Crossplane Multi-Account EKS Setup: Provider Unhealthy (False) and Cross-Account ECR Pull Issues #6746
Replies: 4 comments
-
|
Hi All, I would like to know that is it possible to create buckets, databases in a different account. How does the crossplane stores it's state? If I create A db and the crossplane is uninstalled will the db gone? Thank you for your answers in advance! |
Beta Was this translation helpful? Give feedback.
-
|
@SHASHANK400312 I don't follow what you're trying to do. Which provider is showing unhealthy? Did you check the ProviderRevision and Crossplane pod logs for more information? Are you using provider-kubernetes to create the Deployment in the second cluster? Crossplane can only create native kubernetes resources directly in it's own cluster, so you will need to wrap your resources in provider-kubernetes ECR access from account B is controlled by the AWS policies you have applied to the ECR, Crossplane has no control over that (unless you provision the policies using Crossplane). |
Beta Was this translation helpful? Give feedback.
-
|
@gabbler97 You can definitely create resources in different accounts - you will need to have roles in the target accounts that can be assumed by the Crossplane account, and then set up ProviderConfigs with the appropriate account/roles to be assumed. You can use RBAC to restrict access to the Crossplane state is stored in the kubernetes objects. If you uninstall Crossplane and/or it's providers, the CRDs for those resources will also be deleted and the resources will cease to exist. If you set up the managed resources to be Orphaned on delete them the external resources will survive. Whether or not Crossplane can discover an existing resource depends on the design and naming convention of the resource. I'm not sure that this is related to the original issue, so please feel free to open a new discussion or use the Slack channel if you have more questions. |
Beta Was this translation helpful? Give feedback.
-
|
Dear @bobh66, All the best! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I’m new to Crossplane and trying a multi-account setup. In Account A, I have an EKS cluster with Crossplane installed. I created the provider file, a kubeconfig secret for Account B’s cluster, a ProviderConfig pointing to that secret, and some manifests (Deployment + Service) that I want to get applied in Account B. In Account B, I have another EKS cluster with 2 worker nodes. I created a ServiceAccount with ClusterRoleBinding, then extracted the CA data and token and used them to build the kubeconfig that I stored as a secret in Account A. My goal is that when I apply the image pod Deployment in Account A, the application pod that actually run in Account B’s EKS cluster can access same image that in Account A ECR . But right now the provider health in Account A is showing False, and the pod is not getting created in Account B. So my questions are: do these steps sound sufficient, or am I missing something? Do I need to change anything in the kubeconfig secret (like cluster name/context) or in IAM policies? And in general, what could cause the provider to stay unhealthy (False) here? give me all steps
Beta Was this translation helpful? Give feedback.
All reactions