AWS EKS 相关错误修复 - remote error: tls: internal error - CSR pending

现象

升级aws eks的kubernetes版本后执行kubectl logs 或者kubectl exec相关命令会出现报错
remote error: tls: internal error
执行kubectl get csr -A查看csr出现一直pending的状态,并且出现问题的pod都在新创建出来的eks node节点上

kubectl get csr -A
NAME        AGE   SIGNERNAME                      REQUESTOR                                                     REQUESTEDDURATION   CONDITION
csr-lxtzg   23h   kubernetes.io/kubelet-serving                                                                 <none>              Pending
csr-m2dlr   16h   kubernetes.io/kubelet-serving                                                                 <none>              Pending
csr-m66ft   21h   kubernetes.io/kubelet-serving                                                                 <none>              Pending
csr-m6nnk   17h   kubernetes.io/kubelet-serving                                                                 <none>              Pending
csr-m8j6l   22h   kubernetes.io/kubelet-serving                                                                 <none>              Pending
csr-mb4kz   21h   kubernetes.io/kubelet-serving                                                                 <none>              Pending
csr-mcw4w   23h   kubernetes.io/kubelet-serving                                                                 <none>              Pending

原因

执行kubectl describe cm aws-auth -n kube-system命令发现aws-auth有些role重复了，删掉重复的role就行了, 用 kubectl edit cm aws-auth -n kube-system命令可以直接编辑，或者kubectl get cm aws-auth -n kube-system -o yaml > aws-auth.yaml保存成yaml文件修改后直接apply

Name:         aws-auth
Namespace:    kube-system
Labels:       <none>
Annotations:  <none>Data
====
mapRoles:
----
- groups:- system:mastersrolearn: arn:aws:iam::xxxxxx:role/Fed_Account
- groups:- system:bootstrappers- system:nodesrolearn: arn:aws:iam::xxxxxx:role/eks-stg-shared-workerusername: system:node:{{EC2PrivateDNSName}}mapUsers:
----
[]BinaryData
====Events:  <none>

其他

如果主机名类型值是subnet的资源名称也可能会导致这种错误，或者role的policy设置不正确，例如：

    "Condition": {"ArnLike": {"aws:SourceArn": "arn:aws:eks:region-code:your-account-id:cluster/cluster-name"}}

可以试着禁用policy然后重启pod.
对于pending状态的csr可以尝试手动approve
kubectl get csr | grep Pending | awk '{print $1}' | xargs -I {} kubectl certificate approve {}
但是这对于我们的eks并没有效果

更多讨论可以参考下面的链接

https://github.com/awslabs/amazon-eks-ami/issues/610
https://stackoverflow.com/questions/71696747/kubectl-exec-logs-on-eks-returns-remote-error-tls-internal-error