hashicorp / terraform-provider-kubernetes

Terraform Kubernetes provider
https://www.terraform.io/docs/providers/kubernetes/
Mozilla Public License 2.0
1.6k stars 979 forks source link

exec: executable aws not found in GitHub Actions #2607

Closed dtwilliamsWork closed 4 weeks ago

dtwilliamsWork commented 4 weeks ago

I'm not sure if this is an issue with the provider or GitHub actions runner.

Still, we've been using the Kubernetes provider without issue for a couple of years, but in recent weeks, we have been getting an error when using the exec plugin to get a token to authenticate to our EKS cluster when running in GitHub Actions.

exec {
    api_version = "client.authentication.k8s.io/v1beta1"
    args        = ["eks", "get-token", "--cluster-name", var.cluster_name]
    command     = "aws"
 }

It says the exec: executable aws not found.

I have added a step in our pipeline to install the aws-cli but still it doesn't work.

- name: Install AWS CLI
        uses: unfor19/install-aws-cli-action@v1
        with:
          arch: amd64

I know I can change it to use a token = data.aws_eks_cluster_auth.prod.token instead, but I am getting Error: Unauthorized error when using that as I'm not sure what IAM role it's using when using an aws_eks_cluster_auth token and my EKS is on a different AWS account to the one I'm running the pipeline. I will need to edit my aws-auth config map on my Prod EKS to give it access, but am not sure what ARN to use.

I'm trying to add a Prod ArgoCD EKS cluster to my dev ArgoCD instance, hence the need to set up Kubernetes cluster roles, bindings, service accounts, and secret tokens.

dtwilliamsWork commented 4 weeks ago

ignore me, i managed to get it to work using the aws_eks_cluster_auth.prod.token instead

My aws_eks_cluster_auth was using an assume role and once I added this to the EKS aws-auth config map it was able to connect.

Not sure why the exec plugin has stopped working though. Also seems to fail on the helm and argocd terraform providers so I'm guessing it's something to do with GitHub actions runners.

provider "aws" {
  alias  = "prod"
  region = "eu-west-2"
  assume_role {
    role_arn = "arn:aws:iam::1234567890:role/prod_assume_role_arn"
  }
}

data "aws_eks_cluster_auth" "prod" {
  provider = aws.prod
  name     = data.aws_eks_cluster.prod.name
}