Kubectl apply 未能创建 EBS 卷持久卷声明

问题描述

我正在尝试使用具有以下 k8s yaml 的 EBS StorageClass 创建加密的持久卷声明：

    ---
#########################################################
# Encrypted storage for Redis AWS EBS
#########################################################
apiVersion: storage.k8s.io/v1
kind: StorageClass
Metadata:
  name: encrypted-redis-data
provisioner: kubernetes.io/aws-ebs
reclaimPolicy: Retain
allowVolumeExpansion: true
parameters:
  encrypted: "true"

---
#########################################################
# Persistent volume for redis
#########################################################
apiVersion: v1
kind: PersistentVolumeClaim
Metadata:
  name: redis-data-encry
  labels:
    name: redis-data-encry
spec:
  storageClassName: encrypted-redis-data
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 100Mi

这样做后，持久卷声明卡在“待处理”状态，并出现以下错误：

Failed to provision volume with StorageClass "encrypted-redis-data": Failed to create encrypted volume: the volume disappeared after creation,most likely due to inaccessible KMS encryption key

如何解决此问题并创建 EBS 卷？

解决方法

感谢 IronMan，我找到了答案。我向 EKS 集群添加了适当的 KMS 权限并创建了卷。答案在这里找到： https://github.com/kubernetes/kubernetes/issues/62171#issuecomment-380481349

{
    "Version": "2012-10-17","Statement": [
        {
            "Sid": "Minimal_EBS_KMS_Create_and_Attach","Effect": "Allow","Action": [
                "kms:Decrypt","kms:GenerateDataKeyWithoutPlaintext","kms:CreateGrant"
            ],"Resource": "key arn"
        }
    ]
}