[EKS] [request]: kube-proxy addon should internally handle RBAC permissions dependencies addition
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
During new cluster creation specifically, kube-proxy addon's is erroring out
```clusterrolebindings.rbac.authorization.k8s.io "eks:kube-proxy" is forbidden: user "eks:addon-manager" (groups=["system:authenticated"]) is attempting to grant RBAC permissions not currently held: {APIGroups:["discovery.k8s.io"], Resources:["endpointslices"], Verbs:["get"]}```
As per the [comment](https://github.com/aws/containers-roadmap/issues/1159#issuecomment-846857536) mentioned [here](https://github.com/aws/containers-roadmap/issues/1159) we are handling it in our automation with no luck. Manual re-addition of the kube-proxy addon is giving the same error.
Expected:
RBAC issues should be handled directly by AWS side, as these addons are provided by AWS.
**Which service(s) is this request for?**
EKS - 1.20+
kube-proxy version: v1.20.4-eksbuild.2
**Are you currently working around this issue?**
1. Add the steps mentioned in the [comment](https://github.com/aws/containers-roadmap/issues/1159#issuecomment-846857536) into our automation.
2. if point 1 is not successful, workaround is to not use kube-proxy as addon and have it managed by our own. This is less optimal and increases our maintenance overhead.
Contributor guide
Research direction
This is an EKS service request rather than a repository code change. Read the linked issue 1159 and its referenced comment, then verify the behavior for EKS 1.20+ with kube-proxy v1.20.4-eksbuild.2. Done means a newly created cluster can install the kube-proxy add-on without the reported RBAC permission error or manual permission workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- authorization, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 15/100