Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(cik8s) update permissions of the IAM role for autoscaler #405

Merged

Conversation

dduportal
Copy link
Contributor

We started with the minimalistic set of IAM permissions from https://docs.aws.amazon.com/eks/latest/userguide/autoscaling.html

But given the set of errors we have in the autoscaler logs:

I0429 12:17:14.342961       1 aws_manager.go:185] Found multiple availability zones for ASG "eks-spot-linux-24xlarge-20230426083600396100000013-20c3de5a-43bf-d7b2-52a9-334975546a73"; using us-east-2a for failure-domain.beta.kubernetes.io/zone label
E0429 12:17:14.463603       1 managed_nodegroup_cache.go:133] Failed to query the managed nodegroup spot-linux-24xlarge-20230426083600396100000013 for the cluster cik8s-ENRZrfwf while looking for labels/taints: AccessDeniedException: User: arn:aws:sts::200564066411:assumed-role/cluster-autoscaler-aws-cluster-autoscaler-chart-cik8s/1682770623236629083 is not authorized to perform: eks:DescribeNodegroup on resource: arn:aws:eks:us-east-2:200564066411:nodegroup/cik8s-ENRZrfwf/spot-linux-24xlarge-20230426083600396100000013/20c3de5a-43bf-d7b2-52a9-334975546a73
E0429 12:17:14.463649       1 aws_manager.go:297] Failed to get labels from EKS DescribeNodegroup API for nodegroup spot-linux-24xlarge-20230426083600396100000013 in cluster cik8s-ENRZrfwf because AccessDeniedException: User: arn:aws:sts::200564066411:assumed-role/cluster-autoscaler-aws-cluster-autoscaler-chart-cik8s/1682770623236629083 is not authorized to perform: eks:DescribeNodegroup on resource: arn:aws:eks:us-east-2:200564066411:nodegroup/cik8s-ENRZrfwf/spot-linux-24xlarge-20230426083600396100000013/20c3de5a-43bf-d7b2-52a9-334975546a73.
I0429 12:17:14.464040       1 aws_manager.go:185] Found multiple availability zones for ASG "eks-spot-linux-4xlarge-bom-20230429110448570900000006-16c3e657-eb96-f4d9-f9df-280c45ab6c4a"; using us-east-2a for failure-domain.beta.kubernetes.io/zone label
E0429 12:17:14.554276       1 managed_nodegroup_cache.go:133] Failed to query the managed nodegroup spot-linux-4xlarge-bom-20230429110448570900000006 for the cluster cik8s-ENRZrfwf while looking for labels/taints: AccessDeniedException: User: arn:aws:sts::200564066411:assumed-role/cluster-autoscaler-aws-cluster-autoscaler-chart-cik8s/1682770623236629083 is not authorized to perform: eks:DescribeNodegroup on resource: arn:aws:eks:us-east-2:200564066411:nodegroup/cik8s-ENRZrfwf/spot-linux-4xlarge-bom-20230429110448570900000006/16c3e657-eb96-f4d9-f9df-280c45ab6c4a
E0429 12:17:14.554325       1 aws_manager.go:297] Failed to get labels from EKS DescribeNodegroup API for nodegroup spot-linux-4xlarge-bom-20230429110448570900000006 in cluster cik8s-ENRZrfwf because AccessDeniedException: User: arn:aws:sts::200564066411:assumed-role/cluster-autoscaler-aws-cluster-autoscaler-chart-cik8s/1682770623236629083 is not authorized to perform: eks:DescribeNodegroup on resource: arn:aws:eks:us-east-2:200564066411:nodegroup/cik8s-ENRZrfwf/spot-linux-4xlarge-bom-20230429110448570900000006/16c3e657-eb96-f4d9-f9df-280c45ab6c4a.

then this PR switches to the https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#full-cluster-autoscaler-features-policy-recommended setup

@dduportal dduportal requested a review from a team April 29, 2023 12:52
@dduportal dduportal merged commit d1481c1 into jenkins-infra:main Apr 29, 2023
@dduportal dduportal deleted the fix/cik8s/autoscaler-iam-permission branch April 29, 2023 13:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant