aws / aws/eks-anywhere

Investigate how to avoid excessive VSphere calls if user is missing appropriate session permissions

Open
#4,202 1 comment 0 reactions 0 assignees View on GitHub
area/providers/capv area/providers/vsphere kind/enhancement
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

A few users have reported running into an issue where if the VSphere user is missing ValidateSession permissions as described in the [docs](https://anywhere.eks.amazonaws.com/docs/reference/vsphere/vsphere-preparation/#create-and-define-user-roles), it overloads the VSphere server, failing other calls with a 503 or even bringing down the entire server until the VMs are powered off.

These are the logs we see in the capv controller:
```
session "msg"="unable to check if vim session is active" "error"="ServerFaultCode: Permission to perform this operation was denied."
```
```
session "msg"="unable to get vim client session" "error"="ServerFaultCode: Permission to perform this operation was denied."
```

This is something that may potentially happen even if a user were not to use EKS Anywhere and use Cluster API directly, so will need to create an issue upstream after confirming this.

Contributor guide

Open the contributing guide

Research direction

Start with the capv controller logs and the linked vSphere user-role documentation, focusing on the session checks that produce the permission-denied errors. Confirm how missing ValidateSession permission triggers repeated calls and determine what behavior prevents 503 errors or server overload; also verify whether the issue belongs upstream in Cluster API.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.