<p>I have a really strange and annoying Kubernetes issue. I developed sign-in service (like <a href="https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-v2-aspnet-core-webapp" rel="nofollow noreferrer">this</a>) and it is working without errors when running it on my Windows laptop. In addition, it is also working fine when running it on my local Kubernetes single-node cluster, activated with Docker Desktop. Docker desktop, in my situation, uses Linux containers with WSL (2) integration. It want the behaviour to be the same on my EKS cluster which is simply not happening. Let my first describe the relevant files.</p>
<p>This is my deployment file:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: xxxxxxxx
spec:
  selector:
   matchLabels:
    app: xxxxxxxx
  replicas: 3
  template:
    metadata:
      labels:
        app: xxxxxxxx
    spec:
      containers:
      - name: xxxxxxxx
        image: yyyyyy.dkr.ecr.qqqqq.amazonaws.com/xxxxxxxx:2676
        livenessProbe:
          httpGet:
            path: /health/live
            port: 80
          initialDelaySeconds: 30
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 80
          initialDelaySeconds: 30
          timeoutSeconds: 5
        ports:
        - containerPort: 80
        env:
        - name: &quot;ASPNETCORE_ENVIRONMENT&quot;
          value: &quot;KubernetesDevelopment&quot;
        volumeMounts:
        - name: secrets
          mountPath: /secret
          readOnly: true
        resources:
          requests:
            memory: &quot;64Mi&quot;
            cpu: &quot;250m&quot;
          limits:
            memory: &quot;128Mi&quot;
            cpu: &quot;500m&quot;
      volumes:
      - name: secrets
        secret:
          secretName: secret-appsettings
      imagePullSecrets:
       - name: awspull
 
</code></pre>
<p>This is my Dockerfile:</p>
<pre><code>FROM mcr.microsoft.com/dotnet/aspnet:5.0.4-alpine3.13 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:5.0 AS build
WORKDIR /src
COPY [&quot;QQQQQ.API/QQQQQ.API.csproj&quot;, &quot;QQQQQ.API/&quot;]
RUN dotnet restore &quot;QQQQQ.API/QQQQQ.API.csproj&quot;
COPY . .
WORKDIR &quot;/src/QQQQQ.API&quot;
RUN dotnet build &quot;QQQQQ.API.csproj&quot; -c Release -o /app/build

FROM build AS publish
RUN dotnet publish &quot;QQQQQ.API.csproj&quot; -c Release -o /app/publish

