[EKS] [request]: Managed Node Groups using role with extra path do not join cluster

[dpiddockcmp]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request
Bug report - Managed Node Group nodes are unable to join a cluster when using an IAM role with extra path.

Which service(s) is this request for?
EKS, Managed Node Groups

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard
The MNG service adds a section to aws-auth's mapRoles with the full ARN for the role. But when joining the cluster aws-iam-authenticator does not receive the full ARN as GetCallerIdentity lacks the extra path element.

Adding a section to the ConfigMap with the "correct" ARN before creating the MNG results in a duplicate block. Also nicely demonstrates the two cases:

  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::111111111111:role/test-eks
      username: system:node:{{EC2PrivateDNSName}}
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::111111111111:role/extra/test-eks
      username: system:node:{{EC2PrivateDNSName}}

Are you currently working around this issue?
aws-auth ConfigMap must be edited to "correct" the IAM role ARN

Additional context
Related to:

• [EKS] [bugfix]: Federated roles containing paths don't work properly with EKS #573
• IAM roles with paths are only recognized without the path kubernetes-sigs/aws-iam-authenticator#153
• Specifying iam_path causes nodes to be unable to join cluster terraform-aws-modules/terraform-aws-eks#893

Attachments

[anarsen]

This behavior is documented here:

• https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting_iam.html#security-iam-troubleshoot-ConfigMap
• https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html (see 2.b)

[dpiddockcmp]

It would be good if the aws-auth inserts generated by AWS when using Managed Node Groups followed their own documentation 😆

[tsndqst]

@mikestef9 Any updates on this? It's been almost two years and this is still an issue.

[portswigger-tim]

Anyone using CDK that ends up here, I did this as a "workaround": #573 (comment)

[mikestef9]

Addressed with #185