search

fluent / fluent-plugin-s3

Amazon S3 input and output plugin for Fluentd
https://docs.fluentd.org/output/s3
315 stars 217 forks source link

Fluentd on EKS: MissingCredentialsError when expecting it to use instance profile creds #268

Closed cwhatley closed 3 years ago

cwhatley commented 5 years ago

I am using fluent/fluentd-kubernetes-daemonset:v1.3-debian-s3 in a daemonset and properly setting S3_BUCKET_NAME and S3_BUCKET_REGION, but it seems to be choking on trying to get credentials from the instance profile.

Any idea what's the cause?

Errors below:

2019-03-14 01:18:04 +0000 [error]: #0 unexpected error error_class=Aws::Sigv4::Errors::MissingCredentialsError error="missing credentials, provide credentials with one of the following options:\n - :access_key_id and :secret_access_key\n - :credentials\n - :credentials_provider" 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sigv4-1.0.3/lib/aws-sigv4/signer.rb:517:in extract_credentials_provider' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sigv4-1.0.3/lib/aws-sigv4/signer.rb:121:ininitialize' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-s3-1.30.1/lib/aws-sdk-s3/plugins/s3_signer.rb:190:in new' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-s3-1.30.1/lib/aws-sdk-s3/plugins/s3_signer.rb:190:inbuild_v4_signer' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-s3-1.30.1/lib/aws-sdk-s3/plugins/s3_signer.rb:13:in block in <class:S3Signer>' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-3.46.1/lib/seahorse/client/configuration.rb:70:incall' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-3.46.1/lib/seahorse/client/configuration.rb:213:in block in resolve_defaults' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-3.46.1/lib/seahorse/client/configuration.rb:57:ineach' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-3.46.1/lib/seahorse/client/configuration.rb:57:in each' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-3.46.1/lib/seahorse/client/configuration.rb:212:inresolve_defaults' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-3.46.1/lib/seahorse/client/configuration.rb:205:in value_at' 2019-03-14 01:18:04 +0000 [error]: #0 /fluentd/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-3.46.1/lib/seahorse/client/configuration.rb:189:inblock in resolve'

cwhatley commented 5 years ago

I explicitly added the instance_profile_credentials to the block and now it is working. Should that be required? The docs seem to say that you can have only the bucket and region and it should work.

Ramneekkhurana commented 4 years ago

@cwhatley , where are you able to see these logs, i am facing a similar issue but can't see anything in the fluend container logs

rmccarthy-ellevation commented 4 years ago

@cwhatley @Ramneekkhurana I have this working on a linux aws instance with an instance profile that allows access to the bucket, however, when I tried this on Windows I get the same error. Nothing mentioned in the documentation about there being a difference. If anyone has figured it out please let me know. Thanks.

pinkavaj commented 3 years ago

It was necessary to disable containerSecurityContext to make it working in the helm chart from which I installed the fluentd.

github-actions[bot] commented 3 years ago

This issue has been automatically marked as stale because it has been open 90 days with no activity. Remove stale label or comment or this issue will be closed in 30 days

github-actions[bot] commented 3 years ago

This issue was automatically closed because of stale in 30 days