`AWSSupport-TroubleshootEKSNetwork`

說明

AWSSupport-TroubleshootEKSNetwork Runbook 可協助您疑難排解在 Amazon Elastic Kubernetes Service (Amazon EKS) 叢集中執行之容器中的網路連線問題。Runbook 會根據目的地類型，從流量來源和目的地收集運算和聯網統計資料。

運作方式

使用此 Runbook 對下列目的地類型的連線進行故障診斷：

POD：另一個 Kubernetes Pod。
服務：Kubernetes服務。
IP：叢集或 Amazon VPC 內部或外部的 IPv4/IPv6 地址。
DNS：叢集或 Amazon VPC 內部或外部的網域名稱。

重要

除了下列 IAM 許可，AutomationAssumeRole 必須使用支援的 Amazon EKS API 存取方法存取 Amazon EKS 叢集。對於使用存取項目的叢集，AmazonEKSViewPolicy存取政策是最低必要政策。

執行此自動化（主控台）

所需的 IAM 許可

AutomationAssumeRole 參數需要下列動作才能成功使用 Runbook。

此 Runbook 會在相同角色下執行 AWSSupport-SetupK8sApiProxyForEKS和 AWSSupport-CollectEKSLinuxNodeStatistics 子 Runbook。您的 AutomationAssumeRole 必須允許父系和子系 Runbook 執行下列動作：

cloudformation:CreateStack
cloudformation:DeleteStack
cloudformation:DescribeStackResources
cloudformation:DescribeStacks
cloudformation:UpdateStack
ec2:CreateNetworkInterface
ec2:DeleteNetworkInterface
ec2:DescribeInstances
ec2:DescribeNetworkInterfaces
ec2:DescribeRegions
ec2:DescribeRouteTables
ec2:DescribeSecurityGroups
ec2:DescribeSubnets
ec2:DescribeVpcPeeringConnections
ec2:DescribeVpcs
eks:DescribeCluster
eks:DescribeFargateProfile
iam:AttachRolePolicy
iam:CreateRole
iam:DeleteRole
iam:DeleteRolePolicy
iam:DetachRolePolicy
iam:GetRole
iam:PassRole
iam:PutRolePolicy
iam:TagRole
iam:UntagRole
lambda:CreateFunction
lambda:DeleteFunction
lambda:GetFunction
lambda:InvokeFunction
lambda:ListTags
lambda:TagResource
lambda:UntagResource
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
logs:CreateLogGroup
logs:CreateLogStream
logs:DeleteLogGroup
logs:DescribeLogGroups
logs:DescribeLogStreams
logs:ListTagsForResource
logs:PutLogEvents
logs:PutRetentionPolicy
logs:TagResource
logs:UntagResource
s3:GetBucketLocation
s3:GetObject
s3:PutObject
ssm:DescribeAutomationExecutions
ssm:DescribeAutomationStepExecutions
ssm:DescribeDocument
ssm:DescribeInstanceInformation
ssm:GetAutomationExecution
ssm:GetCommandInvocation
ssm:GetDocument
ssm:ListCommands
ssm:SendCommand
ssm:StartAutomationExecution
sts:GetCallerIdentity
tag:GetResources
tag:TagResources

下列範例政策顯示所需的最低權限許可AutomationAssumeRole。將 REGION、ACCOUNTID、DESTINATION_CLUSTER_NAME、 SOURCE_CLUSTER_NAME和取代S3_BUCKET_NAME為您自己的值：



