AWS EKS fargate coredns ImagePullBackOff

Question

我正在尝试将一个简单的教程应用程序部署到一个新的基于 fargate 的 kubernetes 集群。

不幸的是，我卡在了 coredns pod 的 ImagePullBackOff 上：

Events:
  Type     Reason           Age                  From               Message
  ----     ------           ----                 ----               -------
  Warning  LoggingDisabled  5m51s                fargate-scheduler  Disabled logging because aws-logging configmap was not found. configmap "aws-logging" not found
  Normal   Scheduled        4m11s                fargate-scheduler  Successfully assigned kube-system/coredns-86cb968586-mcdpj to fargate-ip-172-31-55-205.eu-central-1.compute.internal
  Warning  Failed           100s                 kubelet            Failed to pull image "602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1": rpc error: code = Unknown desc = failed to pull and unpack image "602

401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1": failed to resolve reference "602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1": failed to do request: Head "https://602401143452.dkr.

ecr.eu-central-1.amazonaws.com/v2/eks/coredns/manifests/v1.8.0-eksbuild.1": dial tcp 3.122.9.124:443: i/o timeout
  Warning  Failed           100s                 kubelet            Error: ErrImagePull
  Normal   BackOff          99s                  kubelet            Back-off pulling image "602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1"
  Warning  Failed           99s                  kubelet            Error: ImagePullBackOff
  Normal   Pulling          87s (x2 over 4m10s)  kubelet            Pulling image "602401143452.dkr.ecr.eu-central-1.amazonaws.com/eks/coredns:v1.8.0-eksbuild.1"

我在谷歌搜索时发现 https://aws.amazon.com/premiumsupport/knowledge-center/eks-ecr-troubleshooting/ 它包含以下列表：

To resolve this error, confirm the following:

 - The subnet for your worker node has a route to the internet. Check the route table associated with your subnet.
 - The security group associated with your worker node allows outbound internet traffic.
 - The ingress and egress rule for your network access control lists (ACLs) allows access to the internet.

由于我已经手动创建了我的私有子网及其 NAT 网关，所以我试图在此处找到问题，但找不到任何东西。他们以及安全组和 ACL 对我来说都很好。

我什至将 AmazonEC2ContainerRegistryReadOnly 添加到我的 EKS 角色中，但在发出命令后 kubectl rollout restart -n kube-system deployment coredns 不幸的是，结果是一样的：ImagePullBackOff

不幸的是，我的想法用完了，我被困住了。任何可以帮助我解决此问题的帮助将不胜感激。 ~谢谢

编辑>

按照@mreferre 在他的评论中的建议，通过 *eksctl 创建新集群后，我收到 link 的 RBAC 错误：https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting_iam.html#security-iam-troubleshoot-cannot-view-nodes-or-workloads

我不确定发生了什么，因为我已经有了

编辑>>

通过 AWS 控制台（网络界面）创建的集群没有 configmap aws-auth 我已经使用命令 kubectl edit configmap aws-auth -n kube-system[= 检索了下面的配置图20=]

apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      - system:node-proxier
      rolearn: arn:aws:iam::370179080679:role/eksctl-tutorial-cluster-FargatePodExecutionRole-1J605HWNTGS2Q
      username: system:node:{{SessionName}}
kind: ConfigMap
metadata:
  creationTimestamp: "2021-04-08T18:42:59Z"
  name: aws-auth
  namespace: kube-system
  resourceVersion: "918"
  selfLink: /api/v1/namespaces/kube-system/configmaps/aws-auth
  uid: d9a21964-a8bf-49e9-800f-650320b7444e

Answer 1

创建一个答案来总结评论中认为可以接受的讨论。设置支持 Fargate 的 EKS 集群的最常见（并且可以说更简单）的方法是使用 EKSCTL and setup the cluster using eksctl create cluster --fargate. This will build all the plumbing for you and you will get a cluster with no EC2 instances nor managed node groups with the two CoreDNS pods deployed on two Fargate instances. Note that when you deploy EKSCTL via the command line you may end up using different roles/users between your CLI and console. This may result in access denied issues. Best course of action would be to use a non-root user to login into the AWS console and use CloudShell 通过 EKSCTL 进行部署（CloudShell 将继承相同的控制台用户身份）。 {更多信息在评论中}

AWS EKS fargate coredns ImagePullBackOff

AWS EKS fargate coredns ImagePullBackOff

amazon-web-services

kubernetes

docker-registry

aws-fargate

kubernetes-pod