eksctl-io/eksctl

[Bug] eksctl create (or update) iamserviceaccount does not work for an existing ServiceAccount

jimydavis opened this issue · 3 comments

jimydavis commented

My Scenario

  • I have a vanilla ServiceAccount - very pure with nothing inside, no annotations etc.
  • I don't have an IAM role.
  • I wish for eksctl to create the IAM role for me and then "attach" the role to the ServiceAccount.

Things I Tried That Didn't Work

  1. eksctl create iamserviceaccount does not work. I have tried all permutations of the --include / --exclude keywords as well as the --override-existing-serviceaccount flag and the --role-only flag. It is able to create the role but not annotate the serviceaccount.
  2. eksctl update iamserviceaccount does not work - it declares that the serviceaccount has no annotation and therefore there is nothing to update.

Things I Tried That Did Work

  1. I created the role manually with the standard Trust Relationship using Step 2 / AWS CLI tab of this doc
  2. I manually annotated the Service Account using kubectl annotate

Residual Questions

  1. After I did things manually eksctl get iamserviceaccount does not "register" this new mapping. It only shows the ones that eksctl did itself. Can I ignore this and just assume everything is ok now?
  2. What is the procedure for attaching IAM to an existing vanilla SA? Since a pod can only have 1 SA, the intuitive path of users is that they might have created an SA via their own helm charts for other auth reasons, THEN they wish to attach the iam mapping on top.
  3. When is PodIdentity coming to ASCP? I am only using IRSA because PodIdentity is not available for ASCP / CSI.

Thank you.

github-actions commented

Hello jimydavis 👋 Thank you for opening an issue in eksctl project. The team will review the issue and aim to respond within 1-5 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website

bdulive commented

I encountered a similar issue that "eksctl create iamserviceaccount" does not work.
When I use eksctl 0.187.0 on my mac to create iamserviceaccount, it always fails to create the IAM role.
Then I tried to use an older eksctl version 0.181.0 on a linux machine, it works.