{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EKSClusterAccess",
            "Effect": "Allow",
            "Action": "eks:DescribeCluster",
            "Resource": [
                "arn:aws:eks:REGION:ACCOUNTID:cluster/SOURCE_CLUSTER_NAME",
                "arn:aws:eks:REGION:ACCOUNTID:cluster/DESTINATION_CLUSTER_NAME"
            ]
        },
        {
            "Sid": "EKSFargateProfileAccess",
            "Effect": "Allow",
            "Action": "eks:DescribeFargateProfile",
            "Resource": [
                "arn:aws:eks:REGION:ACCOUNTID:fargateprofile/SOURCE_CLUSTER_NAME/*",
                "arn:aws:eks:REGION:ACCOUNTID:fargateprofile/DESTINATION_CLUSTER_NAME/*"
            ]
        },
        {
            "Sid": "EC2DescribePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeRouteTables",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpcPeeringConnections",
                "ec2:DescribeSubnets"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "REGION"
                }
            }
        },
        {
            "Sid": "SSMAutomationExecution",
            "Effect": "Allow",
            "Action": [
                "ssm:StartAutomationExecution",
                "ssm:GetAutomationExecution",
                "ssm:DescribeAutomationExecutions",
                "ssm:DescribeAutomationStepExecutions"
            ],
            "Resource": "arn:aws:ssm:REGION:ACCOUNTID:automation-execution/*"
        },
        {
            "Sid": "SSMDocumentAccess",
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeDocument",
                "ssm:GetDocument"
            ],
            "Resource": [
                "arn:aws:ssm:REGION:ACCOUNTID:document/AWSSupport-TroubleshootEKSNetwork",
                "arn:aws:ssm:REGION:ACCOUNTID:document/AWSSupport-SetupK8sApiProxyForEKS",
                "arn:aws:ssm:REGION:ACCOUNTID:document/AWSSupport-CollectEKSLinuxNodeStatistics",
                "arn:aws:ssm:REGION:*:document/AWS-RunShellScript"
            ]
        },
        {
            "Sid": "SSMRunCommandOnNodes",
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand",
                "ssm:GetCommandInvocation"
            ],
            "Resource": [
                "arn:aws:ec2:REGION:ACCOUNTID:instance/*",
                "arn:aws:ssm:REGION:*:document/AWS-RunShellScript"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/eks:cluster-name": [
                        "SOURCE_CLUSTER_NAME",
                        "DESTINATION_CLUSTER_NAME"
                    ]
                }
            }
        },
        {
            "Sid": "S3TroubleshootingAssets",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::S3_BUCKET_NAME/AWSSupport-CollectEKSLinuxNodeStatistics/*"
        },
        {
            "Sid": "S3BucketLocation",
            "Effect": "Allow",
            "Action": "s3:GetBucketLocation",
            "Resource": "arn:aws:s3:::S3_BUCKET_NAME"
        },
        {
            "Sid": "LambdaK8sProxyManagement",
            "Effect": "Allow",
            "Action": [
                "lambda:CreateFunction",
                "lambda:DeleteFunction",
                "lambda:GetFunction",
                "lambda:InvokeFunction",
                "lambda:UpdateFunctionCode",
                "lambda:UpdateFunctionConfiguration"
            ],
            "Resource": "arn:aws:lambda:REGION:ACCOUNTID:function:Automation-K8sProxy-*"
        },
        {
            "Sid": "CloudFormationK8sProxyStack",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStacks",
                "cloudformation:DescribeStackResources"
            ],
            "Resource": "arn:aws:cloudformation:REGION:ACCOUNTID:stack/AWSSupport-SetupK8sApiProxyForEKS-*/*"
        },
        {
            "Sid": "IAMForK8sProxyLambdaRole",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:GetRole",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:PutRolePolicy",
                "iam:DeleteRolePolicy"
            ],
            "Resource": "arn:aws:iam::ACCOUNTID:role/Automation-K8sProxy-Role-*"
        },
        {
            "Sid": "IAMPassRoleToLambda",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::ACCOUNTID:role/Automation-K8sProxy-Role-*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "lambda.amazonaws.com"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsForK8sProxy",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DeleteLogGroup"
            ],
            "Resource": "arn:aws:logs:REGION:ACCOUNTID:log-group:/aws/lambda/Automation-K8sProxy-*"
        },
        {
            "Sid": "ResourceTaggingForStackLookup",
            "Effect": "Allow",
            "Action": "tag:GetResources",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "REGION"
                }
            }
        },
        {
            "Sid": "STSCallerIdentity",
            "Effect": "Allow",
            "Action": "sts:GetCallerIdentity",
            "Resource": "*"
        }
    ]
}

除了上述AWSSupport-TroubleshootEKSNetwork僅提供許可的範例政策之外，您需要 AWSSupport-SetupK8sApiProxyForEKS和的子執行手冊執行的其他政策AWSSupport-CollectEKSLinuxNodeStatistics。下列範例政策適用於這些文件：

