aws / aws/eks-charts

Alb is failling to create in EKS cluster

Open
#926 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Mustache
Stars
1.3k
Forks
1.1k
Avg merge
22m
Merged PRs (30d)
5

Description

**Describe the bug**
We are trying to deploy ALB in EKS cluster by following this aws documentation [https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-controller-fargate/ ](https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-controller-fargate/)

Followed all the steps are mentioned, however when deploying an app alb is not creating , it is failling with below error,

{"level":"info","ts":1679398103.3748488,"logger":"controllers.ingress","msg":"successfully built model","model":"{\"id\":\"game-2048/ingress-2048\",\"resources\":{}}"}
{"level":"error","ts":1679398155.4208565,"logger":"controllers.ingress","msg":"unable to determine AWS Shield subscription state, skipping AWS shield reconciliation","error":"WebIdentityErr: failed to retrieve credentials\ncaused by: InvalidIdentityToken: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint\n\tstatus code: 400, request id: 6b22cdba-7d87-489d-8366-be27077b2a81"}

Followed these steps as well to check the thumbprint used in the OIDC provider, [https://aws.amazon.com/premiumsupport/knowledge-center/eks-error-invalid-identity-token/ ](https://aws.amazon.com/premiumsupport/knowledge-center/eks-error-invalid-identity-token/)
and it all matches and the cert is not expired.

We are still getting this error, please help

**Steps to reproduce**
Followed this aws documentation https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-controller-fargate/

**Expected outcome**
Alb should created

**Environment**
aws

* Chart name: [aws-load-balancer-controller](https://github.com/aws/eks-charts/tree/master/stable/aws-load-balancer-controller)
* Chart version: v2.4.7
* Kubernetes version: 1.25
* Using EKS (yes/no), if so version? Yes

**Additional Context**:

Contributor guide

Open the contributing guide

Research direction

Start with the linked AWS EKS ALB Ingress Controller and InvalidIdentityToken documentation, then inspect the aws-load-balancer-controller chart at version v2.4.7 and the reported controller logs. Verify the EKS OIDC provider and configured thumbprint against the documented requirements; done means the controller creates the ALB without the WebIdentityErr.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, helm, kubernetes
Domain
cloud, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.