在 AWS 上创建集群时，Kubernetes kops 返回 IAMRolePolicy 错误答案

【问题标题】：Kubernetes kops returning IAMRolePolicy error when creating cluster on AWS在 AWS 上创建集群时，Kubernetes kops 返回 IAMRolePolicy 错误
【发布时间】：2020-11-29 18:15:29
【问题描述】：

这是我的命令：

kops 创建集群 --name=kubernetes.test123.test123 --state=s3bucket-123 --zones=us-east-1a --node-count=2 --node-size=t2.micro --master -size=t2.micro --dns-zone=kubernetes.test123.test123

我收到的输出如下：

I0809 23:20:53.462666   42621 create_cluster.go:557] Inferred --cloud=aws from zone "us-east-1a"
I0809 23:20:53.679499   42621 subnets.go:184] Assigned CIDR 172.20.32.0/19 to subnet us-east-1a
I0809 23:20:53.808364   42621 create_cluster.go:1547] Using SSH public key: /Users/evan.dullsk/.ssh/id_rsa.pub
Previewing changes that will be made:

I0809 23:20:55.268711   42621 executor.go:103] Tasks: 0 done / 87 total; 43 can run
I0809 23:20:55.834951   42621 executor.go:103] Tasks: 43 done / 87 total; 26 can run
W0809 23:20:56.198813   42621 executor.go:128] error running task "IAMRolePolicy/masters.kubernetes.test123.test123" (9m59s remaining to succeed): error rendering PolicyDocument: error opening resource: error building IAM policy: failed to generate AWS IAM Policy for Master Instance Group: failed to generate AWS IAM S3 access statements: path is not cluster readable: s3bucket-123/kubernetes.test123.test123/
W0809 23:20:56.198862   42621 executor.go:128] error running task "IAMRolePolicy/nodes.kubernetes.test123.test123" (9m59s remaining to succeed): error rendering PolicyDocument: error opening resource: error building IAM policy: failed to generate AWS IAM Policy for Node Instance Group: failed to generate AWS IAM S3 access statements: path is not cluster readable: s3bucket-123/kubernetes.test123.test123/
I0809 23:20:56.198884   42621 executor.go:103] Tasks: 67 done / 87 total; 18 can run
W0809 23:20:56.435506   42621 executor.go:128] error running task "IAMRolePolicy/masters.kubernetes.test123.test123" (9m59s remaining to succeed): error rendering PolicyDocument: error opening resource: error building IAM policy: failed to generate AWS IAM Policy for Master Instance Group: failed to generate AWS IAM S3 access statements: path is not cluster readable: s3bucket-123/kubernetes.test123.test123/
W0809 23:20:56.435535   42621 executor.go:128] error running task "IAMRolePolicy/nodes.kubernetes.test123.test123" (9m59s remaining to succeed): error rendering PolicyDocument: error opening resource: error building IAM policy: failed to generate AWS IAM Policy for Node Instance Group: failed to generate AWS IAM S3 access statements: path is not cluster readable: s3bucket-123/kubernetes.test123.test123/
I0809 23:20:56.435551   42621 executor.go:103] Tasks: 83 done / 87 total; 4 can run

我错过了什么？集群似乎仍在创建中。

【问题讨论】：

介意解释关闭的原因吗？
可能是因为这个错误：AmazonS3FullAccess failed to generate AWS IAM Policy for Master Instance Group: failed to generate AWS IAM S3 access statements: path is not cluster readable 所以请遵循以下要求：kubernetes AWS-kops, Kops AWS, S3 Bucket naming Requirements
在我看来，您与 KOPS 一起使用的 AWS 角色没有足够的权限。
@riyasyash 我缺少什么权限？

标签： amazon-web-services amazon-s3 kubernetes kops

【解决方案1】：

如果您在脚本（shell、bash 等）中运行 kops 命令，请记住脚本内的环境变量是不同的。因此，请确保您不依赖环境变量中的 AWS 凭证或任何其他 Kops 相关参数（如 AWS_ACCESS_KEY_ID、AWS_SECRET_ACCESS_KEY、NAME、KOPS_STATE_STORE 等）。我花了 3 个小时才意识到这与我的 AWS 权限无关！

仅供参考，以下是我的 AWS 用户的权限：

AmazonEC2FullAccess
AmazonRoute53FullAccess
AmazonS3FullAccess
IAMFullAccess
AmazonVPCFullAccess

【讨论】：