FROM base AS final
RUN addgroup -S lirantal &amp;&amp; adduser -S lirantal -G lirantal
WORKDIR /app
COPY --from=publish /app/publish .
RUN chown -R lirantal:lirantal /app
USER lirantal
CMD cp /secret/*.* /app &amp;&amp; dotnet QQQQQ.API.dll
</code></pre>
<p>This is what has been logged (on my own local Kubernetes cluster):</p>
<blockquote>
<p>warn:
Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]</p>
<p>Storing keys in a directory
'/home/lirantal/.aspnet/DataProtection-Keys' that may not be persisted
outside of the container. Protected data will be unavailable when
container is destroyed.</p>
<p>warn:
Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35]</p>
<p>No XML encryptor configured. Key
{e13ce6cb-c64d-4aaf-ad4f-1a345c73f5bc} may be persisted to storage in
unencrypted form.</p>
<p>info: Microsoft.Hosting.Lifetime[0]</p>
<p>Now listening on: http://[::]:80</p>
<p>info: Microsoft.Hosting.Lifetime[0]</p>
<p>Application started. Press Ctrl+C to shut down.</p>
<p>info: Microsoft.Hosting.Lifetime[0]
Hosting environment: KubernetesDevelopment
info: Microsoft.Hosting.Lifetime[0]
Content root path: /app
warn: Microsoft.AspNetCore.HttpsPolicy.HttpsRedirectionMiddleware[3]</p>
<p>Failed to determine the https port for redirect.</p>
</blockquote>
<p>And this is what has been logged when running it in AWS EKS:</p>
<blockquote>
<p>Loading... [40m[1m[33mwarn[39m[22m[49m:
Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
Storing keys in a directory
'/home/lirantal/.aspnet/DataProtection-Keys' that may not be persisted
outside of the container. Protected data will be unavailable when
container is destroyed. [40m[1m[33mwarn[39m[22m[49m:
Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35] No
XML encryptor configured. Key {04076fdc-f191-4253-9dc4-dbc77981d9b3}
may be persisted to storage in unencrypted form.
[41m[1m[37mcrit[39m[22m[49m:
<strong>&gt; Microsoft.AspNetCore.Server.Kestrel[0] Unable to start Kestrel.</strong>
System.Net.Sockets.SocketException (13): Permission denied at
System.Net.Sockets.Socket.UpdateStatusAfterSocketErrorAndThrowException(SocketError
error, String callerName) at System.Net.Sockets.Socket.DoBind(EndPoint
endPointSnapshot, SocketAddress socketAddress) at
System.Net.Sockets.Socket.Bind(EndPoint localEP) at
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketConnectionListener.g__BindSocket|13_0(&lt;&gt;c__DisplayClass13_0&amp;
) at
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketConnectionListener.Bind()
at
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportFactory.BindAsync(EndPoint
endpoint, CancellationToken cancellationToken) at
Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Infrastructure.TransportManager.BindAsync(EndPoint
endPoint, ConnectionDelegate connectionDelegate, EndpointConfig
endpointConfig) at
Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.&lt;&gt;c__DisplayClass29_0<code>1.&lt;&lt;StartAsync&gt;g__OnBind|0&gt;d.MoveNext() --- End of stack trace from previous location --- at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindEndpointAsync(ListenOptions endpoint, AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions.BindAsync(AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.AnyIPListenOptions.BindAsync(AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IEnumerable</code>1
listenOptions, AddressBindContext context) at
Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.BindAsync(CancellationToken
cancellationToken) at
Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.StartAsync[TContext](IHttpApplication<code>1 application, CancellationToken cancellationToken) Unhandled exception. System.Net.Sockets.SocketException (13): Permission denied at System.Net.Sockets.Socket.UpdateStatusAfterSocketErrorAndThrowException(SocketError error, String callerName) at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress) at System.Net.Sockets.Socket.Bind(EndPoint localEP) at Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketConnectionListener.&lt;Bind&gt;g__BindSocket|13_0(&lt;&gt;c__DisplayClass13_0&amp; ) at Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketConnectionListener.Bind() at Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportFactory.BindAsync(EndPoint endpoint, CancellationToken cancellationToken) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Infrastructure.TransportManager.BindAsync(EndPoint endPoint, ConnectionDelegate connectionDelegate, EndpointConfig endpointConfig) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.&lt;&gt;c__DisplayClass29_0</code>1.&lt;g__OnBind|0&gt;d.MoveNext()
--- End of stack trace from previous location --- at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindEndpointAsync(ListenOptions
endpoint, AddressBindContext context) at
Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions.BindAsync(AddressBindContext
context) at
Microsoft.AspNetCore.Server.Kestrel.Core.AnyIPListenOptions.BindAsync(AddressBindContext
context) at
Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext
context) at
Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IEnumerable<code>1 listenOptions, AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.BindAsync(CancellationToken cancellationToken) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.StartAsync[TContext](IHttpApplication</code>1
application, CancellationToken cancellationToken) at
Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken
cancellationToken) at
Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken
cancellationToken) at
Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost
host, CancellationToken token) at
Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost
host, CancellationToken token) at
Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.Run(IHost
host) at
QQQQ.API.Program.Main(String[] args)
in /src/Kinly.SMPD.XXXXXXX.API/Program.cs:line 10</p>
</blockquote>
<p>This is really strange. What I do is just entering:</p>
<pre><code>kubectl apply -f deployment.yml
</code></pre>
<p>The pods then start logging things, which is normal. However, Kestrel should work and as does work, but only on my &quot;own&quot; Kubernetes cluster, not when using the EKS Kubernetes cluster. How come? And how to fix? I find this so strange as this is an EKS only problem I have. My service simply does not log any errors, except when running it on my EKS Cluster. So please tell me how this is possible and how to fix it.</p>

Daan
<blockquote>
<p>Microsoft.AspNetCore.Server.Kestrel[0] Unable to start Kestrel. System.Net.Sockets.SocketException (13): Permission denied at</p>
</blockquote>
<p>Looks like your container did not have enough permissions to listen on the port that you want.</p>
<p>In Linux, you typically need privileged permissions to listen to a port 1024 and lover. I suggest that you change your app to listen to port 8080 and 8433 instead. You can have a Service that expose port 80 but map that to targetPort 8080.</p>
