-
Notifications
You must be signed in to change notification settings - Fork 791
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Deploy ESO on EKS #4930
Deploy ESO on EKS #4930
Conversation
infra/aws/terraform/prow-build-cluster/resources/kube-system/tune-sysctls_daemonset.yaml
Outdated
Show resolved
Hide resolved
infra/aws/terraform/prow-build-cluster/resources/namespaces.yaml
Outdated
Show resolved
Hide resolved
infra/aws/terraform/prow-build-cluster/resources/external-secrets/configmaps.yaml
Outdated
Show resolved
Hide resolved
while true; do | ||
for i in $(seq 0 1000); do | ||
if ! [ -e /dev/loop$i ]; then | ||
mknod /dev/loop$i b 7 $i |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we do this via Terraform?
k8s.io/infra/aws/terraform/prow-build-cluster/eks.tf
Lines 104 to 107 in c5181fa
# Required to ensure Prow works well. | |
pre_bootstrap_user_data = <<-EOT | |
sysctl -w fs.inotify.max_user_watches=524288 | |
EOT |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we can, it is easier to apply the existing manifest :D
infra/aws/terraform/prow-build-cluster/resources/test-pods/test-pods-poddisruptionbudget.yaml
Show resolved
Hide resolved
/approve Leaving the lgtm to @xmudri. ping on slack for the gcp part when ready. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
/hold
to apply Terraform changes
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ameukam, upodroid, xmudrii The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/hold cancel |
Got │ Error: Error setting IAM policy for service account 'projects/k8s-infra-prow-build/serviceAccounts/kubernetes-external-secrets@k8s-infra-prow-build.iam.gserviceaccount.com': googleapi: Error 400: Invalid principalSet member (principalSet://iam.googleapis.com/projects/773781448124/locations/global/workloadIdentityPools/prow-eks/providers/oidc/attribute.sub/system:serviceaccount:external-secrets:external-secrets)., badRequest
│
│ with module.workload_identity_service_accounts["kubernetes-external-secrets"].google_service_account_iam_policy.serviceaccount_iam,
│ on ../modules/workload-identity-service-account/main.tf line 43, in resource "google_service_account_iam_policy" "serviceaccount_iam":
│ 43: resource "google_service_account_iam_policy" "serviceaccount_iam" {
│
╵ during the deployment. |
Follow-up of: - kubernetes#4930 - Fix name of the workload identity provider pool. - Fix a required version of the terraform provider Signed-off-by: Arnaud Meukam <ameukam@gmail.com>
Fixing in: #4944 |
/cc @dims @xmudrii @ameukam @BenTheElder
This PR deploys ESO on EKS using Workload Identity Federation. Marko will need to initially apply this manifest, but I intend on creating a prowjob that applies it automatically. We should probably consider using ArgoCD to deploy complex apps bundled as helm charts.
I'll fix the secrets later as I need to upgrade them to new format expected by ESO