Skip to content
This repository has been archived by the owner on Jul 26, 2022. It is now read-only.

eks fargate issue facing ERROR, Missing credentials in config #506

Closed
yongxiuuu opened this issue Oct 7, 2020 · 4 comments
Closed

eks fargate issue facing ERROR, Missing credentials in config #506

yongxiuuu opened this issue Oct 7, 2020 · 4 comments

Comments

@yongxiuuu
Copy link

Hello I am facing missing credentials in config error for fargate eks. I followed the steps from here

#416
and also
#414

tried both but no success :( This is the logs I got from the pod:

{“level”:50,“time”:1602036267400,“pid”:17,“hostname”:“external-secret-2kubernetes-external-secrets-886db7b86-9xnf4”,“message”:“Missing credentials in config”,“errno”:“ETIMEDOUT”,“code”:“CredentialsError”“originalError”:{“message”:“Could not load credentials from any providers”,“errno”:“ETIMEDOUT”,“code”:“CredentialsError”,“syscall”:“connect”,,“originalError”:{“message”:“EC2 Metadata roleName request returned

@Flydiverny
Copy link
Member

Flydiverny commented Oct 7, 2020

You want to look at #452 and #442 (comment) changes suggested in the PRs you linked were reverted (see #453)

@yongxiuuu
Copy link
Author

I just tried #452.
I had supplied the helm chart value as mentioned in the thread. I still got the same error message :( Thank you

@yongxiuuu
Copy link
Author

yongxiuuu commented Oct 7, 2020

Hi @Flydiverny can check with you for this particular role arn:aws:iam::111111111:role/eksctl-fargate-test-kes-iamserviceaccount-role --> what kind of policy you using?

and I also realised that the #452 got reverted to #453?

@Flydiverny
Copy link
Member

Flydiverny commented Oct 11, 2020

arn:aws:iam::111111111:role/eksctl-fargate-test-kes-iamserviceaccount-role

Only has a trust relationship of, NOTE that this permission would allow any service account to assume this role
No policies attached or inlined.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::111111111:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/F5C083E55DB8AE8A685E5F11E3DDCAB8"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringLike": {
          "oidc.eks.eu-west-1.amazonaws.com/id/F5C083E55DB8AE8A685E5F11E3DDCAB8:sub": "system:serviceaccount:*"
        }
      }
    }
  ]
}

For more details check the EKS user guide
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants