EKS私有子网节点aws-node DaemonSet添加SNAT禁用变量失败求助

Let's get that AWS_VPC_K8S_CNI_EXTERNALSNAT=true environment variable added to your aws-node DaemonSet without using kubectl edit—perfect for your upcoming Ansible automation. The invalid JSON error you're hitting is almost certainly due to an incorrect patch path or structure. Here's how to resolve it:

Correct kubectl Patch Commands #

You have two reliable, automation-friendly options to apply the patch:

1. JSON Patch (Exact, Non-Destructive) #

This method explicitly appends the new environment variable to the existing list, so you won't accidentally overwrite other env vars:

kubectl patch daemonset aws-node -n kube-system --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "AWS_VPC_K8S_CNI_EXTERNALSNAT", "value": "true"}}]'

• The - at the end of env/- tells Kubernetes to add the new var to the end of the environment array.
• containers/0 targets the first (and only) container in the aws-node pod spec—safe since this DaemonSet only runs one container.

2. Merge Patch (Simpler, Readable Syntax) #

If you prefer a more intuitive structure, use a merge patch. We target the container by name to avoid any ambiguity:

kubectl patch daemonset aws-node -n kube-system --type merge -p '{"spec":{"template":{"spec":{"containers":[{"name":"aws-node","env":[{"name":"AWS_VPC_K8S_CNI_EXTERNALSNAT","value":"true"}]}]}}}'

Verify the Patch Worked #

Run this command to confirm the environment variable was added successfully:

kubectl get daemonset aws-node -n kube-system -o jsonpath='{.spec.template.spec.containers[0].env[?(@.name=="AWS_VPC_K8S_CNI_EXTERNALSNAT")]}'

You should see output like:

{"name":"AWS_VPC_K8S_CNI_EXTERNALSNAT","value":"true"}

Ansible Automation Ready #

For your Ansible playbook, use the Kubernetes core module to replicate this patch consistently. Here's a sample task:

- name: Disable SNAT on EKS private subnet worker nodes
  kubernetes.core.k8s:
    state: patched
    kind: DaemonSet
    namespace: kube-system
    name: aws-node
    definition:
      spec:
        template:
          spec:
            containers:
              - name: aws-node
                env:
                  - name: AWS_VPC_K8S_CNI_EXTERNALSNAT
                    value: "true"
    merge_type: merge

This uses the same merge logic as the kubectl patch command above, making it straightforward to translate your manual fix into automated infrastructure as code.

Common Pitfalls to Avoid #

• Incorrect Path: If your original patch missed containers/0 or used an invalid path for env, Kubernetes would reject it as invalid JSON.
• String Values: Ensure "true" is quoted—Kubernetes environment variables are always string-typed, even for boolean settings.

内容的提问来源于stack exchange，提问作者David