Switching authorization from ConfigMap to API and ConfigMap breaks fargate (or is it EKS bug)

[cdenneen]

So I think this might be a larger EKS bug but it seems when switching from ConfigMap to api & ConfigMap the module switches from the old ConfigMap entries to the new access_entries but it complains that the fargate profile is misconfigured:

  Warning  FailedScheduling  40m   fargate-scheduler  Misconfigured Fargate Profile: fargate profile karpenter blocked for new launches due to: Pod execution role is not found in auth config or does not have all required permissions for launching fargate pods.

However I have seen this on a brand new cluster too. I destroyed the new cluster created which had this complaint and recreated exactly same and "second" new cluster worked. I'm not sure why some times clusters have this issues and some don't...

I'm seeing this on existing cluster upgrades as well where I have 2 fargate_profiles defined using this module and the coredns one worked fine and pod came up but the Karpenter one had this error. The module creates 2 access entries that except for the name look the same so maybe its the EKS managed backend that all regions or something haven't been properly updated and that's why sometimes this works and other times it doesn't?

Not sure where to raise this as EKS bug though so I figured I'd start here since the developers are on the EKS team.

[cdenneen]

I deleted the fargate profile from the console, deleted the role, deleted the access entry and allowed module to recreate them and issue was gone this time. Definitely something strange on backend whether it's the conversion or managed control plane itself.

[bryantbiggs]

duplicate of #2912

@cdenneen can you open an AWS support case with your cluster ARN and the time period when you encountered this behavior, please

[bryantbiggs]

closing in favor of #2912

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.