在AWS EKS集群中,可以通过以下代码示例将“cluster creator”用户映射到“system:masters” RBAC组:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"eks:DescribeCluster",
"eks:ListClusters",
"eks:AccessKubernetesApi",
"eks:DescribeNodegroup",
"eks:ListNodegroups",
"eks:CreateFargateProfile",
"eks:DeleteFargateProfile",
"eks:DescribeFargateProfile",
"eks:ListFargateProfiles",
"eks:CreateNodegroup",
"eks:DeleteNodegroup",
"eks:UpdateNodegroupConfig",
"eks:DescribeUpdate",
"eks:ListUpdates",
"eks:TagResource",
"eks:UntagResource",
"eks:DescribeAddon",
"eks:DescribeAddonVersions",
"eks:ListAddons",
"eks:CreateAddon",
"eks:DeleteAddon"
],
"Resource": "*"
}
]
}
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapUsers: |
- userarn:
username:
groups:
- system:masters
请注意,将
替换为“cluster creator”用户的ARN,将
替换为该用户的用户名。
kubectl apply -f aws-auth-cm.yaml
这将更新Kubernetes集群的kube-system
命名空间中的aws-auth
ConfigMap。
现在,“cluster creator”用户将映射到“system:masters” RBAC组,并具有对集群的完全访问权限。
下一篇:AWS EKS集群自动扩展