无法从链中的任何提供商加载 AWS 凭证：WebIdentityTokenCredentialsProvider：无法找到指定的 Web 身份令牌文件

Question

我正在使用 aws eks fargate deployment.yaml 文件部署我的服务，我的服务将连接到 dynamodb，并且在加载 id 时会抛出错误。即使我通过以下命令获得了网络令牌文件。

kubectl exec -n first-namespace first-deployment-fhghgj567kkk-257xq env | grep AWS

AWS_REGION=us-east-1
AWS_ROLE_ARN=arn:aws:iam::263011912432:role/firstRole
AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token

但它仍然抛出以下错误。

Caused by: com.amazonaws.SdkClientException: Unable to load AWS credentials from any provider in the chain: 
[EnvironmentVariableCredentialsProvider: 
Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) 
and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)), 
SystemPropertiesCredentialsProvider: Unable to load AWS credentials from Java system properties (aws.accessKeyId and aws.secretKey), 
WebIdentityTokenCredentialsProvider: Unable to locate specified web identity token file: 
/var/run/secrets/eks.amazonaws.com/serviceaccount/token, 
com.amazonaws.auth.profile.ProfileCredentialsProvider@7b58e085: profile file cannot be null, 
com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@39cb0014: Failed to connect to service endpoint: ]

我通过 ssh 进入容器并检查令牌是否仍然存在。

有人可以帮忙吗？谢谢

Answer 1

我遇到了类似的问题，就我而言，我必须升级 java sdk 并添加服务帐户，我没有尝试自己调用 dynamo，但 s3 和 lambda 工作正常。以下是我遵循的步骤，这是文档链接：https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html

首先，启用OIDC

eksctl utils associate-iam-oidc-provider --cluster cluster_name --approve

然后创建并应用您的服务帐户，请注意该角色必须有权访问您要使用的任何服务（dynamo）：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: fargateserviceaccount
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT:role/MY_ROLE_NAME

在您的 pod 上，定义服务帐户和环境变量：

spec:
  serviceAccountName: <ServiceAccountName> (kubectl get sa)
  containers:
    - name: java-api
      image: <AccountID>.dkr.ecr.us-east-1.amazonaws.com/<Repo>:<tag>
      env:
        - name: AWS_REGION
          value: us-east-1

最后在代码中使用 WebIdentityTokenCredentialsProvider

// Create Credentials provider using ENV variables -> Service account is used to run  Fargate
WebIdentityTokenCredentialsProvider awsCredentialProvider = WebIdentityTokenCredentialsProvider.builder()
        .roleArn(System.getenv("AWS_ROLE_ARN"))
        .roleSessionName(System.getenv("AWS_ROLE_SESSION_NAME"))
        .webIdentityTokenFile(System.getenv("AWS_WEB_IDENTITY_TOKEN_FILE"))
        .build();
// Build client using explicit credentials provider
AWSLambdaClientBuilder builder = AWSLambdaClientBuilder.standard()
        .withRegion(REGION)
        .withCredentials(awsCredentialProvider);
client = builder.build();

Answer 2

我遇到了同样的问题，但观察到一个记录器

WebIdentityTokenCredentialsProvider(): To use web identity tokens, the 'sts' service module must be on the class path

添加依赖项software.amazon.awssdk:sts解决了我的问题。sts因此，如果存在上述记录器，请尝试添加正确的 aws sdk 版本的依赖项。