NoCredentialProviders: no valid providers in chain

[rclayton-the-terrible]

"Failed creating cluster: NoCredentialProviders: no valid providers in chain" - keep getting this error. Noticed that there was a similar issue registered in the AWS GO SDK.

[aaronlevy]

@rclayton-the-terrible are you still seeing this issue?

[rclayton-the-terrible]

@aaronlevy Honestly, I've stop trying. The closest I got to a full Kubernetes deployment on AWS was mirroring Kelsey's Terraform scripts. Since then, I've gotten really busy in development and haven't put any effort into it.

[aaronlevy]

@rclayton-the-terrible if you get some time to come back to this, and you're still having issues, please let us know. I'm gonna close this for now, but feel free to re-open.

Also, just as a note, a quick way to get started deploying a cluster to AWS should be using the defaults in our quickstart guide: https://coreos.com/kubernetes/docs/latest/kubernetes-on-aws.html#kube-aws-quickstart

[munhitsu]

It might be related to: aws/aws-sdk-go#345

[jasdel]

@rclayton-the-terrible Saw this was linked to the SDK. It looks like coreos-kubernetes is using a fairly old version of the SDK (0.9.5) But I've verified that this version of the SDK should be returning the configured role credential.

You can run the following curl commands on the EC2 host to see what error the SDK is running into.

# Get the role name
curl http://169.254.169.254//latest/meta-data/iam/security-credentials/

# Use role name to get credentials
curl http://169.254.169.254//latest/meta-data/iam/security-credentials/<my-ec2-iam-role-name>

The AWS SDK for Go has aws/aws-sdk-go#413 to improve this error message.

[kbrwn]

I ran into this issue yesterday. Using the latest version of kube-aws and my credential file is set up correctly.

[four43]

+1 having this issue as well. Anything we can do to help debug?

EDIT: Doh! This was my fault for trying to do this from home. This message appeared when I had invalid (or in my case totally missing) AWS credentials. Make sure you can run something like aws ec2 describe-instances to ensure your AWS credentials are valid.

[aymanosman]

I also experienced the error.

Initialized TLS infrastructure
Wrote kubeconfig to ...
Waiting for cluster creation...
Failed creating cluster: NoCredentialProviders: no valid providers in chain

I was using export AWS_DEFAULT_PROFILE=foo

Fixed the issue by making sure that a [default] profile was set in ~/.aws/credentials, but it still remains confusing to me why I was getting an error.

[aaronlevy]

/cc @colhom

[colhom]

@aymanosman if you have multiple aws credentials in your ~/.aws/credentials, how is the aws client supposed to know which one to use if you don't explicitly specify a default?

The "more direct" way is to just export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY etc environment variables, rather than deal with the credentials chain.

[aymanosman]

@colhom I was under the (presumably false) impression that export AWS_DEFAULT_PROFILE=foo would do the trick. It is one way the awscli determines which profile to use and I expected kube-aws to also respect that.

http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html.

I have no idea how much work it is to support multiple profiles in this way. It's not a major issue.

[aymanosman]

The docs for the go sdk (https://github.com/aws/aws-sdk-go) seams to make no mention of AWS_DEFAULT_PROFILE which suggests that is isn't supported. So it is not an issue with this repo.

EDIT: In fact, support has been ruled out :) aws/aws-sdk-go#554.

EDIT2: Omg, apparently you can use AWS_PROFILE instead of AWS_DEFAULT_PROFILE do achieve the same effect with the sdk... I have tested this and it works. https://github.com/aws/aws-sdk-go/blob/c59d0ced7590a7e8df83b5871eb6dfbb13940af2/aws/credentials/shared_credentials_provider.go#L37

[jasdel]

@colhom, The AWS SDK for Go only supports the AWS_PROFILE environment variable for profile names. AWS_DEFAULT_PROFILE is a value only supported by the AWS CLI, not the SDKs. To add it would be a potentially breaking change to SDK users. We have issue aws/aws-sdk-go#384 which discusses this topic.

If you set env AWS_PROFILE to your desired profile the SDK should respond to that.

[DImuthuUpe]

I'm also getting the issue. I followed instructions mentioned in https://coreos.com/kubernetes/docs/latest/kubernetes-on-aws.html. I tried v0.4.1, 0.4.0 but no luck.

[colhom]

Ref: #303

[cgag]

@DImuthuUpe This error means the aws sdk isn't picking up your credentials correctly. The docs have been updated with instructions for how to configure them.

I'm going to consider this fixed by the documentation update, but we'll enable verbose credential errors as well: #368.

Feel free to reopen if there's any more trouble.

edit: I don't actually have issue closing. @colhom can you close this and #303?