如何解决Kubectl apply 未能创建 EBS 卷持久卷声明
我正在尝试使用具有以下 k8s yaml 的 EBS StorageClass 创建加密的持久卷声明:
---
#########################################################
# Encrypted storage for Redis AWS EBS
#########################################################
apiVersion: storage.k8s.io/v1
kind: StorageClass
Metadata:
name: encrypted-redis-data
provisioner: kubernetes.io/aws-ebs
reclaimPolicy: Retain
allowVolumeExpansion: true
parameters:
encrypted: "true"
---
#########################################################
# Persistent volume for redis
#########################################################
apiVersion: v1
kind: PersistentVolumeClaim
Metadata:
name: redis-data-encry
labels:
name: redis-data-encry
spec:
storageClassName: encrypted-redis-data
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 100Mi
这样做后,持久卷声明卡在“待处理”状态,并出现以下错误:
Failed to provision volume with StorageClass "encrypted-redis-data": Failed to create encrypted volume: the volume disappeared after creation,most likely due to inaccessible KMS encryption key
如何解决此问题并创建 EBS 卷?
解决方法
感谢 IronMan,我找到了答案。我向 EKS 集群添加了适当的 KMS 权限并创建了卷。答案在这里找到: https://github.com/kubernetes/kubernetes/issues/62171#issuecomment-380481349
{
"Version": "2012-10-17","Statement": [
{
"Sid": "Minimal_EBS_KMS_Create_and_Attach","Effect": "Allow","Action": [
"kms:Decrypt","kms:GenerateDataKeyWithoutPlaintext","kms:CreateGrant"
],"Resource": "key arn"
}
]
}
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。