所需的許可AWSSupport-SetupK8sApiProxyForEKS：



{
    "Version":"2012-10-17",                   
    "Statement": [
        {
            "Action": [
                "tag:GetResources",
                "tag:TagResources",
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:DeleteNetworkInterface",
                "eks:DescribeCluster",
                "iam:GetRole",
                "cloudformation:DescribeStacks",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "lambda:GetFunction",
                "lambda:ListTags",
                "logs:ListTagsForResource"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "AllowActionsWithoutConditions"
        },
        {
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/AWSSupport-SetupK8sApiProxyForEKS": "true"
                }
            },
            "Action": "iam:CreateRole",
            "Resource": [
                "arn:aws:iam::ACCOUNTID:role/Automation-K8sProxy*"
            ],
            "Effect": "Allow",
            "Sid": "AllowCreateRoleWithRequiredTag"
        },
        {
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true"
                }
            },
            "Action": [
                "iam:DeleteRole",
                "iam:TagRole",
                "iam:UntagRole"
            ],
            "Resource": [
                "arn:aws:iam::ACCOUNTID:role/Automation-K8sProxy*"
            ],
            "Effect": "Allow",
            "Sid": "IAMActions"
        },
        {
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true"
                },
                "StringLike": {
                    "iam:PolicyARN": [
                        "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
                        "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
                    ]
                }
            },
            "Action": [
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::ACCOUNTID:role/Automation-K8sProxy*"
            ],
            "Effect": "Allow",
            "Sid": "AttachRolePolicy"
        },
        {
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true"
                }
            },
            "Action": [
                "lambda:CreateFunction",
                "lambda:DeleteFunction",
                "lambda:TagResource",
                "lambda:UntagResource",
                "lambda:UpdateFunctionCode"
            ],
            "Resource": "arn:aws:lambda:REGION:ACCOUNTID:function:Automation-K8sProxy*",
            "Effect": "Allow",
            "Sid": "LambdaActions"
        },
        {
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true"
                }
            },
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:DeleteStack",
                "cloudformation:UpdateStack"
            ],
            "Resource": "arn:aws:cloudformation:REGION:ACCOUNTID:stack/AWSSupport-SetupK8sApiProxyForEKS*",
            "Effect": "Allow",
            "Sid": "CloudFormationActions"
        },
        {
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/AWSSupport-SetupK8sApiProxyForEKS": "true"
                }
            },
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:PutRetentionPolicy",
                "logs:TagResource",
                "logs:UntagResource"
            ],
            "Resource": [
                "arn:aws:logs:REGION:ACCOUNTID:log-group:/aws/lambda/Automation-K8sProxy*",
                "arn:aws:logs:REGION:ACCOUNTID:log-group:/aws/lambda/Automation-K8sProxy*:*"
            ],
            "Effect": "Allow",
            "Sid": "LogsActions"
        },
        {
            "Condition": {
                "StringLikeIfExists": {
                    "iam:PassedToService": "lambda.amazonaws.com"
                }
            },
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::ACCOUNTID:role/Automation-K8sProxy-Role*"
            ],
            "Effect": "Allow",
            "Sid": "PassRoleToLambda"
        }
    ]
}

所需的許可AWSSupport-CollectEKSLinuxNodeStatistics：



{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetAccountPublicAccessBlock"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketAcl",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketLocation",
                "s3:GetEncryptionConfiguration"
            ],
            "Resource": "arn:aws:s3:::S3_BUCKET_NAME"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::S3_BUCKET_NAME/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeInstanceInformation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand"
            ],
            "Resource": [
                "arn:aws:ssm:*:*:document/AWS-RunShellScript",
                "arn:aws:ec2:*:ACCOUNTID:instance/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetCommandInvocation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances"
            ],
            "Resource": "*"
        }
    ]
}

指示

在文件下的 Systems Manager AWSSupport-TroubleshootEKSNetwork中開啟。
選擇 Execute automation (執行自動化)。
針對輸入參數，輸入下列內容：
- AutomationAssumeRole （選用）：
  
  允許 Systems Manager Automation 代表您執行動作的 IAM 角色 ARN。如果未指定角色，Systems Manager Automation 會使用您的許可來執行此 Runbook。
- S3BucketName （必要）：
  
