Hi there, I am new to Flyte, and I am just getting started. I deployed the flyte helm chart on Kubernettes AWS cluster. I modified the eks starter file, and uncommented nginx-ingress.

ingress:
  create: true
  ##-- Uncomment the following section if you plan to use NGINX Ingress Controller
  ingressClassName: nginx
  commonAnnotations:
   ingress.kubernetes.io/rewrite-target: /
   nginx.ingress.kubernetes.io/ssl-redirect: "true"
  httpAnnotations:
   nginx.ingress.kubernetes.io/app-root: /console
  grpcAnnotations:
   nginx.ingress.kubernetes.io/backend-protocol: GRPC
  host: localhost # change for the URL you'll use to connect to Flyte

I am able to port forward from K8s cluster, and access the console, as well as the APIs. However, when I run

pyflyte run --remote basics/hello_world.py hello_world_wf

I get the following error:

FlyteSystemException: SYSTEM:Unknown: error=None, cause=<_InactiveRpcError of RPC that terminated with:
        status = StatusCode.INTERNAL
        details = "failed to create a signed url. Error: WebIdentityErr: failed to retrieve credentials
caused by: ValidationError: Request ARN is invalid
        status code: 400, request id: 4fc450f6-113d-42b7-acf7-c1b56dec46f4"
        debug_error_string = "UNKNOWN:Error received from peer  {grpc_message:"failed to create a signed url. Error: WebIdentityErr: failed to retrieve credentials\ncaused by: 
ValidationError: Request ARN is invalid\n\tstatus code: 400, request id: 4fc450f6-113d-42b7-acf7-c1b56dec46f4", grpc_status:13, created_time:"2024-08-29T06:10:47.63416731+00:00"}"

My flyte config yaml:

admin:
  # For GRPC endpoints you might want to use dns:///flyte.myexample.com
  endpoint: dns:///localhost:8089
  authType: Pkce
  insecure: true
logger:
  show-source: true
  level: 0

Any help, appreciated !! Thanks

Not familiar with deployment problems, but you can try this. https://github.com/davidmirror-ops/flyte-the-hard-way

@salmon-flower-36598 well, in general if you provided that Ingress config to Helm and if there was an NGINX controller installed in your EKS cluster, then you should have an Ingress resource in the flyte namespace, removing the need to port-forward. Can you verify?

kubectl get ingress -n flyte

Also from the error message it looks lite it's complaining for the ARN of a request. Could you

kubectl describe sa default -n flytesnacks-development

to confirm there's an annotation with the right ARN?

Hi David, I actually got it working. Here is a strange part, when I use the EKS starter.yaml file, it causes the above error, but when I use the yaml file in the “Flyte Hard Way” posting, it works. I use the same ARNs, and the like.

Yeah, there's an open PR to unify on the eks-starter and yes, we need to double check that everything is okay there