Stuck on timeout error

[vitarkah]

Trying to add EKS cluster A to ArgoCD running in Cluster B (same account)

Get "https://aaaaa.gr7.us-east-2.eks.amazonaws.com/version?timeout=32s": getting credentials: exec: executable argocd-k8s-auth failed with exit code 20 (Client.Timeout exceeded while awaiting headers)

Looked at Subnet ACL, Security Groups & IP Access (EKS is public & private with allowed IP; so allowing Argo CD / EKS NAT Elastic IP in the cluster A)

I am also able to CURL from Argo CD EC2 Instance (from Nodegroup) to the URL above

Any pointers / idea would be super helpful. At this point I am totally stuck.

[vitarkah]

turned out to be a problem with the one of the policies. Addressing the policy took care care of the issue

[isihu]

Could you elaborate on that, please ? I'm having the same issue. Which policy turned out to be faulty?

[jorgelon]

yes please. same error here

[vitarkah]

The pattern setup closely follows the outline provided here: https://www.modulo2.nl/blog/argocd-on-aws-with-multiple-clusters. The script that set up the clusters, failed on argocd-deployer role set up. Without that role (or an equivalent in my case) it was just not working. Once that was set up with right policies, things just worked fine.

[jorgelon]

mmm i have the same problem. what policies did you add. thx

[isihu]

Funny, I was following the same tutorial.
For anyone reading this:
My mistake was using the same aws role for the argocd service accounts and for the deployment. In the tutorial, ArgoCD assumes the deployment role from its irsa roles. In my case, that means that Argo tries to assume the role it's already in leading to this cryptic error.
Due to my use case I have to use the same aws role. This can be possible by allowing the role be assumed from itself:

        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Principal": {
                "AWS": "arn:aws:sts::{ACCOUNT_ID}:role/{ROLE}"
            }
        }

[rezonick]

Thank you! had the same issue :)

[moonape1226]

Same issue here. Thanks for the solution!

[eagleusb]

Same here, I did use the terraform module to create the IRSA and setup the self assume role policy which worked 👍🏽

[korbin]

Both the argocd-application-controller and argocd-server IAM roles apparently need role delegation. Until adding the former this would consistently timeout for me, regardless of the assume role config.

[s33dunda]

Wow thanks all. I was expecting to get an auth error on first attempt but got a timeout instead. What a red herring!

[AnubhavSabharwa]

I am able to get the token via

argocd-k8s-auth aws --cluster-name test-dev --role-arn arn:aws:iam
Able to get the token but still on argocd the cluster addition got failed.

Below error:
/version?timeout=32s": getting credentials: exec: executable argocd-k8s-auth failed with exit code 20 (Client.Timeout exceeded while awaiting headers)

Please help me out on this

[magzim21]

I had this error. Turned out that I did not configure the current principal to assume the role.
The error message is misleading.