AWS Ingress控制器部署报错NoCredentialProviders问题求助

问题根源 #

报错NoCredentialProviders: no valid providers in chain说明AWS Load Balancer Controller无法获取有效AWS凭证调用API创建ALB。在EKS集群中，正确的权限配置方式是IAM Roles for Service Accounts (IRSA)，而非直接设置环境变量。你通过Helm安装控制器时仅创建了ServiceAccount，但未关联具备所需权限的IAM角色，导致权限缺失。

解决步骤 #

1. 创建ALB控制器所需IAM权限策略 #

创建JSON策略文件alb-controller-policy.json，包含控制器操作AWS资源的必要权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAddresses",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeInstances",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeTags",
                "ec2:GetCoipPoolUsage",
                "ec2:DescribeCoipPools",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeListenerCertificates",
                "elasticloadbalancing:DescribeSSLPolicies",
                "elasticloadbalancing:DescribeRules",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetGroupAttributes",
                "elasticloadbalancing:DescribeTargetHealth",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:CreateTargetGroup",
                "elasticloadbalancing:CreateListener",
                "elasticloadbalancing:CreateRule",
                "elasticloadbalancing:ModifyLoadBalancerAttributes",
                "elasticloadbalancing:ModifyTargetGroup",
                "elasticloadbalancing:ModifyTargetGroupAttributes",
                "elasticloadbalancing:AddTags",
                "elasticloadbalancing:RemoveTags",
                "elasticloadbalancing:RegisterTargets",
                "elasticloadbalancing:DeregisterTargets",
                "elasticloadbalancing:SetIpAddressType",
                "elasticloadbalancing:SetSecurityGroups",
                "elasticloadbalancing:SetSubnets",
                "elasticloadbalancing:DeleteLoadBalancer",
                "elasticloadbalancing:DeleteTargetGroup",
                "elasticloadbalancing:DeleteListener",
                "elasticloadbalancing:DeleteRule"
            ],
            "Resource": "*"
        }
    ]
}

执行命令创建IAM策略：

aws iam create-policy \
    --policy-name AWSLoadBalancerControllerIAMPolicy \
    --policy-document file://alb-controller-policy.json

2. 创建IAM角色并配置信任关系 #

先获取EKS集群的OIDC提供商URL：

aws eks describe-cluster --name sample-cluster --query "cluster.identity.oidc.issuer" --output text

输出格式类似：https://oidc.eks.ap-south-1.amazonaws.com/id/EXAMPLEOIDCIDENTIFIER

创建信任关系文件trust-policy.json，替换OIDC_PROVIDER为上面的输出，ACCOUNT_ID为你的AWS账号ID：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::ACCOUNT_ID:oidc-provider/OIDC_PROVIDER"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "OIDC_PROVIDER:sub": "system:serviceaccount:kube-system:aws-load-balancer-controller"
                }
            }
        }
    ]
}

创建IAM角色：

aws iam create-role \
    --role-name AmazonEKSLoadBalancerControllerRole \
    --assume-role-policy-document file://trust-policy.json

3. 关联IAM策略到角色 #

aws iam attach-role-policy \
    --policy-arn arn:aws:iam::ACCOUNT_ID:policy/AWSLoadBalancerControllerIAMPolicy \
    --role-name AmazonEKSLoadBalancerControllerRole

4. 绑定ServiceAccount与IAM角色 #

给已创建的ServiceAccount添加权限注释，替换ROLE_ARN为上面创建的角色ARN：

kubectl annotate serviceaccount aws-load-balancer-controller \
    -n kube-system \
    eks.amazonaws.com/role-arn=arn:aws:iam::ACCOUNT_ID:role/AmazonEKSLoadBalancerControllerRole

5. 重启控制器Pod加载新权限 #

kubectl rollout restart deployment aws-load-balancer-controller -n kube-system

6. 验证Ingress状态 #

等待3-5分钟后，查看Ingress的Address字段是否生成：

kubectl describe ingress ingress-srv-eks

额外检查点 #

• 若EKS集群未启用OIDC提供商，先执行以下命令启用：

  eksctl utils associate-iam-oidc-provider --cluster sample-cluster --approve
  

• 检查控制器Pod是否正常运行：

  kubectl get pods -n kube-system | grep aws-load-balancer-controller
  

内容的提问来源于stack exchange，提问作者Mahesh