Failed with IAM Roles chapter (kube2iam section)

[vietwow]

Hi,

I follow the chapter https://github.com/aws-samples/aws-workshop-for-kubernetes/tree/master/roles on Kubernetes v1.8.5 (which created by kops 1.8) using Calico network

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: kube2iam
labels:
app: kube2iam
spec:
template:
metadata:
labels:
name: kube2iam
spec:
hostNetwork: true
containers:
- image: jtblin/kube2iam:latest
name: kube2iam
args:
- "--iptables=true"
- "--host-ip=$(HOST_IP)"
- "--host-interface=cali+"
env:
- name: HOST_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
ports:
- containerPort: 8181
hostPort: 8181
name: http
securityContext:
privileged: true

Everything is OK until the final step, I got the below error when test the result :

$ kubectl exec -it aws-cli aws s3 ls
Unable to locate credentials. You can configure credentials by running "aws configure".
command terminated with exit code 255

It seems that pod "aws-cli" don't recognize the aws role, still looking aws credentials. But why ? Anyone can help me ? Thank you so much

Best Regards,
VietNC

[buzzsurfr]

Module has been moved to https://github.com/aws-samples/aws-workshop-for-kubernetes/blob/master/04-path-security-and-networking/402-authentication-and-authorization/readme.adoc

The role should have been granted the AmazonS3ReadOnlyAccess policy using the step https://github.com/aws-samples/aws-workshop-for-kubernetes/blame/master/04-path-security-and-networking/402-authentication-and-authorization/readme.adoc#L216

aws iam attach-role-policy --role-name MyPodRole --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Can you confirm that the role has the policy using the following command: aws iam list-attached-role-policies --role-name MyPodRole? You should get output similar to:

{
    "AttachedPolicies": [
        {
            "PolicyName": "AmazonS3ReadOnlyAccess", 
            "PolicyArn": "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
        }
    ]
}

[miki79]

I have the same issue

Unable to locate credentials. You can configure credentials by running "aws configure".
command terminated with exit code 255

I think it's related to permissions. the kube2iam logs has this error

Failed to list *v1.Namespace: namespaces is forbidden: User "system:serviceaccount:default:default" cannot list namespaces at the cluster scope

So the network is restricted (by the flag --iptables=true) but kube2iam proxy is not working, so when the container is trying to call http://169.254.169.254/ it fails

Kubernetes 1.9.6
Kops 1.9.1