[Bug] Can't get iamserviceaccount because of an issue with an unrelated cloud formation stack

[calebgrollins]

What were you trying to accomplish?

What happened?

How to reproduce it?

I am trying to use eksctl get the iamserviceaccount of a given application, let's call it APPLICATION-A
eksctl get iamserviceaccount --region us-east-1 --name APPLICATION-A-sa --namespace OUR_NAMESPACE --cluster OUR-CLUSTER

This returns an error based on the CloudFormation stack of a different, unrelated serviceaccount for APPLICATION-B

Error: getting iamserviceaccounts: no output "Role1" in stack "eksctl-OUR-CLUSTER-addon-iamserviceaccount-OUR-NAMESPACE-APPLICATION-B-sa"

I do see the above error in APPLICATION-B's CloudFormation stack, but the stack for the APPLICATION-A is fine

I would expect that an error in one stack shouldn't prevent me from interacting with a different, unrelated serviceaccount

Logs

Anything else we need to know?

Windows 11

Versions

$ eksctl info

I'm using the latest AMD64/x86_64 build for Windows from here: https://eksctl.io/installation/#for-windows

eksctl version: 0.206.0
kubectl version: v1.29.1
OS: windows

[github-actions]

Hello calebgrollins 👋 Thank you for opening an issue in eksctl project. The team will review the issue and aim to respond within 1-5 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website

[cheeseandcereal]

I don't seem to be able to reproduce this issue. Are you able to provide reproduction instructions? I tried:

$ eksctl create cluster -n cluster
...
$ eksctl utils associate-iam-oidc-provider --cluster cluster --approve
...
$ eksctl create iamserviceaccount --name some-service-account --namespace kube-system --cluster cluster --role-name my-cool-testing-role --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy --approve
...
$ eksctl create iamserviceaccount --name some-other-service-account --namespace kube-system --cluster cluster --role-name my-cool-other-testing-role --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy --approve
...
$ eksctl get iamserviceaccount --name some-service-account --namespace kube-system --cluster cluster
NAMESPACE	NAME			ROLE ARN
kube-system	some-service-account	arn:aws:iam::123456789012:role/my-cool-testing-role
$ eksctl get iamserviceaccount --name some-other-service-account --namespace kube-system --cluster cluster
NAMESPACE	NAME				ROLE ARN
kube-system	some-other-service-account	arn:aws:iam::123456789012:role/my-cool-other-testing-role

[calebgrollins]

The issue is that when one of the iamserviceaccounts has an error in its CF stack, then it interferes with getting a different, unrelated iamserviceaccount. I'm not sure how said CF stack ended up with an error, but that's a separate issue

[cheeseandcereal]

Ok, I was able to reproduce with

$ eksctl create iamserviceaccount --name some-service-account --namespace kube-system --cluster cluster --role-name my-cool-testing-role --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy --approve --override-existing-serviceaccounts
2025-03-26 14:55:42 [ℹ]  1 iamserviceaccount (kube-system/some-service-account) was included (based on the include/exclude rules)
2025-03-26 14:55:42 [!]  metadata of serviceaccounts that exist in Kubernetes will be updated, as --override-existing-serviceaccounts was set
2025-03-26 14:55:42 [ℹ]  1 task: {
    2 sequential sub-tasks: {
        create IAM role for serviceaccount "kube-system/some-service-account",
        create serviceaccount "kube-system/some-service-account",
    } }2025-03-26 14:55:42 [ℹ]  building iamserviceaccount stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-service-account"
2025-03-26 14:55:42 [ℹ]  deploying stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-service-account"
2025-03-26 14:55:42 [ℹ]  waiting for CloudFormation stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-service-account"
2025-03-26 14:56:13 [ℹ]  waiting for CloudFormation stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-service-account"
2025-03-26 14:56:13 [ℹ]  serviceaccount "kube-system/some-service-account" already exists
2025-03-26 14:56:13 [ℹ]  serviceaccount "kube-system/some-service-account" is already up-to-date

$ eksctl create iamserviceaccount --name some-other-service-account --namespace kube-system --cluster cluster --role-name my-cool-testing-role --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy --approve --override-existing-serviceaccounts
2025-03-26 14:56:26 [ℹ]  1 existing iamserviceaccount(s) (kube-system/some-service-account) will be excluded
2025-03-26 14:56:26 [ℹ]  1 iamserviceaccount (kube-system/some-other-service-account) was included (based on the include/exclude rules)
2025-03-26 14:56:26 [!]  metadata of serviceaccounts that exist in Kubernetes will be updated, as --override-existing-serviceaccounts was set
2025-03-26 14:56:26 [ℹ]  1 task: {
    2 sequential sub-tasks: {
        create IAM role for serviceaccount "kube-system/some-other-service-account",
        create serviceaccount "kube-system/some-other-service-account",
    } }2025-03-26 14:56:26 [ℹ]  building iamserviceaccount stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-other-service-account"
2025-03-26 14:56:27 [ℹ]  deploying stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-other-service-account"
2025-03-26 14:56:27 [ℹ]  waiting for CloudFormation stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-other-service-account"
2025-03-26 14:56:57 [ℹ]  waiting for CloudFormation stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-other-service-account"
2025-03-26 14:56:57 [ℹ]  1 error(s) occurred and IAM Role stacks haven't been created properly, you may wish to check CloudFormation console
2025-03-26 14:56:57 [✖]  waiter state transitioned to Failure
Error: failed to create iamserviceaccount(s)

$ eksctl get iamserviceaccount --name some-service-account --namespace kube-system --cluster cluster
Error: getting iamserviceaccounts: no output "Role1" in stack "eksctl-cluster-addon-iamserviceaccount-kube-system-some-other-service-account"