AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

EKS pod not accessing Kubernetes Service account for role

0

I have a issue where EKS POD is not able to access DynamoDB resource and on further analysis I found that EKS is not using the configured Kubernetes service account and instead it is trying to use the EC2 default profile to get the credentials in which it is deployed ?

I am using AWS SDK software.amazon.awssdk:: dynamodb-enhanced :: 2.20.94 in my java application.

Below error is shown when trying to access dynamoDB from POD :

software.amazon.awssdk.core.exception.SdkClientException: Profile file contained no credentials for profile 'default': ProfileFile(profilesAndSectionsMap=[]) at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:111) ~[sdk-core-2.20.94.jar!/:na] at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.lambda$createCredentialsProvider$2(ProfileCredentialsProvider.java:173) ~[auth-2.20.94.jar!/:na]

Please kindly let me know if you need any further details

주제
데이터베이스컴퓨팅컨테이너
태그
아마존 DynamoDB쿠버네티스
언어
English
Sathwik
질문됨 8달 전882회 조회
2개 답변
1
수락된 답변

Hi,

Do you use any code in your app to specify the credentials? If yes, can you detail it?

It is important to know if / how break override the credentials provided by the DefaultAWSCredentialsProviderChain. See https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html for all details on this chain of credentials

Related question: do you have the AWS STS SDK included as part of your dependencies?

i.e., if you use Maven, in our pom.xml, something like:

<dependency>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>sts</artifactId>
        <version>2.17.108</version>
</dependency>

Best,

Didier

profile pictureAWS
전문가
Didier_Durand
답변함 8달 전
  • Sathwik
    8달 전

    Hi @Didier Durand, Thanks the answer

    I did not specifying any secret and key details in the code. we are depending on the Kubernetes Service account to retrieve the role info and on further analysis I found that we have 2 different Kubernetes service account (Default, and custom) and I am expecting my Pod to access custom service account to access Dynamodb but Pod is always trying to access default service account

    Now I am checking if there is a way in java plication to specify which service account to use

0

Hello,

When using IAM roles for service accounts, the containers in your Pods must use an AWS SDK version that supports assuming an IAM role through an OpenID Connect web identity token file. Make sure that you're using the following versions, or later, for your AWS SDK:

  • Java (Version 2) – 2.10.11
  • Java – 1.11.704

https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html

Using the AWS SDK for Java, you can build Java applications that work with DynamoDB as the SDK provides a Java API for the DynamoDB.

https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/home.html

AWS
Olawale
답변함 8달 전
  • Sathwik
    8달 전

    Olawale-AWS, Thanks for your answer

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