AWS CodeBuild kubectl apply -f 无法识别：未经授权

Question

构建过程因以下错误而失败：

[Container] 2019/12/12 08:07:41 Running command kubectl apply -f simple_jwt_api.yml 
unable to recognize "simple_jwt_api.yml": Unauthorized 
unable to recognize "simple_jwt_api.yml": Unauthorized 
[Container] 2019/12/12 08:07:43 Command did not exit successfully kubectl apply -f simple_jwt_api.yml exit status 1 
[Container] 2019/12/12 08:07:43 Phase complete: POST_BUILD State: FAILED 
[Container] 2019/12/12 08:07:43 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: kubectl apply -f simple_jwt_api.yml. Reason: exit status 1 

simple_jwt_api.yml 文件： simple_jwt_api.yml

构建脚本文件： buildspec.yml

构建日志：

[Container] 2019/12/12 08:07:41 Running command kubectl apply -f simple_jwt_api.yml 
unable to recognize "simple_jwt_api.yml": Unauthorized 
unable to recognize "simple_jwt_api.yml": Unauthorized 

[Container] 2019/12/12 08:07:43 Command did not exit successfully kubectl apply -f simple_jwt_api.yml exit status 1 
[Container] 2019/12/12 08:07:43 Phase complete: POST_BUILD State: FAILED 
[Container] 2019/12/12 08:07:43 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: kubectl apply -f simple_jwt_api.yml. Reason: exit status 1 
[Container] 2019/12/12 08:07:43 Expanding base directory path: . 
[Container] 2019/12/12 08:07:43 Assembling file list 
[Container] 2019/12/12 08:07:43 Expanding . 
[Container] 2019/12/12 08:07:43 Expanding file paths for base directory . 
[Container] 2019/12/12 08:07:43 Assembling file list 
[Container] 2019/12/12 08:07:43 Expanding build.json 
[Container] 2019/12/12 08:07:43 Skipping invalid file path build.json 
[Container] 2019/12/12 08:07:43 Phase complete: UPLOAD_ARTIFACTS State: FAILED 
[Container] 2019/12/12 08:07:43 Phase context status code: CLIENT_ERROR Message: no matching artifact paths found 

Answer 1

Buildspec 看起来不错，所以我怀疑您的 CodeBuild 服务角色在其 ARN (/service-role/) 中有一个“路径”，已知这会在使用 iam 身份验证器对 EKS 进行身份验证时导致问题。

您能否在另一个可能有帮助的线程上查看我的这个答案：

• 在 CodeBuild 阶段运行 kubectl apply -f hello-k8s.yml 时出现“Unable to recognize \"hello-k8s.yml\": Unauthorized" 错误

还要检查“身份验证器”EKS 控制平面日志，它可能会提供有关“未授权”错误的一些线索：

• Amazon EKS 控制平面日志记录 - https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html

Answer 2

我遇到了同样的问题。 但是，对我来说，原因是文档“/tmp/aws-auth-patch.yml”

我没有正确添加角色。

第一次，我将它添加到 mapUsers 而不是 mapRoles。

其次，我忘了更换 ACCOUNT_ID

第三次，我用错了格式。

• 角色学习：arn:aws:iam::<ACCOUNT_ID>:role/UdacityFlaskDeployCBKubectlRole 用户名：构建组：
  • 系统：大师

它应该是

• 团体：
  • system:masters rolearn: arn:aws:iam::<ACCOUNT_ID>:role/UdacityFlaskDeployCBKubectlRole 用户名：build

然后我得到了正确的结果。