Half solved the issue ^ and now I m getting a s3 putObject a

Question

Half solved the issue ^ and now I m getting a s3 putObject auth error ```lytekit exceptions user FlyteAssertion Failed to put data from tmp flyte gnaguqof sandbox local flytekit engine dir to recursive=True Original exception Called process exited with error code 1 Stderr dump b upload failed tmp flyte gnaguqof sandbox local flytekit engine dir error pb to An error occurred AccessDenied when calling the PutObject operation Access Denied n ``` the flyte user role has AmazonS3FullAccess I verified that the failing pod has the env var `AWS ROLE ARN` set to the flyte user role And when I look inside the bucket I can see that there s a `` So something is working correctly to put in objects but then fails Not using minio either and docker image has `awscli==1 25 94`

Laura Lin · Answer

actually now that I m looking at it aws says the `flyte user role` has never been accessed

Laura Lin · Answer

Can it be this This says default instead of flyte user role

Ketan (kumare3) · Answer

you have to use the service account

Ketan (kumare3) · Answer

did you IAM for serviceaccounts

Ketan (kumare3) · Answer

and then associate that to the execution

Ketan (kumare3) · Answer

you can ofcourse have a default for a project domain

Laura Lin · Answer

I m launching these from the UI How can I set the default for the project

Ketan (kumare3) · Answer

you have to open the fold Advanced Options

Laura Lin · Answer

isnt that for specific execution

Ketan (kumare3) · Answer

and to set the default either when you register set the service account or when you run with pyflyte run ```pyflyte run service account```

Laura Lin · Answer

which arg is it in `flytectl register`

Ketan (kumare3) · Answer

Ketan (kumare3) · Answer

so this will help you set the default per project domain ^

Ketan (kumare3) · Answer

and in register

Ketan (kumare3) · Answer

pyflyte register service account=

Laura Lin · Answer

I still get the error with

Ketan (kumare3) · Answer

ohh not iam role

Ketan (kumare3) · Answer

service account

Ketan (kumare3) · Answer

sorry about the confusion here

Ketan (kumare3) · Answer

Ketan (kumare3) · Answer

iam role only works if you use kIAM which I think you dont

Laura Lin · Answer

is this simiar to <https docs flyte org projects cookbook en latest auto deployment deploying workflows html pulling images from a private container image registry> attach the iamrole to the kube service ccount

Ketan (kumare3) · Answer

similarish

Ketan (kumare3) · Answer

the EKS IAM role for ServiceAccounts is a thing that AWS has

Ketan (kumare3) · Answer

you have to follow specific steps that they have

Ketan (kumare3) · Answer

check the doc link on AWS that I shared

Laura Lin · Answer

is this something that you always have to do for EKS deployments

Laura Lin · Answer

Wondering if I missed it in the <https docs flyte org en latest deployment aws manual html>

Laura Lin · Answer

<https docs flyte org en latest deployment aws manual html oidc provider for the eks cluster> there s some stuff here that has to do with the iamroles I did do this

Laura Lin · Answer

so for following the doc you shared the IAM role I use is flyte user role and if I ve been using the default kube service account then default for that too

Laura Lin · Answer

oh i got it working

Ketan (kumare3) · Answer

Sorry busy with kids now but yeahhhh

Hiromu Hota · Answer

It worked for us too For posterity and more concrete example I annotated the default service account for each namespace like this ```$ kubectl annotate serviceaccount n flytesnacks development default <http eks amazonaws com role arn=arn aws iam xxxx role flyte user role|eks amazonaws com role arn=arn aws iam xxxx role flyte user role>``` Then a worker pod is spawn with AWS env vars like this ```$ kubectl describe pod f81f7df8fd03f4f84b45 n0 0 n flytesnacks development | grep AWS AWS STS REGIONAL ENDPOINTS regional AWS DEFAULT REGION xxxxxx AWS REGION xxxxxx AWS ROLE ARN arn aws iam xxxxx role flyte user role AWS WEB IDENTITY TOKEN FILE var run secrets eks amazonaws com serviceaccount token```

Ketan (kumare3) · Answer

cc < David Espejo he him > to ensure we can capture some of the learnings here