aws / aws/containers-roadmap

[EKS] [request]: kube-proxy addon should internally handle RBAC permissions dependencies addition

Open
#1,842 0 comments 1 reaction 0 assignees View on GitHub
EKS EKS Add-Ons Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

During new cluster creation specifically, kube-proxy addon's is erroring out

```clusterrolebindings.rbac.authorization.k8s.io "eks:kube-proxy" is forbidden: user "eks:addon-manager" (groups=["system:authenticated"]) is attempting to grant RBAC permissions not currently held: {APIGroups:["discovery.k8s.io"], Resources:["endpointslices"], Verbs:["get"]}```

As per the [comment](https://github.com/aws/containers-roadmap/issues/1159#issuecomment-846857536) mentioned [here](https://github.com/aws/containers-roadmap/issues/1159) we are handling it in our automation with no luck. Manual re-addition of the kube-proxy addon is giving the same error.

Expected:
RBAC issues should be handled directly by AWS side, as these addons are provided by AWS.

**Which service(s) is this request for?**
EKS - 1.20+
kube-proxy version: v1.20.4-eksbuild.2

**Are you currently working around this issue?**
1. Add the steps mentioned in the [comment](https://github.com/aws/containers-roadmap/issues/1159#issuecomment-846857536) into our automation.
2. if point 1 is not successful, workaround is to not use kube-proxy as addon and have it managed by our own. This is less optimal and increases our maintenance overhead.

Contributor guide

Open the contributing guide

Research direction

This is an EKS service request rather than a repository code change. Read the linked issue 1159 and its referenced comment, then verify the behavior for EKS 1.20+ with kube-proxy v1.20.4-eksbuild.2. Done means a newly created cluster can install the kube-proxy add-on without the reported RBAC permission error or manual permission workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
authorization, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.