Aws-load-balancer-controller: Controller health check failed: [ec2.DescribeTagsWithContext]: WebIdentityErr: failed to retrieve credentials caused by: InvalidIdentityToken: No OpenIDConnect provider found

Created on 16 Apr 2020 · 7Comments · Source: kubernetes-sigs/aws-load-balancer-controller

I unable use ingress controller by error:

    status code: 400, request id: xxx
E0416 12:40:46.016106       1 healthcheck.go:38] Controller health check failed: [ec2.DescribeTagsWithContext]: WebIdentityErr: failed to retrieve credentials
caused by: InvalidIdentityToken: No OpenIDConnect provider found in your account for https://oidc.eks.eu-west-1.amazonaws.com/id/xxxx

My args is:

                  + container {
                      + args                     = [
                          + "--ingress-class=alb",
                          + "--aws-region=eu-west-1",
                          + "--aws-max-retries=10",

lifecyclrotten

Source

ARogovsky

👍5

All 7 comments

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot on 15 Jul 2020

Facing same issue. Does anyone know why and how to fix it?

nthienan on 4 Aug 2020

👍1

having the same problem here.
Using terraform module https://registry.terraform.io/modules/iplabs/alb-ingress-controller/kubernetes/3.4.0

matias-devoto on 24 Aug 2020

If you have just created the EKS Cluster using eksctl or using the AWS Console, make sure to follow the steps documented here to enable the EKS' OIDC Provider in your IAM Provider list, e.g. eksctl utils associate-iam-oidc-provider --cluster "${CLUSTER_NAME}" --approve

Please note should you decide to use the AWS Console for this one time setup for a newly created EKS Cluster, you should _ideally_ verify the EKS OIDC Identity Provider by manually obtaining the root CA thumbprint for the EKS OIDC Identity Provider.

It appears that the eksctl … command does this for you automatically.

wadkar on 10 Sep 2020

👍1

Thanks i have already solved the problem adding the oidc

matias-devoto on 10 Sep 2020

👍1

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

fejta-bot on 10 Oct 2020

closing this as it's iam for service accounts setup . Feel free to reopen if issue still exists