Failing to create persistent volume

[Mahoney]

Hi,

I'm trying to find the very lightest, simplest way to:

1. create a K8S cluster from scratch
2. install the https://charts.bitnami.com/bitnami/postgresql:15.5.12 helm chart into it

The postgresql helm chart creates a persistent volume claim with no storage class:

I'm trying to work out the correct incantations to make eksctl do this. So far I've got to this:

#!/usr/bin/env bash

CLUSTER_NAME=${1:-test-cluster}
REGION=${2:-eu-west-2}

cat > /tmp/eksctl-cluster-config.yaml << EOL
---
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: ${CLUSTER_NAME}
  region: ${REGION}

nodeGroups:
  - name: ng-1
    instanceType: m5.large
    iam:
      withAddonPolicies:
        ebs: true
EOL

# Create the cluster
eksctl create cluster -f /tmp/eksctl-cluster-config.yaml
eksctl utils associate-iam-oidc-provider --region="$REGION" --cluster="$CLUSTER_NAME" --approve

ACCOUNT="$(aws sts get-caller-identity --query Account --output text)"
eksctl create addon --name aws-ebs-csi-driver --cluster "$CLUSTER_NAME" --service-account-role-arn "arn:aws:iam::$ACCOUNT:role/AmazonEKS_EBS_CSI_DriverRole" --force

kubectl patch storageclass gp2 -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

which already feels like about 3 commands too many, but still leaves my claim kicking out this event:

LAST SEEN   TYPE      REASON                 OBJECT                                             MESSAGE
11m         Warning   ProvisioningFailed     persistentvolumeclaim/data-postgresql-0            failed to provision volume with StorageClass "gp2": rpc error: code = Internal desc = Could not create volume "pvc-6fc199ab-0e68-40b3-95c7-cff4b2e33a74": could not create volume in EC2: operation error EC2: CreateVolume, get identity: get credentials: failed to refresh cached credentials, failed to retrieve credentials, operation error STS: AssumeRoleWithWebIdentity, https response error StatusCode: 403, RequestID: f1d9cf72-bc34-4d44-9dea-d68e8a3b66f7, api error AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity

I'm guessing I've missed something obvious, as this seems such a simple use case, so any pointers on what it is would be much appreciated.

[Mahoney]

For anyone following after, it is fewer commands but slightly more config:

#!/usr/bin/env bash

CLUSTER_NAME=${1:-test-cluster}
REGION=${2:-eu-west-2}

cat > /tmp/eksctl-cluster-config.yaml << EOL
---
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: ${CLUSTER_NAME}
  region: ${REGION}

iam:
  withOIDC: true

addons:
  - name: aws-ebs-csi-driver
    attachPolicyARNs:
    - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy

nodeGroups:
  - name: ng-1
    instanceType: m5.large
    iam:
      withAddonPolicies:
        ebs: true
EOL

# Create the cluster
eksctl create cluster -f /tmp/eksctl-cluster-config.yaml

# Make gp2 the default storage class
kubectl patch storageclass gp2 -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

Not sure if the step to make gp2 the default storage class is strictly necessary, it takes soooo long to test I haven't bothered!

[Mahoney]

(On the off chance anyone from eksctl sees this, would you consider making this config the default? Would have saved me much angst and time and unhappiness.)