Open undervane opened 9 months ago
scottslowe
commented
9 months ago Hi @undervane! Thanks for submitting this issue. Are you able to share any more of your code, such as where oidcProviderArn is defined? Or where you're assigning this role to the ALB?
dag-andersen
commented
4 months ago Hi @scottslowe, i have the same issue.
I created a oidcProvider with
eksctl utils associate-iam-oidc-provider \
--region <region-code> \
--cluster <your-cluster-name> \
--approvefrom the official guide
But i also tried specifying: createOidcProvider: true when creating the cluster
const cluster = new eks.Cluster(config.pulumiName, {
vpcId: vpc.vpcId,
name: config.awsName,
subnetIds: vpc.privateSubnetIds,
createOidcProvider: true,
});The pulumi code looks like this
const policy = new aws.iam.Policy('aws-load-balancer-controller-policy', {
policy: fs.readFileSync('./iam-policy.json', 'utf8').toString(),
});
const roleForServiceAccountsEks = new iam.RoleForServiceAccountsEks(
'aws-iam-example-role-for-service-accounts-eks',
{
role: {
name: 'aws-load-balancer-controller',
policyArns: [policy.arn],
},
policies: {
loadBalancer: {
controller: true,
},
},
oidcProviders: {
main: {
providerArn: <the-arn-from-the-newly-created-oidc-provider>,
namespaceServiceAccounts: [
'kube-system:aws-load-balancer-controller',
],
},
},
},
);output:
Error: failed to register new resource aws-iam-example-role-for-service-accounts-eks [aws-iam:index:RoleForServiceAccountsEks]: 2 UNKNOWN: marshaling properties: awaiting input property "role": cannot marshal an input of type pulumi.StringOutput with element type string as a value of type pulumi.StringOutput
at Object.registerResource (repo-path/node_modules/@pulumi/runtime/resource.ts:455:27)
at new Resource (repo-path/node_modules/@pulumi/resource.ts:518:13)
at new ComponentResource (repo-path/node_modules/@pulumi/resource.ts:1090:9)
at new RoleForServiceAccountsEks (repo-path/node_modules/@pulumi/roleForServiceAccountsEks.ts:99:9)
at Object.<anonymous> (repo-path/k8s-clusters/index.ts:101:39)
at Module._compile (node:internal/modules/cjs/loader:1467:14)
at Module.m._compile (repo-path/node_modules/@pulumi/pulumi/vendor/ts-node@7.0.1/index.js:3009:23)
at Module._extensions..js (node:internal/modules/cjs/loader:1551:10)
at Object.require.extensions.<computed> [as .ts] (repo-path/node_modules/@pulumi/pulumi/vendor/ts-node@7.0.1/index.js:3011:12)
at Module.load (node:internal/modules/cjs/loader:1282:32) {
promise: Promise { <rejected> [Circular *1] }
}Do you know what is wrong?
gueux
commented
4 months ago Any update of this? I've faced the same issue with Typescript module:
<ref *1> Error: failed to register new resource aws-iam-role-external-dns-dev [aws-iam:index:RoleForServiceAccountsEks]: 2 UNKNOWN: marshaling properties: awaiting input property "role": cannot marshal an input of type pulumi.StringOutput with element type string as a value of type pulumi.StringOutput
What happened?
After many tries changing config, I still keep getting the following error even with the most basic example, so possibly there's nothing to do with my own setup:
Error: failed to register new resource aws-load-balancer-controller-test-eks-cluster [aws-iam:index:RoleForServiceAccountsEks]: 2 UNKNOWN: marshaling properties: awaiting input property "role": cannot marshal an input of type pulumi.StringOutput with element type string as a value of type pulumi.StringOutput at Object.registerResource (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/node_modules/@pulumi/runtime/resource.ts:438:27) at new Resource (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/node_modules/@pulumi/resource.ts:507:13) at new ComponentResource (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/node_modules/@pulumi/resource.ts:1011:9) at new RoleForServiceAccountsEks (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/node_modules/@pulumi/roleForServiceAccountsEks.ts:99:9) at SetupAlb (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/modules/alb.ts:42:14) at Object.<anonymous> (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/index.ts:12:9) at Module._compile (node:internal/modules/cjs/loader:1198:14) at Module.m._compile (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/node_modules/ts-node/src/index.ts:439:23) at Module._extensions..js (node:internal/modules/cjs/loader:1252:10) at Object.require.extensions.<computed> [as .ts] (/Users/undervane/Repositories/inbox/kubernetes-aws-typescript/node_modules/ts-node/src/index.ts:442:12)Example
Output of
pulumi aboutAdditional context
No response
Contributing
Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).