azure - 无法使用 StorageClass 配置卷 - 无法获取存储帐户的存储 key

Question

我尝试为 Pod 部署提供 PVC，但遇到此错误:

Failed to provision volume with StorageClass "xxxxxxxxxxx": could not get storage key for storage account yyyyyyyyyyy: could not get storage key for storage account yyyyyyyyyyy: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 400, RawError: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 400, RawError: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to http://localhost:7788/subscriptions/zzzzzzzzzzz-aaaaaa-bbbbbb/resourceGroups/MC_kkkkkkkkkkkkkkkkkkkk/providers/Microsoft.Storage/storageAccounts/yyyyyyyyyyyyyyy/listKeys?api-version=2019-06-01: StatusCode=400 -- Original Error: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier 'aaaaaa-bbbbbbbb-cccccccccccccccc' was not found in the directory 'ppppppppppp-aaaaaaaaaaaa-tttttttttttt'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

我对 AKS 还很陌生，我相信我缺少一些非常重要的东西，但尚未在网络上找到任何帮助。

这是我已经仔细检查过的内容:

• 使用正确的帐户登录和订阅
• 引用的存储帐户确实存在
• 与 AKS 集群位于同一区域和资源组

存储类 list

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: xxxxxxxx
provisioner: kubernetes.io/azure-file
parameters:
  skuName: Standard_LRS
  storageAccount: yyyyyyyyyyyy
  resourceGroup: MC_zzzzzzzzzzzzzzzzz

PVC list

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
  - ReadWriteMany
  storageClassName: xxxxxxxx
  resources:
    requests:
      storage: 5Gi 

我正在使用Lens管理我的集群。 PVC 资源挂起于 Pending 状态:

你们能帮我解决一下吗？

Answer 1

根据github问题here如果集群没有服务主体或者服务主体在 1 年后过期，就会发生这种情况。

您可以通过运行以下命令来验证它。通过在任何主节点或代理节点上打开 /etc/kubernetes/azure.json 文件来检索详细信息。

az login --service-principal -u <aadClientId> -p <aadClientSecret> -t <tenantId>

按照 doc 更新或轮换凭证应该可以解决。

或者，您可以使用托管身份来获取权限，而不是使用服务主体。托管身份比服务主体更容易管理，并且不需要更新或轮换。欲了解更多信息，请参阅Use managed identities