permissions grant with IAM Roles for Service Accounts does not work
- Dominant language
- Go
- Stars
- 3.8k
- Forks
- 407
- PR merge metrics
- No merged PRs in 30d
Description
Hi There,
I am leveraging chartmuseum --version 3.8.0. As I am using service account with proper iam role on aws, I can not bring up Chartmuseum pod. Application does not throw any error even though --debug is enabled. If use worker node's role and attach necessary policies it works properly. I can make it work with iam user's credentials(aws_access_key_id and aws_secret_access_key).
Reproduce:
cat << custom-config.yaml > EOF
env:
open:
# STORAGE: local
AWS_SDK_LOAD_CONFIG: true
STORAGE: amazon
STORAGE_AMAZON_BUCKET:
STORAGE_AMAZON_PREFIX:
STORAGE_AMAZON_REGION: us-west-1
DEBUG: true
DISABLE_API: false
AUTH_ANONYMOUS_GET: true
ALLOW_OVERWRITE: true
service:
type: NodePort
serviceAccount:
create: true
automountServiceAccountToken: true
annotations:
eks.amazonaws.com/role-arn: ""
image:
repository: < my image reposiyory>
tag: v0.14.0
pullPolicy: IfNotPresent
securityContext:
enabled: true
fsGroup: 65534
EOF
---
helm install test -f custom-config chartmuseum/chartmuseum --version 3.8.0
After running this command, pod is trying to come up for a while. Since readiness and liveness probes are failing, pod is crashing eventually. When describe I am getting something like shared below:
Readiness probe failed: Get "http://:8080/health": dial tcp :8080: connect: connection refused
Note: When the same service account attached to an aws cli pod, it can list s3 bucket objets with no issue.
Any idea why it is behaving this way?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.