Skip to content

AWS IRSA bucket authentication does not work properly on EKS  #75

Description

@flaccid

Checks

  • I have searched the existing issues.
  • This issue is NOT specific to the CLI. (If so, please open an issue on the CLI repo)

deployKF Version

0.1.3

Kubernetes Version

Client Version: version.Info{Major:"1", Minor:"25", GitVersion:"v1.25.0", GitCommit:"a866cbe2e5bbaa01cfd5e969aa3e033f3282a8a2", GitTreeState:"clean", BuildDate:"2022-08-23T17:44:59Z", GoVersion:"go1.19", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.7
Server Version: version.Info{Major:"1", Minor:"24+", GitVersion:"v1.24.17-eks-8cb36c9", GitCommit:"b114b128d961e18fed9242aed57f37f289bc740f", GitTreeState:"clean", BuildDate:"2023-11-22T21:53:08Z", GoVersion:"go1.20.10", Compiler:"gc", Platform:"linux/amd64"}

Description

Objective is to use S3 instead of MiniIO. IAM and deploykf has been set up per https://www.deploykf.org/guides/tools/external-object-store/. Note: the S3 bucket is in eu-west-1 region.

Relevant Logs

ml-pipeline pods are returning the following starting up:

│ ml-pipeline-api-server I0111 06:29:38.766223       7 client_manager.go:160] Initializing client manager                                                                                              │
│ ml-pipeline-api-server I0111 06:29:38.766320       7 config.go:57] Config DBConfig.ExtraParams not specified, skipping                                                                               │
│ ml-pipeline-api-server F0111 06:29:39.200188       7 client_manager.go:412] Failed to check if Minio bucket exists. Error: Access Denied.


### deployKF Values (Optional)

```yaml
deploykf_core:
  deploykf_profiles_generator:
    profileDefaults:
      plugins:
        - kind: AwsIamForServiceAccount
          spec:
            awsIamRole: "${iam_role_arn}"
            AnnotateOnly: true
deploykf_opt:
  deploykf_minio:
    enabled: false

kubeflow_dependencies:
  kubeflow_argo_workflows:
    controller:
      serviceAccount:
        annotations:
          eks.amazonaws.com/role-arn: "${iam_role_arn}"
    server:
      serviceAccount:
        annotations:
          eks.amazonaws.com/role-arn: "${iam_role_arn}"

kubeflow_tools:
  pipelines:
    enabled: true
    serviceAccounts:
      apiServer:
        annotations:
          eks.amazonaws.com/role-arn: "${iam_role_arn}"
      frontend:
        annotations:
          eks.amazonaws.com/role-arn: "${iam_role_arn}"
    bucket:
      name: ${bucket}
      region: ${region}
    objectStore:
      useExternal: true
      ## for IRSA, this should always be 's3.amazonaws.com'
      host: s3.amazonaws.com
      port: ""
      useSSL: true
      auth:
        fromEnv: true
    kfpV2:
      minioFix: false

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugkind - things not working properlypriority/highpriority - must be fixed before next release

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions