禁止:只能更新PVC状态。

Question

我安装了EFS CSI驱动程序来在EKS上挂载EFS，我遵循了Amazon EFS CSI驱动程序和aws csi-驱动程序。

我在部署PersistentVolumeClaim时遇到了以下错误。

Error from server (Forbidden): error when creating "claim.yml": persistentvolumeclaims "efs-claim" is forbidden: may only update PVC status

StorageClass.yaml -->

   kind: StorageClass
    apiVersion: storage.k8s.io/v1
    metadata:
      name: efs-sc
    provisioner: efs.csi.aws.com
    mountOptions:
      - tls  

pv.yaml -->

    apiVersion: v1
    kind: PersistentVolume
    metadata:
      name: efs-pv
    spec:
      capacity:
        storage: 5Gi
      volumeMode: Filesystem
      accessModes:
        - ReadWriteOnce
      persistentVolumeReclaimPolicy: Retain
      storageClassName: efs-sc
      csi:
        driver: efs.csi.aws.com
        volumeHandle: fs-xxxxxxxxxxx 

pvclaim.yaml -->

    apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: efs-claim
    spec:
      accessModes:
        - ReadWriteOnce
      storageClassName: efs-sc
      resources:
        requests:
          storage: 5Gi
      selector:
        matchLabels:
          name: production-environment
          role: prod 

请帮我解决这个问题

Answer 1

我用aws支持解决了这个问题。

发布决议可能会对某人有帮助。

我们从auth中删除了控制器服务器的system:nodes和system:bootstrappers权限。它解决了这个问题。

前configmap/aws-auth ->

apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::xxxxxxxxxx:role/eksctl-sc-prod-eks-cluster-NodeInstanceRole-T3B32A19KBZB
      username: system:node:{{EC2PrivateDNSName}}
    - groups:
        - system:bootstrappers
        - system:nodes
        - system:masters
      rolearn: arn:aws:iam::xxxxxxxxx:role/sc-prod-iam-ec2-instance-profile-bastion
      username: system:node:{{EC2PrivateDNSName}}
  mapUsers: |
    - userarn: arn:aws:iam::xxxxxxxxxx:user/jawad846
      username: admin
      groups:
        - system:masters

Currenlt configmap/aws-auth ->

apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::xxxxxxxxx:role/eksctl-sc-prod-eks-cluster-NodeInstanceRole-T3B32A19KBZB
      username: system:node:{{EC2PrivateDNSName}}
    - groups:
      - system:masters
      rolearn: arn:aws:iam::xxxxxxxxxx:role/sc-prod-iam-ec2-instance-profile-bastion
      username: system:node:{{EC2PrivateDNSName}}
  mapUsers: |
    - userarn: arn:aws:iam::xxxxxxxxxx:user/jawad846
      username: admin
      groups:
      - system:masters

谢谢@所有