- Newest
- Most votes
- Most comments
Hello there, EKS have a concept called IAM Roles for Service Account (IRSA). With IRSA, an IAM role can be assigned to a Service Account object in Kubernetes and Service Account gets assigned to a pod.
When AWS SDK (part of aws-load-balancer-controller pod) queries AWS API's, it detects the IRSA configuration and uses IAM role configured for the pod (by going through environment variables).
Worker node credentials act as fall back scenario so that node role can be used in case of IRSA configuration is not applied.
From above error message, it looks like you are missing IRSA configuration. Please check Step 3 from below doc,
If you have created IAM role and do not see the configuration, validate configuration using below commands,
- Check annotation for aws-load-balancer-controller Service Account
kubectl describe serviceaccount <aws-load-balancer-controller-sa--name-here> -n kube-system
- Describe aws-load-balancer-controller pod and validate for IRSA environment variables
kubectl describe pod <aws-load-balancer-controller-pod-id-here> -n kube-system | grep -i "AWS_ROLE_ARN"
kubectl describe pod <aws-load-balancer-controller-pod-id-here> -n kube-system | grep -i "AWS_WEB_IDENTITY_TOKEN_FILE"
Hello,
thanks for your answer. My output is
➜ cluster git:(infrastructure-playground) ✗ kubectl describe serviceaccount aws-load-balancer-controller -n kube-system
Name: aws-load-balancer-controller
Namespace: kube-system
Labels: app.kubernetes.io/component=controller
app.kubernetes.io/name=aws-load-balancer-controller
Annotations: <none>
Image pull secrets: <none>
Mountable secrets: aws-load-balancer-controller-token-fdxw5
Tokens: aws-load-balancer-controller-token-fdxw5
Events: <none>
so there are no annotations. Step 3 only says:
eksctl create iamserviceaccount
--cluster=my_cluster
--namespace=kube-system
--name=aws-load-balancer-controller
--attach-policy-arn=arn:aws:iam::111122223333:policy/AWSLoadBalancerControllerIAMPolicy
--override-existing-serviceaccounts
--approve
So should this create any annotations? If yes which one?
BR rene
Relevant content
- Accepted Answerasked 2 years ago
- asked a year ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 10 months ago
- AWS OFFICIALUpdated 10 months ago
- How can I troubleshoot issues when I use the AWS Load Balancer Controller to create a load balancer?AWS OFFICIALUpdated 2 years ago