Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Karpenter addons reconciler error as missing requested permission "describing images" #15948

Closed
ndallavalentina opened this issue Sep 22, 2023 · 1 comment
Labels
kind/bug Categorizes issue or PR as related to a bug.

Comments

@ndallavalentina
Copy link

ndallavalentina commented Sep 22, 2023

/kind bug

1. What kops version are you running? The command kops version, will display
this information.

Kops = v1.26.7

2. What Kubernetes version are you running? kubectl version will print the
version if a cluster is running or provide the Kubernetes version specified as
a kops flag.

K8s =1.26.5

3. What cloud provider are you using? Aws

4. What commands did you run? What is the simplest way to reproduce this issue?

Create or enable AWS Karpenter as a Kops addon, create a provider, and try to scale up and down the cluster with a simple deployment. Karperter is not able to Reconciler the EC2 instances as for this error

5. What happened after the commands executed?

`2023-09-22T10:48:08.936Z	ERROR	controller	Reconciler error	{"commit": "30fa8f3-dirty", "controller": "awsnodetemplate", "controllerGroup": "karpenter.k8s.aws", "controllerKind": "AWSNodeTemplate", "AWSNodeTemplate": {"name":"nodes-xx-xx-2a"}, "namespace": "", "name": "nodes-xx-xx-2a", "reconcileID": "xxxxx-92f9-xxxx-xx-a6d1817d135c", "error": "describing images [{\n  Name: \"image-id\",\n  Values: [\n    \"ami-0d6xxxxf5\",\n    \"ami-0e02xxxxx6822\",\n    \"ami-0e02xxxfxxxxxx\",\n    \"ami-05a1xxxa1e1xxxxa7\",\n    \"\"\n  ]\n}], UnauthorizedOperation: You are not authorized to perform this operation.\n\tstatus code: 403, request id: xxxxx-6cef-xxxx-xxx-xxxxx"}`

6. What did you expect to happen?

The IAM created by Kops should have all the permissions required to work. At the moment it is missing ec2:DescribeImages

here:
https://github.com/kubernetes/kops/blob/master/pkg/model/components/addonmanifests/karpenter/iam.go#L49

here you can find all the permission required: https://karpenter.sh/docs/getting-started/migrating-from-cas/

@k8s-ci-robot k8s-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label Sep 22, 2023
@ndallavalentina
Copy link
Author

it has been merged on master

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Categorizes issue or PR as related to a bug.
Projects
None yet
Development

No branches or pull requests

2 participants