Upgrading from alb load balancer controller v2.1.3 and earlier incorrect documentation

[obiordu]

Describe the bug

From multiple tests carried out to upgrade AWS ingress from v2.1.2 on chart 1.1.4 to v2.1.4 on chart 1.4.1,

the use of the '--set service account.create=false' flag in the helm upgrade command causes the existing service account 'aws-load-balancer-controller' to be deleted and causing the entire upgrade to fail with consistent crashloopbackoff as the pods can no longer access the service account or token for oidc authentication.

Steps to reproduce

Run the command in the documentation:

Update the iam permissions to the required

kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller//crds?ref=master"

helm upgrade -i aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller

Expected outcome The existing service account will be deleted and cause the ingress pods to fail in crashloopbaskoff

The only solution was to omit the '--set service account.create=false' flag for the service account not to be deleted and the upgrade to deploy successfully

Environment

Chart name: v2.1.2 on chart 1.1.4 to v2.1.4 on chart 1.4.1, Chart version: v2.1.2 on chart 1.1.4 to v2.1.4 on chart 1.4.1, Kubernetes version: 1.21 with plans to upgrade to 1.22 after ingress upgrade Using EKS (yes/no), if so version? 1.21 to 1.22 upgrade in anticipation of ingress API deprecations.

Additional Context: This is the initial issue opened on the helm chart repo https://github.com/aws/eks-charts/issues/736

[kishorj]

@obiordu, the --set service account.create=false on helm upgrade causes the service account to be deleted only if it had been created by the previous chart installation. If the sa was created outside of the helm chart, it will not be deleted during the helm upgrade. If sa is not found, the pods will fail to start - this is expected behavior.

Please verify if the service account on v2.1.3 or earlier was created by the helm chart.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.