使用Terraform创建EKS托管节点组时遇aws-auth ConfigMap无效访问拒绝错误

我拥有一个采用Fargate计算容量的EKS集群，需要添加EKS节点组作为新增计算容量。编写Terraform脚本用于创建EKS节点组及对应的启动模板后，使用EKS集群所有者角色执行脚本时出现如下错误：

Error: error waiting for EKS Node Group to create: unexpected state 'CREATE_FAILED', wanted target 'ACTIVE'. last error: 1 error occurred:
            * : AccessDenied: The aws-auth ConfigMap in your cluster is invalid.

对应的Terraform代码如下：

#--- setup launch template for eks nodegroups ---#
resource "aws_launch_template" "eks_launch_template" {
    name = "launch-template"
    key_name = var.ssh_key_name
    block_device_mappings {
      device_name = "/dev/xvda"
      ebs {
        volume_size = var.disk_size
      }
    }  
    tag_specifications{
      resource_type= "instance"
      tags = merge(var.tags, { Name = "${local.name_prefix}-eks-node" })
    }
    tag_specifications{
      resource_type= "volume"
      tags = var.tags
    }
    tag_specifications{
      resource_type= "network-interface"
      tags = var.tags
    }
    tag_specifications{
      resource_type= "spot-instances-request"
      tags = var.tags
    }
    vpc_security_group_ids =[aws_security_group.eks_worker_node_sg.id] 
}
#--- setup eks ondemand nodegroup ---#
resource "aws_eks_node_group" "eks_on_demand" {
  cluster_name    = aws_eks_cluster.eks_cluster.name
  node_group_name = "${local.name_prefix}-group"
  node_role_arn   = aws_iam_role.eks_ec2_role.arn
  subnet_ids      = var.private_subnets
  instance_types  = var.nodegroup_instance_types
  launch_template {
    id = aws_launch_template.eks_launch_template.id
    version = aws_launch_template.eks_launch_template.latest_version
  }
  scaling_config {
    desired_size = var.desire_size
    max_size     = var.max_size
    min_size     = var.min_size
  }
  update_config {
    max_unavailable = 1
  }
  tags = var.tags
  lifecycle {
    ignore_changes = [scaling_config[0].desired_size]
  }
}
#--- eks ec2 node iam role ---#
resource "aws_iam_role" "eks_ec2_role" {
  name = "${local.name_prefix}-eks-node-role"
  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "ec2.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}
#--- attach workernode policy to ec2---#
resource "aws_iam_role_policy_attachment" "eks_ec2_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
  role       = aws_iam_role.eks_ec2_role.name
}
#--- attach cni policy to ec2---#
resource "aws_iam_role_policy_attachment" "eks_ec2_CNI_Policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
  role       = aws_iam_role.eks_ec2_role.name
}
#-- attach ecr read access policy to ec2 ---#
resource "aws_iam_role_policy_attachment" "eks_ec2_ecr_read_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
  role       = aws_iam_role.eks_ec2_role.name
}

解决方案 #

1. 修正aws-auth ConfigMap配置 #

EKS节点需要通过aws-auth ConfigMap获取集群访问权限，必须将节点组使用的IAM角色ARN添加到该ConfigMap的mapRoles部分：

• 执行命令编辑ConfigMap：

  kubectl edit configmap aws-auth -n kube-system
  

• 在mapRoles中添加节点角色的配置，示例如下：

  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: aws-auth
    namespace: kube-system
  data:
    mapRoles: |
      - rolearn: <你的节点角色ARN>
        username: system:node:{{EC2PrivateDNSName}}
        groups:
          - system:bootstrappers
          - system:nodes
  

  可直接替换<你的节点角色ARN>为Terraform中创建的aws_iam_role.eks_ec2_role.arn对应的值，也可以通过Terraform的kubectl_manifest资源自动化管理该ConfigMap。

2. 验证节点角色权限 #

你的Terraform代码已附加EKS节点所需的核心策略，确认这些策略正确绑定到节点角色，且角色的信任策略允许ec2.amazonaws.com扮演该角色。

3. 确认执行Terraform的角色权限 #

执行Terraform的集群所有者角色需要具备以下权限：

• 管理EKS节点组的权限（如eks:CreateNodegroup、eks:DescribeNodegroup等）
• 修改kube-system命名空间下ConfigMap的权限

内容的提问来源于stack exchange，提问作者Akshay Gopani