helm / helm/chartmuseum

permissions grant with IAM Roles for Service Accounts does not work

Open
#625 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3.8k
Forks
407
PR merge metrics
No merged PRs in 30d

Description

Hi There,

I am leveraging chartmuseum --version 3.8.0. As I am using service account with proper iam role on aws, I can not bring up Chartmuseum pod. Application does not throw any error even though --debug is enabled. If use worker node's role and attach necessary policies it works properly. I can make it work with iam user's credentials(aws_access_key_id and aws_secret_access_key).

Reproduce:

cat << custom-config.yaml > EOF
env:
open:
# STORAGE: local
AWS_SDK_LOAD_CONFIG: true
STORAGE: amazon
STORAGE_AMAZON_BUCKET:
STORAGE_AMAZON_PREFIX:
STORAGE_AMAZON_REGION: us-west-1
DEBUG: true
DISABLE_API: false
AUTH_ANONYMOUS_GET: true
ALLOW_OVERWRITE: true

service:
type: NodePort
serviceAccount:
create: true
automountServiceAccountToken: true
annotations:
eks.amazonaws.com/role-arn: ""

image:
repository: < my image reposiyory>
tag: v0.14.0
pullPolicy: IfNotPresent
securityContext:
enabled: true
fsGroup: 65534
EOF
---
helm install test -f custom-config chartmuseum/chartmuseum --version 3.8.0


After running this command, pod is trying to come up for a while. Since readiness and liveness probes are failing, pod is crashing eventually. When describe I am getting something like shared below:

Readiness probe failed: Get "http://:8080/health": dial tcp :8080: connect: connection refused


Note: When the same service account attached to an aws cli pod, it can list s3 bucket objets with no issue.

Any idea why it is behaving this way?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.