Open petersamueljohn opened 1 year ago
1) Please let us know what we are missing in order to avoid the warning
As far as i can tell the tool does not find any authentication information, you have to configure it yourself, this is probably due to using IRSA/service-account based authentication.
2) we are not using any template based yaml, so why few files are ignored.
It's hard to tell without having resources to test/reproduce the issue.
@gusfcarvalho do you have an idea?
Thanks for responding back, based on the kes-eso code(snippet:1) below which is based on input kes-deployment(snippet:2) file if am understanding it right
kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"kubernetes-client.io/v1","kind":"ExternalSecret","metadata":{"annotations":{},"name":"admin-sec","namespace":"admin"},"spec":{"backendType":"secretsManager","dataFrom":["app/admin-sec"],"roleArn":"arn:aws:iam::562983362877:role/eksExternalSecrets"}}
Below is the kes deployment file and we also have sa for eso, probably I can update the generated files with eso service account as a workaround but still trying to understand on the error as we have configured service account based authentication
"dnsPolicy":"ClusterFirst","nodeSelector":{"nodegroup-type":"component"},"restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"kubernetes-external-secrets","serviceAccountName":"kubernetes-external-secrets","terminationGracePeriodSeconds":30}}}} creationTimestamp: "2020-09-23T19:25:55Z" generation: 3 labels: app.kubernetes.io/instance: 2.2.0 app.kubernetes.io/name: kubernetes-external-secrets name: kubernetes-external-secrets
Let me know if we can connect so that I can explain the issue or concern from my end
I believe this issue is related to the fact that the tool could not find your KES deployment. Is it deployed under kube-system namespace? There are flags that you can pass to configure namespace and deployment names for KES, which will allow the configuration to be set up.
Also, please note that the tool does not handle dataFrom
. At that time we did not have that capability in ESO :)
yes it is deployed under kube-system and passed both namespace and deployment flag, service account is configured too in the deployment file
serviceAccount":"kubernetes-external-secrets","serviceAccountName":"kubernetes-external-secrets","terminationGracePeriodSeconds":30}}}}
./main generate -i kes_files -o eso_files -n kube-system kubernetes-external-secrets WARN[0000] Failed to Install AWS Backend Specific configuration: could not find aws credential information (secrets or sa with role-arn annotation) on kes deployment. Make sure you have set up Controller Pod Identity or manually edit SecretStore before applying it
I was able to fix the annotations issue with sa. was able to generate 36 files out of 63 in eso folder. I assume this is not complete since we datafrom in kes, do we have any workaround here?
generated eso: `apiVersion: external-secrets.io/v1alpha1 kind: ExternalSecret metadata: creationTimestamp: null name: admin-sec namespace: admin spec: dataFrom:
Hello, trying to migrate KES to ESO, I have the kes_files generated(63) and when I execute
./main generate -i kes_files -o eso_files -n kube-system
it gives me below warning:and I see just 36 eso files generated in the eso_files folder. we have the service account used in reference to KES and in the input yml files
Example input KES file:
and the corresponding ESO file generated is below
we got 2 questions, 1)Please let us know what we are missing in order to avoid the warning 2)we are not using any template based yaml, so why few files are ignored.
Please let us know incase of any additional info.