POD log is flooded with warning message from aws cli.

[lalat-das]

Confirm by changing [ ] to [x] below:

• I've gone though the User Guide and the API reference
• I've searched for previous similar issues and didn't find any solution

Issue is about usage on:

• Service API : I want to do X using Y service, what should I do?
• CLI : passing arguments or cli configurations.
• Other/Not sure.

Platform/OS/Hardware/Device
centos VM using EKS 1.19 & EKS 1.21

Describe the question
When I am deploying various application pod in EKS 1.19 version cluster. After a API call to k8s cluster is done as part of application , The POD log is flooded with below error message.

W1207 14:08:21.496434 1 exec.go:282] constructing many client instances from the same exec auth config can cause performance problems during cert rotation and can exhaust available network connections; 27556 clients constructed calling "aws"

I did some homework and found out that any binary(may be aws-cli here) using client-go version below 1.21 will have this issue because there is a warning message present in exec.go file which will appear neumerous times.
[https://github.com/kubernetes/client-go/blob/release-1.20/plugin/pkg/client/auth/exec/exec.go#L282](exec.go of 1.20 ver)

So is it that aws-cli is using k8s client-go version below 1.20 ? I couldn't find out as the aws-cli is in python hence not sure how the code trace landing in exec.go from python. The issue is seen with EKS1.19 onwards.

This warning earlier used to come from "aws-iam-authenticator" calling binary. how to get rid of this warning?
Any clue would be greatly appreciated. Thanks in advance.

[kdaily]

Hi @lalat-das,

Thanks for your post. The AWS CLI does not have any code written in Go, and is not using client-go for anything. Some AWS CLI customizations make subprocess calls to other code that may be written in Go (for example, the AWS Session Manager plugin is written in Go), but a Go client is not shipped with the CLI for usage. As far as I know EKS supports Kubernetes 1.16 to 1.21 (reference: #6476).

Previous issues with similar warnings indicate this is a Kubernetes issue, so you may need to take it up with them.

kubernetes-sigs/aws-iam-authenticator#308 (comment)

For further assistance, I would ask this in the AWS Developer Forum for EKS:

https://forums.aws.amazon.com/forum.jspa?forumID=303

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.