<p>I'm trying my hand on iam roles for services account to secure the autoscaller. But I seem to be missing something. Little precision I'm using terraform to create the cluster.</p>

<p>I followed these documentation:</p>

<ul>
<li><a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/</a></li>
<li><a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html</a></li>
</ul>

<p>So I've created a role other than the one for the nodes and applied the policy for the autoscaller to this new role. This part is basic, no issue there.</p>

<p>I also activated the openid provider in terraform:</p>

<pre><code>resource "aws_iam_openid_connect_provider" "example" {
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = []
  url             = aws_eks_cluster.eks.identity.0.oidc.0.issuer
}
</code></pre>

<p>No issue the cluster is creating itself with no issue.</p>

<p>No I added the annotation to service account for the autoscalling:</p>

<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::ID:role/terraform-eks-autoscaller
  labels:
    k8s-addon: cluster-autoscaler.addons.k8s.io
    k8s-app: cluster-autoscaler
  name: cluster-autoscaler
  namespace: kube-system
</code></pre>

<p>My problem is that it does not seems to works and the pod is still trying to use the new IAM role but still using the node role:</p>

<pre><code>Failed to create AWS Manager: cannot autodiscover ASGs: AccessDenied: User: arn:aws:sts::ID:assumed-role/terraform-eks-node/i-ID is not authorized to perform: autoscaling:DescribeTags
</code></pre>

<p>Does someone know what step I'm missing here?</p>

<p>Thanks in advance for the help ;)</p>

<p>So answer is very simple. Your OIDC provider configuration is missing the thumbprint. It is essential for Iam to work correctly. 
Normally if you create OIDC provider in AWS console that thumbprint gets populated automatically, however it is not the case when you do it through terraform.</p>

<p>I have been caught by this as well so I have written a blog about this that you can find here: <a href="https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c" rel="noreferrer">https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c</a></p>

<p>To solve your issue simply add the following:</p>

<p>9E99A48A9960B14926BB7F3B02E22DA2B0AB7280</p>

<p>The above is the hashed root CA that doesn’t change for another 10+ years and it is the same across all regions. How to acquire it, you can read the blog I added link to above.</p>

<p>Additionally, ensure to use the latest autoscaler version which is matching the version of your kubernetes. Also, try adding security context with fsGroup: 65534. That is the current workaround to make the OIDC work properly for some apps.</p>
