awseks和awsssoRBAC身份验证问题

我创建了一个新的 AWS SSO（使用内部 IDP 作为身份源，因此不使用 Active Directory）。

我能够登录 AWS CLI、AWS GUI，但无法执行任何 kubectl 操作。

error: You must be logged in to the server (Unauthorized)


我认为这与 RBAC 有关，因为我可以通过

aws eks get-token.

? cat ~/.aws/config
[profile team-sso-admin]
sso_start_url=https://team.awsapps.com/start
sso_region=us-west-2
sso_account_id=1111111111
sso_role_name=AdministratorAccess
region=us-west-2
credential_process = aws-vault exec team-sso-admin --json
? aws-vault exec team-sso-admin --debug -- zsh --login
? env | grep AWS
AWS_VAULT_PROMPT=pass
AWS_VAULT_BACKEND=pass
AWS_VAULT=team-sso-admin
AWS_DEFAULT_REGION=us-west-2
AWS_REGION=us-west-2
AWS_ACCESS_KEY_ID=xxx
AWS_SECRET_ACCESS_KEY=xxx
AWS_SESSION_TOKEN=xxx
AWS_SECURITY_TOKEN=yyy
AWS_SESSION_EXPIRATION=2021-01-11T05:55:51Z
AWS_SDK_LOAD_COnFIG=1
? aws sts get-caller-identity --output yaml
Account: '111111111111'
Arn: arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_6c71da2aa3076dfb/TestUser
UserId: XXX:TestUser
? aws eks get-token --cluster-name team-shared-eks --role arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb
{"kind": "ExecCredential", "apiVersion": "client.authentication.k8s.io/v1alpha1", "spec": {}, "status": {"expirationTimestamp": "2021-01-11T02:49:11Z", "token": "xxx"}}


配置文件

config
- name: arn:aws:eks:us-west-2:111111111111:cluster/team-shared-eks
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- --region
- us-west-2
- eks
- get-token
- --cluster-name
- team-shared-eks
- --role
- arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb
command: aws


aws-auth

mapRoles: |
- "groups":
- "system:bootstrappers"
- "system:nodes"
"rolearn": "arn:aws:iam::111111111111:role/team-shared-eks20210110051740674200000009"
"username": "system:node:{{EC2PrivateDNSName}}"
- "groups":
- "system:master"
"rolearn": "arn:aws:iam::111111111111:role/team-saml-devops"
"username": "team-devops"
- "groups":
- "system:master"
"rolearn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_67d1da2aa3076dfb"
"username": "team-sso-devops"


team-sso-devops 用户的集群角色绑定：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
creationTimestamp: "2021-01-11T01:37:51Z"
name: team:sso:devops
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: team-sso-devops
namespace: default


回答