aws-iam-authenticator 守护进程未设置运行

Question

我正在尝试在 AWS EKS 上设置 aws-iam-authenticator 容器，但我已经被困了几个小时试图让守护进程启动。我按照 aws-iam-authenticator repo, and I'm using the deploy/example.yml 上的说明作为我的参考起点。我已经修改了角色、clusterID 和其他必需的组件，但在应用部署后仍然没有成功。

我刚刚为 controller-master 启用了日志记录，所以我希望其中可能有更多详细信息。我还遇到了一个 post，其中人们提到重新启动控制器节点，但我还没有找到使用 EKS 来完成它的方法。

如果有人有快速提示或其他地方可以检查，我将不胜感激:)

$ kubectl get ds -n kube-system
    NAME                    DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR                     AGE
    aws-iam-authenticator   0         0         0       0            0           node-role.kubernetes.io/master=   8h
    aws-node                3         3         3       3            3           <none>                            3d22h
    kube-proxy              3         3         3       3            3           <none>                            3d22h

额外输出

$ kubectl get ds aws-iam-authenticator -n kube-system --output=yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"apps/v1","kind":"DaemonSet","metadata":{"annotations":{},"labels":{"k8s-app":"aws-iam-authenticator"},"name":"aws-iam-authenticator","namespace":"kube-system"},"spec":{"selector":{"matchLabels":{"k8s-app":"aws-iam-authenticator"}},"template":{"metadata":{"annotations":{"scheduler.alpha.kubernetes.io/critical-pod":""},"labels":{"k8s-app":"aws-iam-authenticator"}},"spec":{"containers":[{"args":["server","--config=/etc/aws-iam-authenticator/config.yaml","--state-dir=/var/aws-iam-authenticator","--generate-kubeconfig=/etc/kubernetes/aws-iam-authenticator/kubeconfig.yaml"],"image":"602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-iam-authenticator:v0.4.0","name":"aws-iam-authenticator","resources":{"limits":{"cpu":"100m","memory":"20Mi"},"requests":{"cpu":"10m","memory":"20Mi"}},"volumeMounts":[{"mountPath":"/etc/aws-iam-authenticator/","name":"config"},{"mountPath":"/var/aws-iam-authenticator/","name":"state"},{"mountPath":"/etc/kubernetes/aws-iam-authenticator/","name":"output"}]}],"hostNetwork":true,"nodeSelector":{"node-role.kubernetes.io/master":""},"serviceAccountName":"aws-iam-authenticator","tolerations":[{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"key":"CriticalAddonsOnly","operator":"Exists"}],"volumes":[{"configMap":{"name":"aws-iam-authenticator"},"name":"config"},{"hostPath":{"path":"/etc/kubernetes/aws-iam-authenticator/"},"name":"output"},{"hostPath":{"path":"/var/aws-iam-authenticator/"},"name":"state"}]}},"updateStrategy":{"type":"RollingUpdate"}}}
  creationTimestamp: "2020-03-24T06:47:54Z"
  generation: 4
  labels:
    k8s-app: aws-iam-authenticator
  name: aws-iam-authenticator
  namespace: kube-system
  resourceVersion: "601895"
  selfLink: /apis/extensions/v1beta1/namespaces/kube-system/daemonsets/aws-iam-authenticator
  uid: 63e8985a-54cc-49a8-b343-3e20b4d9eaff
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: aws-iam-authenticator
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ""
      creationTimestamp: null
      labels:
        k8s-app: aws-iam-authenticator
    spec:
      containers:
      - args:
        - server
        - --config=/etc/aws-iam-authenticator/config.yaml
        - --state-dir=/var/aws-iam-authenticator
        - --generate-kubeconfig=/etc/kubernetes/aws-iam-authenticator/kubeconfig.yaml
        image: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-iam-authenticator:v0.4.0
        imagePullPolicy: IfNotPresent
        name: aws-iam-authenticator
        resources:
          limits:
            cpu: 100m
            memory: 20Mi
          requests:
            cpu: 10m
            memory: 20Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /etc/aws-iam-authenticator/
          name: config
        - mountPath: /var/aws-iam-authenticator/
          name: state
        - mountPath: /etc/kubernetes/aws-iam-authenticator/
          name: output
      dnsPolicy: ClusterFirst
      hostNetwork: true
      nodeSelector:
        node-role.kubernetes.io/master: ""
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: aws-iam-authenticator
      serviceAccountName: aws-iam-authenticator
      terminationGracePeriodSeconds: 30
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
      - key: CriticalAddonsOnly
        operator: Exists
      volumes:
      - configMap:
          defaultMode: 420
          name: aws-iam-authenticator
        name: config
      - hostPath:
          path: /etc/kubernetes/aws-iam-authenticator/
          type: ""
        name: output
      - hostPath:
          path: /var/aws-iam-authenticator/
          type: ""
        name: state
  templateGeneration: 4
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
status:
  currentNumberScheduled: 0
  desiredNumberScheduled: 0
  numberMisscheduled: 0
  numberReady: 0
  observedGeneration: 4

Answer 1

问题与 nodeSelector 字段有关。根据 k8s docs for label selectors，空字符串并不总是表示通配符，其行为取决于特定 API:

的实现

The semantics of empty or non-specified selectors are dependent on the context, and API types that use selectors should document the validity and meaning of them.

我在其官方文档中没有看到 DaemonSet 的 nodeSelector 的空行为，但是这个 GCE example 特别针对 omit the nodeSelector field to schedule on all nodes，您确认它也适用于您的情况.

aws-iam-authenticator 守护进程未设置运行

aws-iam-authenticator daemon set not running

amazon-web-services

kubernetes

amazon-eks