  用於上傳故障診斷資產的 Amazon S3 儲存貯體名稱。
- SourceClusterName （必要）：
  
  要疑難排解的來源 Amazon EKS 叢集名稱。
- SourcePodName （必要）：
  
  啟動網路連線的來源 Kubernetes Pod 名稱。
- SourcePodNamespace （必要）：
  
  來源 Pod Kubernetes 所在的命名空間。
- DestinationType （必要）：
  
  網路連線目的地的類型。有效值：POD、SERVICE、IP 或 DNS。
- ConnectionProtocol （必要）：
  
  網路連線的通訊協定。有效值：tcp、udp 或 sctp。
- DestinationPort （必要）：
  
  網路連線目的地的連接埠。
- DestinationClusterName （選用）：
  
  目的地 Amazon EKS 叢集名稱 (POD 和 SERVICE 目的地類型需要）。
- DestinationPodName （選用）：
  
  目的地 Kubernetes Pod 的名稱 (POD 目的地類型需要）。
- DestinationPodNamespace （選用）：
  
  目的地 Pod Kubernetes 所在的命名空間 (POD 目的地類型需要）。
- DestinationServiceName （選用）：
  
  目的地Kubernetes服務的名稱 ( SERVICE 目的地類型需要）。
- DestinationServiceNamespace （選用）：
  
  目的地Kubernetes服務所在的命名空間 ( SERVICE 目的地類型需要）。
- DestinationIpAddress （選用）：
  
  目的地 IPv4 或 IPv6 地址 (IP 目的地類型需要）。
- DestinationDnsName （選用）：
  
  目的地 DNS 名稱 (DNS 目的地類型需要）。
選擇 Execute (執行)。
自動化開始。在執行索引標籤上監控執行狀態。
文件會自動執行下列步驟：
- ValidateTroubleshootingParameters:
  
  驗證故障診斷所需的輸入參數，例如叢集是否存在。
- SetupAuthProxyForSourceEKSCluster:
  
  執行 AWSSupport-SetupK8sApiProxyForEKS 文件來設定 Lambda 函數，以在來源 Amazon EKS 叢集上進行 Amazon EKS API 呼叫。
- BranchOnDestinationProxySetupRequired:
  
  決定是否根據目的地類型SetupK8sApiProxyForEKS為目的地叢集執行。
- SetupAuthProxyForDestinationEKSCluster:
  
  如有需要，請執行 AWSSupport-SetupK8sApiProxyForEKS 文件來設定目的地 Amazon EKS 叢集的 Lambda 函數。
- CollectSourcePodData:
  
  收集並驗證來源 Pod 的資訊。
- BranchOnSourcePodComputeEngine:
  
  分支說明來源 Kubernetes Pod 是否在 Amazon EC2 上執行，以收集節點的 Linux 統計資料。
- CollectSourceLinuxNodeStatistics:
  
  如果來源 Pod 在 Amazon EC2 上執行，則會執行 AWSSupport-CollectEKSLinuxNodeStatistics 文件，從來源 Pod 的節點擷取 Linux Kubernetes 統計資料。
- CollectDestinationData:
  
  收集並驗證目的地資訊。
- BranchOnDestinationResults:
  
  分支說明目的地 Kubernetes Pod 是否在 Amazon EC2 上執行，以收集節點的 Linux 統計資料。
- CollectDestinationLinuxNodeStatistics:
  
  如果目的地 Pod 在 Amazon EC2 上執行，會執行 AWSSupport-CollectEKSLinuxNodeStatistics 文件，從目的地 Amazon EKS 節點擷取 Linux 統計資料。
- CleanupAuthProxyForSourceEKSCluster:
  
  使用清除操作執行AWSSupport-SetupK8sApiProxyForEKS文件，以清除為來源叢集建立的資源。
- CleanupAuthProxyForDestinationEKSCluster:
  
  如果適用，會使用清除操作執行AWSSupport-SetupK8sApiProxyForEKS文件，以清除為目的地叢集建立的資源。
- GenerateReport:
  
  產生疑難排解流程的報告。
自動化完成後，請檢閱執行結果的輸出區段。

參考

Systems Manager Automation

如需詳細資訊，請參閱執行自動化。
如需詳細資訊，請參閱設定自動化。
如需詳細資訊，請參閱支援自動化工作流程。

您的瀏覽器已停用或無法使用 Javascript。

您必須啟用 Javascript，才能使用 AWS 文件。請參閱您的瀏覽器說明頁以取得說明。

文件慣用形式

AWSSupport-TroubleshootEbsCsiDriversForEks

AWSSupport-TroubleshootEKSALBControllerIssues