Problems creating first LoadBalancer in brand-new AWS account

[justinsb]

/kind bug

@ameukam observed a problem creating services of type LoadBalancer in a brand new AWS account.

In https://storage.googleapis.com/kubernetes-jenkins/logs/ci-aws-kops-eks-pod-identity-sandbox/1742899966826778624/artifacts/cluster-info/kube-system/aws-cloud-controller-manager-sshfn/aws-cloud-controller-manager.log we found this error:

I0104 13:38:18.926043 1 aws_loadbalancer.go:1017] Creating load balancer for deployment-8855/test-rolling-update-with-lb with name: adaa9d6372b254401baef4dd8faeb0d4 E0104 13:38:19.807666 1 controller.go:298] error processing service deployment-8855/test-rolling-update-with-lb (retrying with exponential backoff): failed to ensure load balancer: AccessDenied: User: arn:aws:sts::808842816990:assumed-role/aws-cloud-controller-manager.kube-system.sa.e2e-kops-eks--9pmkdr/1704375497398309729 is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::808842816990:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing because no identity-based policy allows the iam:CreateServiceLinkedRole action status code: 403, request id: 7edfd319-c55f-4381-9f12-32242008b8f7 

I0104 13:38:19.807812 1 event.go:307] "Event occurred" object="deployment-8855/test-rolling-update-with-lb" fieldPath="" kind="Service" apiVersion="v1" type="Warning" reason="SyncLoadBalancerFaile

(Specifically: "no identity-based policy allows the iam:CreateServiceLinkedRole action status code")

@rifelpet pointed out that someone needs to call iam:CreateServiceLinkedRole before we can use ELB (and possibly other services). That could be in our CCM permissions, we could do it from the kOps CLI, we could require users to do it manually.

@rifelpet also pointed out that CCM and LBC both document the permission as needed:

https://github.com/kubernetes/cloud-provider-aws/blob/65e4f1ac4dbed33744b1e935892417d5c71ae43c/docs/prerequisites.md?plain=1#L77

https://github.com/search?q=repo%3Akubernetes-sigs%2Faws-load-balancer-controller%20CreateServiceLinkedRole&type=code

[ameukam]

Add the required IAM permission was enough to make the test green.
I think we can close.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[ameukam]

/close

[k8s-ci-robot]

@ameukam: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.