amazon-eks - 使用 eksctl 设置时无法使用 ssh 访问 EKS 工作节点

Question

使用 eksctl 工具在 AWS 上创建 EKS 集群后，无法使用 ssh 访问工作机​​器。出了什么问题？

Marcs-MBP:kubernetes tests marc$ eksctl create cluster --name=mycluster --ssh-public-key=~/.ssh/id_rsa.pub 
2018-10-08T08:09:17+02:00 [ℹ]  setting availability zones to [us-west-2c us-west-2b us-west-2a]
2018-10-08T08:09:17+02:00 [ℹ]  using "ami-08cab282f9979fc7a" for nodes
2018-10-08T08:09:17+02:00 [ℹ]  creating EKS cluster "mycluster" in "us-west-2" region
2018-10-08T08:09:17+02:00 [ℹ]  will create 2 separate CloudFormation stacks for cluster itself and the initial nodegroup
2018-10-08T08:09:17+02:00 [ℹ]  if you encounter any issues, check CloudFormation console or try 'eksctl utils describe-stacks --region=us-west-2 --name=mycluster'
2018-10-08T08:09:17+02:00 [ℹ]  creating cluster stack "eksctl-mycluster-cluster"
2018-10-08T08:21:12+02:00 [ℹ]  creating nodegroup stack "eksctl-mycluster-nodegroup-0"
2018-10-08T08:24:54+02:00 [✔]  all EKS cluster resource for "mycluster" had been created
2018-10-08T08:24:54+02:00 [✔]  saved kubeconfig as "/Users/marc/.kube/config"
2018-10-08T08:24:56+02:00 [ℹ]  the cluster has 0 nodes
2018-10-08T08:24:56+02:00 [ℹ]  waiting for at least 2 nodes to become ready
2018-10-08T08:25:29+02:00 [ℹ]  the cluster has 2 nodes
2018-10-08T08:25:29+02:00 [ℹ]  node "ip-192-168-121-173.us-west-2.compute.internal" is ready
2018-10-08T08:25:29+02:00 [ℹ]  node "ip-192-168-228-63.us-west-2.compute.internal" is ready
2018-10-08T08:25:32+02:00 [ℹ]  kubectl command should work with "/Users/marc/.kube/config", try 'kubectl get nodes'
2018-10-08T08:25:32+02:00 [✔]  EKS cluster "mycluster" in "us-west-2" region is ready

现在添加了从任何地方到安全组的 SSH 访问:sg-09a1acc782f2222cd，名称为 eksctl-mycluster-nodegroup-0-SG-4KUHPKAY90D1。

Marcs-MBP:kubernetes tests marc$ ssh -i ~/.ssh/id_rsa.pub ec2-user@ec2-35-166-200-64.us-west-2.compute.amazonaws.com
The authenticity of host 'ec2-35-166-200-64.us-west-2.compute.amazonaws.com (35.166.200.64)' can't be established.
ECDSA key fingerprint is SHA256:dDeYNRVqovc+pb3oEm271J4K+2OAcFvXSddUoZJTHRk.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'ec2-35-166-200-64.us-west-2.compute.amazonaws.com,35.166.200.64' (ECDSA) to the list of known hosts.
ec2-user@ec2-35-166-200-64.us-west-2.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
Marcs-MBP:kubernetes tests marc$ 

我不清楚如何使用 ssh 访问我的工作机器。谁知道出了什么问题？

使用 eksctl 版本

Marcs-MacBook-Pro:~ marc$ eksctl version
2018-10-08T08:44:49+02:00 [ℹ]  versionInfo = map[string]string{"builtAt":"2018-09-12T14:57:03Z", "gitCommit":"2f553a2c54eb1390a7eb6746ccdc5da106fe518b", "gitTag":"0.1.2"}

Answer 1

运行 eksctl create cluster 时需要指定 --ssh-access 选项。指定后，您可以在创建过程中看到以下日志消息:

[ℹ]  importing SSH public key "/home/<USER_NAME>/.ssh/id_rsa.pub" as "eksctl-xxx-nodegroup-ng-a4cd5bb2-xx:xx:xx:xx:xx:xx:xx"

然后，你可以通过 ec2-user ssh 进入主机:

 ssh -i /home/<USER_NAME>/.ssh/id_rsa.pub ec2-user@ec2-xx-xx-xx-xx