docs
docs copied to clipboard
Document Assume Role usage for EKS provider
Problem description
When a user tries to use assume role with https://github.com/pulumi/pulumi-eks, they get an error message about the cluster being "unreachable". We added support for assume role with EKS at https://github.com/pulumi/pulumi-eks/issues/140 with CreationRoleProvider
but this is not easily discoverable.
Example Error Message
kubernetes:core:ConfigMap (eks-cluster-nodeAccess):
error: configured Kubernetes cluster is unreachable: unable to load schema information from the API server: the server has asked for the client to provide credentials
Suggestions for a fix
- Add an EKS-specific note about
CreationRoleProvider
to https://www.pulumi.com/docs/intro/cloud-providers/kubernetes/setup/. And eventually other providers as needed. - Link to that page in the error message - i.e.
kubernetes:core:ConfigMap (eks-cluster-nodeAccess): error: configured Kubernetes cluster is unreachable: unable to load schema information from the API server: the server has asked for the client to provide credentials. See LINK for more details.
- Add an "Authentication" note to https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/eks/
+1 to this, i see this has already been open for more than a year, and I would document it myself if i actually understood this, however I've tried using this in combination with KubeconfigOptions.role_arn
as to not deploy an EKS cluster through the pulumi iam user but through an IAM role but the runs always end in the kube api requiring credentials