaryCredentials","code":"CredentialsError","time":"2021-08-17T14:01:55.862Z","requestId":"44fceebd-67df-47d6-89a7-8d8470326d87","statusCode":403, “可重试”：假，“重试延迟”：71.51677548097439，“原始错误”：{“消息”：“用户： arn:aws:sts::*******:assumed-role/eks-node/i-0f522dc3109b24248 是无权执行：sts:AssumeRole 对资源： arn:aws:iam::*****:role/external-secret","code":"AccessDenied","time":"2021-08-17T14:01:55.862Z","requestId":" 44fceebd-67df-47d6-89a7-8d8470326d87","statusCode":403,"retryable":false,"retryDelay":71.51677548097439}}},"msg":"失败同时轮询秘密管理/外部秘密”}

所有权限都授予管理员权限。
这是我的 yaml。

spec:
  backendType: systemManager
  # optional: specify role to assume when retrieving the data
  roleArn: arn:aws:iam::********:role/external-secret
  # optional: specify region
  region: ap-northeast-2
  data:
    - key: EKS_TEST
      name: test

      imagePullPolicy: IfNotPresent
      resources:
        {}
      env:
      - name: "AWS_REGION"
        value: "ap-northeast-2"
      - name: "POLLER_INTERVAL_MILLISECONDS"
        value: "15000"
    
      # Params for env vars populated from k8s secrets
  securityContext:
    fsGroup: 65534
    runAsNonRoot: false

授权 oidc 并建立了对 aws 角色的信任。

【问题讨论】：

标签： amazon-eks aws-parameter-store

【解决方案1】：

External Secret Operator，默认创建服务账号，勾选helm-chart values

所以，这里的问题可能是服务帐户可能没有足够的权限，即

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": [
        "arn:aws:secretsmanager:us-west-2:111122223333:secret:dev-*",
      ]
    }
  ]
}

您可以在安装期间使用支持的 helm-chart 值创建角色并指定角色，即

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Specifies annotations for this service account
  annotations: 
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: my-service-account

附：这个project 已被弃用。我建议迁移到external-secrets。

【讨论】：