Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AWS Pod Identity Auth Failing #10043

Open
gagemillerlob opened this issue Sep 16, 2024 · 0 comments
Open

AWS Pod Identity Auth Failing #10043

gagemillerlob opened this issue Sep 16, 2024 · 0 comments

Comments

@gagemillerlob
Copy link

Gloo Edge Product

Open Source

Gloo Edge Version

v1.17.7

Kubernetes Version

v1.30

Describe the bug

I setup a pod identity association for gloo edge to authenticate with AWS. My lambda upstream never populates with any upstream lambdas and the following log is seen inside of the discovery pod:

2024/09/16 10:59:38 Ignoring, HTTP credential provider invalid endpoint host, "169.254.170.23", only loopback hosts are allowed. <nil> 

I found the following issue on auto scaler with the same error message
kubernetes/autoscaler#6392

It appears that the issue was resolved when updating github.com/aws/aws-sdk-go to v1.48.7 and gloo edge currently uses v1.34.9

Expected Behavior

gloo edge pods authenticate with pod identity and can make AWS calls

Steps to reproduce the bug

I used the following terraform code to configure the pod identity

module "gloo_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"
  name = "gloo"

  attach_custom_policy = true
  policy_statements = [
    {
      sid       = "Lambda"
      effect    = "Allow"
      actions   = [
        "lambda:ListFunctions",
        "lambda:InvokeFunction",
        "lambda:GetFunction",
        "lambda:InvokeAsync"
      ]
      resources = ["*"]
    }
  ]

  associations = {
    proxy = {
      cluster_name    = local.cluster_name
      namespace       = "gloo-system"
      service_account = "gateway-proxy"
    }
    discovery = {
      cluster_name    = local.cluster_name
      namespace       = "gloo-system"
      service_account = "discovery"
    }
  }
}

And these gloo settings:

settings:
  aws:
    enableCredentialsDiscovery: true

and upstream config

apiVersion: gloo.solo.io/v1
kind: Upstream
metadata:
  name: lambdas
  namespace: gloo-system
spec:
  aws:
    region: us-east-1

Additional Environment Detail

No response

Additional Context

No response

@gagemillerlob gagemillerlob added the Type: Bug Something isn't working label Sep 16, 2024
@nfuden nfuden modified the milestone: lambda Sep 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants