EKS 流畅位无法从服务帐户承担 AWS 角色

Question

我对在帐户 AWS yyyyyyy 上的 EKS 中通过 Helm 安装的流畅位 DaemonSet 无法将数据发送到 AWS 帐户 xxxxxxxxxx 中的 Kinesis 感到非常生气。
看起来 EKS 在 IAM 上没有 OIDC 提供商，但这是错误的！你能帮我吗？

流畅的位日志：

[2022/06/29 15:22:34] [debug] [output:kinesis_firehose:kinesis_firehose.0] firehose:PutRecordBatch: events=157, payload=71245 bytes
[2022/06/29 15:22:34] [debug] [output:kinesis_firehose:kinesis_firehose.0] Sending log records to delivery stream kinesis_backend
[2022/06/29 15:22:34] [debug] [http_client] not using http_proxy for header
[2022/06/29 15:22:34] [debug] [aws_credentials] Requesting credentials from the EC2 provider..
[2022/06/29 15:22:34] [debug] [input:tail:tail.0] inode=19100461 events: IN_MODIFY 
[2022/06/29 15:22:34] [debug] [input chunk] update output instances with new chunk size diff=693
[2022/06/29 15:22:34] [debug] [input:tail:tail.0] inode=19100461 events: IN_MODIFY 
[2022/06/29 15:22:34] [debug] [http_client] server firehose.eu-west-1.amazonaws.com:443 will close connection #74
[2022/06/29 15:22:34] [debug] [aws_client] firehose.eu-west-1.amazonaws.com: http_do=0, HTTP Status: 400
[2022/06/29 15:22:34] [error] [aws_client] auth error, refreshing creds
[2022/06/29 15:22:34] [debug] [aws_credentials] Refresh called on the env provider
[2022/06/29 15:22:34] [debug] [aws_credentials] Refresh called on the profile provider
[2022/06/29 15:22:34] [debug] [aws_credentials] Reading shared config file.
[2022/06/29 15:22:34] [debug] [aws_credentials] Shared config file /root/.aws/config does not exist
[2022/06/29 15:22:34] [debug] [aws_credentials] Reading shared credentials file.
[2022/06/29 15:22:34] [error] [aws_credentials] Shared credentials file /root/.aws/credentials does not exist
[2022/06/29 15:22:34] [debug] [aws_credentials] Refresh called on the EKS provider
[2022/06/29 15:22:34] [debug] [aws_credentials] Calling STS..
[2022/06/29 15:22:34] [debug] [http_client] not using http_proxy for header
[2022/06/29 15:22:34] [debug] [http_client] server sts.eu-west-1.amazonaws.com:443 will close connection #74
[2022/06/29 15:22:34] [debug] [aws_client] sts.eu-west-1.amazonaws.com: http_do=0, HTTP Status: 400
[2022/06/29 15:22:34] [debug] [aws_client] Unable to parse API response- response is not valid JSON.
[2022/06/29 15:22:34] [debug] [aws_credentials] STS raw response: 
<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>InvalidIdentityToken</Code>
    <Message>No OpenIDConnect provider found in your account for https://oidc.eks.eu-west-1.amazonaws.com/id/AAAAAAAAAAAAAAAAAA</Message>
  </Error>
  <RequestId>c517249d-c018-43c3-a712-d0e5080ded86</RequestId>
</ErrorResponse>

命名空间 newrelic 中的

Fluent-bit 服务帐户（由 Fluentbit Helm 图表创建）

kubectl -n newrelic describe sa fluent-bit
Name:                fluent-bit
Namespace:           newrelic
Labels:              app.kubernetes.io/instance=fluent-bit
                     app.kubernetes.io/managed-by=Helm
                     app.kubernetes.io/name=fluent-bit
                     app.kubernetes.io/version=1.9.4
                     helm.sh/chart=fluent-bit-0.20.2
Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxxxx:role/kinesis-write
                     meta.helm.sh/release-name: fluent-bit
                     meta.helm.sh/release-namespace: newrelic

策略权限附加到角色 arn:aws:iam::xxxxxxxxxx:role/kinesis-write

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "firehose:PutRecord",
                "firehose:PutRecordBatch"
            ],
            "Resource": "arn:aws:firehose:region:xxxxxxxxxx:deliverystream/kinesis-backend"
        }
    ]
}

角色 arn:aws:iam::xxxxxxxxxx:role/kinesis-write 可信关系（我在帐户 yyyyyyyyyy 上为我的 EKS 集群添加了 OIDC 提供程序）

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::yyyyyyyyy:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AAAAAAAAAAAAAAAAAA"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:AssumeRoleWithWebIdentity"
            ],
            "Condition": {
                "StringEquals": {
                    "oidc.eks.eu-west-1.amazonaws.com/id/AAAAAAAAAAAAAAAAAA:sub": "system:serviceaccount:newrelic:fluent-bit"
                }
            }
        }
    ]
}

Answer 1

我创建了一个工具，因为我必须调试类似的问题。你可以尝试一下 - https://github.com/pete911/kubectl-iam4sa 当您运行

kubectl-iam4sa get -n newrelic fluent-bit

时，它也会打印云轨迹事件。可能是您缺少某些权限...或者您可以尝试通过

username: system:serviceaccount:newrelic:fluent-bit

搜索 cloudtrail