search

eksctl-io / eksctl

The official CLI for Amazon EKS
https://eksctl.io
Other
4.87k stars 1.4k forks source link

[Bug] eksctl create (or update) iamserviceaccount does not work for an existing ServiceAccount #7887

Open jimydavis opened 1 month ago

jimydavis commented 1 month ago

My Scenario

Things I Tried That Didn't Work

  1. eksctl create iamserviceaccount does not work. I have tried all permutations of the --include / --exclude keywords as well as the --override-existing-serviceaccount flag and the --role-only flag. It is able to create the role but not annotate the serviceaccount.
  2. eksctl update iamserviceaccount does not work - it declares that the serviceaccount has no annotation and therefore there is nothing to update.

Things I Tried That Did Work

  1. I created the role manually with the standard Trust Relationship using Step 2 / AWS CLI tab of this doc
  2. I manually annotated the Service Account using kubectl annotate

Residual Questions

  1. After I did things manually eksctl get iamserviceaccount does not "register" this new mapping. It only shows the ones that eksctl did itself. Can I ignore this and just assume everything is ok now?
  2. What is the procedure for attaching IAM to an existing vanilla SA? Since a pod can only have 1 SA, the intuitive path of users is that they might have created an SA via their own helm charts for other auth reasons, THEN they wish to attach the iam mapping on top.
  3. When is PodIdentity coming to ASCP? I am only using IRSA because PodIdentity is not available for ASCP / CSI.

Thank you.

github-actions[bot] commented 1 month ago

Hello jimydavis :wave: Thank you for opening an issue in eksctl project. The team will review the issue and aim to respond within 1-5 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website

bdulive commented 1 month ago

I encountered a similar issue that "eksctl create iamserviceaccount" does not work. When I use eksctl 0.187.0 on my mac to create iamserviceaccount, it always fails to create the IAM role.
Then I tried to use an older eksctl version 0.181.0 on a linux machine, it works.

github-actions[bot] commented 5 days ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.