Where can I view service account created by `eksctl`?

user_5421539 0
Viewed 3095

I create a EKS cluster in AWS and use this command to create a service account eksctl create iamserviceaccount --name alb-ingress-controller --cluster $componentName --attach-policy-arn $serviceRoleArn --approve --override-existing-serviceaccounts. The output of the command is:

[ℹ]  using region ap-southeast-2
[ℹ]  1 existing iamserviceaccount(s) (default/alb-ingress-controller) will be excluded
[ℹ]  1 iamserviceaccount (default/alb-ingress-controller) was excluded (based on the include/exclude rules)
[!]  metadata of serviceaccounts that exist in Kubernetes will be updated, as --override-existing-serviceaccounts was set
[ℹ]  no tasks

I am not sure whether it is created successfully or not.

I use this command eksctl get iamserviceaccount to verify the result but get an error response:

Error: getting iamserviceaccounts: no output "Role1" in stack "eksctl-monitor-addon-iamserviceaccount-default-alb-ingress-controller"

I also tried to run kubectl get serviceaccount but I got the error: Error from server (NotFound): serviceaccounts "alb-ingress-controller" not found.

Does this mean the service account failed to create? Where can I view the service account in AWS console? or where can I view the error?

amazon-eks amazon-web-services
3 Answers

As per the error, it means serviceaccount already exists.

For getting the service account use kubectl

kubectl get serviceaccount <SERVICE_ACCOUNT_NAME> -n kube-system -o yaml

The order is, create the IAM-role, and after that – RBAC Role and binding. Below is command in case you want to override the existing serviceaccount

eksctl --profile <PROFILE_NAME> \
       --region=ap-northeast-2 \
       create iamserviceaccount \
       --name alb-ingress-controller \
       --namespace kube-system \
       --override-existing-serviceaccounts \
       --approve --cluster <CLUSTER_NAME> \
       --attach-policy-arn \
       arn:aws:iam::ACCOUNT_ID:policy/ALBIngressControllerIAMPolicy

I found this workshop Amazon EKS Workshop very helpful during my venture into EKS.

More information pertaining to ALB can be found here

EDIT

from this error

[ℹ] 1 existing iamserviceaccount(s) (default/alb-ingress-controller) will be excluded

It seems like the service accounts is created inside the default namespace.

so the command to check the serviceaccount will be

kubectl get serviceaccount <SERVICE_ACCOUNT_NAME> -n default-o yaml
user_22463450

eksctl uses CloudFormation to create the resources so you probably will find the cause of the error there.

  1. Go to CloudFormation console in AWS
  2. Find the stack with the name eksctl-[CLUSTER NAME]-addon-iamserviceaccount-default-[SERVICE ACCOUNT NAME], it should have the ROLLBACK_COMPLETE status.
  3. Select the "events" tab and scroll to the first error

In my case, the cause was a missing policy that I was attaching to the role.

user_23547850

works as expected, thanks @samtoddler !

1 Create the IAM policy for the IAM Role 

curl -o iam_policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.3.0/docs/install/iam_policy.json
aws-vault exec Spryker-Humanetic-POC -- aws iam create-policy \
    --policy-name AWSLoadBalancerControllerIAMPolicy \
    --policy-document file://iam_policy.json

2 Create the IAM role and attach it to the newly created ServiceAccount 

eksctl create iamserviceaccount \
  --cluster education-eks-7yby62S7 \
  --namespace kube-system \
  --name aws-load-balancer-controller \
  --attach-policy-arn arn:aws:iam::ACCOUNT_ID:policy/AWSLoadBalancerControllerIAMPolicy \
  --approve

3.1 Verify # 1 that ServiceAccount lives in --namespace kube-system 

kubectl get sa aws-load-balancer-controller -n kube-system -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/eksctl-education-eks-7yby62S7-addon-iamservi-Role1-126OXTBKF3WBM
  creationTimestamp: "2021-12-12T17:38:48Z"
  labels:
    app.kubernetes.io/managed-by: eksctl
  name: aws-load-balancer-controller
  namespace: kube-system
  resourceVersion: "686442"
  uid: 895f6f34-ab04-4bca-aeac-1b6b75766546
secrets:
- name: aws-load-balancer-controller-token-gcd5c

3.2 Verify #2 

kubectl get sa aws-load-balancer-controller -n kube-system
NAME                           SECRETS   AGE
aws-load-balancer-controller   1         123m

Hope it will help! ‍♀️

user_22070070
Related