未正確設定 RBAC 許可或繫結 - AWS Batch

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

未正確設定 RBAC 許可或繫結

如果您遇到任何 RBAC 許可或繫結問題，請確認 aws-batch Kubernetes 角色可以存取 Kubernetes 命名空間：

$ kubectl get namespace namespace --as=aws-batch
$ kubectl auth can-i get ns --as=aws-batch

您也可以使用 kubectl describe命令來檢視叢集角色或 的授權 Kubernetes 命名空間。

$ kubectl describe clusterrole aws-batch-cluster-role

下列為範例輸出。

Name:         aws-batch-cluster-role
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources                                      Non-Resource URLs  Resource Names  Verbs
  ---------                                      -----------------  --------------  -----
  configmaps                                     []                 []              [get list watch]
  nodes                                          []                 []              [get list watch]
  pods                                           []                 []              [get list watch]
  daemonsets.apps                                []                 []              [get list watch]
  deployments.apps                               []                 []              [get list watch]
  replicasets.apps                               []                 []              [get list watch]
  statefulsets.apps                              []                 []              [get list watch]
  clusterrolebindings.rbac.authorization.k8s.io  []                 []              [get list]
  clusterroles.rbac.authorization.k8s.io         []                 []              [get list]
  namespaces                                     []                 []              [get]
$ kubectl describe role aws-batch-compute-environment-role -n my-aws-batch-namespace

下列為範例輸出。

Name:         aws-batch-compute-environment-role
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources                               Non-Resource URLs  Resource Names  Verbs
  ---------                               -----------------  --------------  -----
  pods                                    []                 []              [create get list watch delete patch]
  serviceaccounts                         []                 []              [get list]
  rolebindings.rbac.authorization.k8s.io  []                 []              [get list]
  roles.rbac.authorization.k8s.io         []                 []              [get list]

若要解決此問題，請重新套用 RBAC 許可和rolebinding命令。如需詳細資訊，請參閱準備您的 Amazon EKS叢集 AWS Batch。