pulumi-eks icon indicating copy to clipboard operation
pulumi-eks copied to clipboard

Document Assume Role usage for EKS provider

Open clstokes opened this issue 4 years ago • 1 comments

Problem description

When a user tries to use assume role with https://github.com/pulumi/pulumi-eks, they get an error message about the cluster being "unreachable". We added support for assume role with EKS at https://github.com/pulumi/pulumi-eks/issues/140 with CreationRoleProvider but this is not easily discoverable.

Example Error Message

kubernetes:core:ConfigMap (eks-cluster-nodeAccess):
  error: configured Kubernetes cluster is unreachable: unable to load schema information from the API server: the server has asked for the client to provide credentials

Suggestions for a fix

  • Add an EKS-specific note about CreationRoleProvider to https://www.pulumi.com/docs/intro/cloud-providers/kubernetes/setup/. And eventually other providers as needed.
  • Link to that page in the error message - i.e.
    kubernetes:core:ConfigMap (eks-cluster-nodeAccess):
      error: configured Kubernetes cluster is unreachable: unable to load schema information from the API 
    server: the server has asked for the client to provide credentials. See LINK for more details.
    
  • Add an "Authentication" note to https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/eks/

clstokes avatar Mar 12 '20 19:03 clstokes

+1 to this, i see this has already been open for more than a year, and I would document it myself if i actually understood this, however I've tried using this in combination with KubeconfigOptions.role_arn as to not deploy an EKS cluster through the pulumi iam user but through an IAM role but the runs always end in the kube api requiring credentials

Sefiris avatar Oct 05 '21 09:10 Sefiris