EKS cluster creation fails unless IAM role 'cloud-barista-spider-eks-cluster-role' is manually created in AWS

[Jeon-Jinhyeok]

What happened
: When I tried to create an AWS EKS cluster through CB-Tumblebug, the cluster creation failed with the following error:

failed to create K8sCluster dynamically error="NoSuchEntity: 
The role with name cloud-barista-spider-eks-cluster-role cannot be found. status code: 404,
request id: 2f4d0816-cadd-40bd-9f9e-06ecda6af086 
(from cb-spider:1024/spider/cluster (500 Internal Server Error))"

To proceded, I had to manually create the required AWS IAM role in the AWS console:

• In IAM -> Roles -> Create role:
  • Select EKS - Cluster as the trusted entity type (AWS service).
  • Set the role name explicitly to cloud-barista-spider-eks-cluster-role

Environment

• Source version or branch: cb-tumblebug: 0.11.15, cb-spider: 0.11.15
• OS: Ubuntu 22.04
• Cloud provider: AWS

Proposed solution
: Add logic so the system automatically creates the required AWS IAM roles (both the EKS control plane role and the worker node role) in AWS if they are missing.

[seokho-son]

Hi @Jeon-Jinhyeok
Thanks for the report and the enhancement suggestion. :)

• I agree with setting the role name explicitly to cloud-barista-spider-eks-cluster-role is not appropriate way. But its base implementation is rely on CB-Spider, and cannot be handled by CB-Tumblebug directly. (the naming should be changed at least)

• It is a known issue in the CB-Spider driver implementation, there is a note (comment) about it.

• Cloud-Barista does not have a plan to support a feature for controlling IAM (role). So, we need to find a different way to resolve it.

To resolve this issue, I think we need to support at least ..

• change the role name in general form. (cb-spider).
• add rich documentation (all aspects of K8s) in perspective of CB-Tumblebug. Since CB-Spider is internal function for CB-TB, CB-TB user does not (should not, in general) need to know about CB-Spider. (I believe @hanizang77 can contribute)
• @hanizang77 please add a document to
  • https://github.com/cloud-barista/cb-tumblebug/tree/main/docs/concept
  • For example: https://github.com/cloud-barista/cb-tumblebug/blob/main/docs/concept/existing-csp-res-job-scheduler.md

[seokho-son]

Hello, @powerkimhub
PTAL: I think some parts of this issue need to be resolved by CB-Spider.

[seokho-son]

@all-contributors please add @Jeon-Jinhyeok for User Testing

[allcontributors]

@seokho-son

I've put up a pull request to add @Jeon-Jinhyeok! 🎉

[powerkimhub]

• Applied since v0.11.17
• Updated related guide: Compare: Provider Managed Kubernetes and Driver API

---

• [AS-IS]

  • Used fixed EKS role names:

    • cloud-barista-spider-eks-cluster-role
    • cloud-barista-spider-eks-nodegroup-role

  • Assumed the roles already exist.

• [TO-BE]

  • Updated EKS role names to:

    • cloud-barista-eks-cluster-role
    • cloud-barista-eks-nodegroup-role

  • Added logic to create the roles when they do not exist and use them accordingly.