Troubleshooting Deployments on Amazon EKS

Help diagnose and fix issues you may encounter in your Kubeflow deployment

ALB can not be created

  1. kubectl get ingress -n istio-system
  2. NAME            HOSTS   ADDRESS   PORTS   AGE
  3. istio-ingress   *                 80      3min

If you see your istio-ingress ADDRESS is empty after 3 mins, it must be something wrong in your ALB ingress controller.

  1. E1024 09:02:59.934318       1 :0] kubebuilder/controller "msg"="Reconciler error" "error"="failed to build LoadBalancer configuration due to retrieval of subnets failed to resolve 2 qualified subnets. Subnets must contain the kubernetes.io/cluster/\u003ccluster name\u003e tag with a value of shared or owned and the kubernetes.io/role/elb tag signifying it should be used for ALBs Additionally, there must be at least 2 subnets with unique availability zones as required by ALBs. Either tag subnets to meet this requirement or use the subnets annotation on the ingress resource to explicitly call out what subnets to use for ALB creation. The subnets that did resolve were []"  "controller"="alb-ingress-controller" "request"={"Namespace":"istio-system","Name":"istio-ingress"}

If you see this error, you probably forget to update cluster_name during setup. Please go to edit view by kubectl edit deployment alb-ingress-controller -n kubeflow and make the change. Another reason could be that you did not tag your subnets so that Kubernetes knows to use only those subnets for external load balancers. To fix this ensure the public subnets are tagged with the Key: kubernetes.io/role/elb and Value: 1. See docs here for further details.

KF_DIR is not empty

  1. kfctl build -V -f ${CONFIG_URI}
  2. INFO[0000] Downloading https://raw.githubusercontent.com/kubeflow/manifests/v0.7-branch/kfdef/kfctl_aws.0.7.0.yaml to /var/folders/7z/9cx2bbsd3q3352bd8b01j_nmzx5lm9/T/703750259/tmp.yaml  filename="utils/k8utils.go:169"
  3. INFO[0001] Downloading https://raw.githubusercontent.com/kubeflow/manifests/v0.7-branch/kfdef/kfctl_aws.0.7.0.yaml to /var/folders/7z/9cx2bbsd3q3352bd8b01j_nmzx5lm9/T/367955766/tmp_app.yaml  filename="configconverters/converters.go:70"
  4. Error:  (kubeflow.error): Code 400 with message: current directory /kf_base/kf070 not empty, please switch directories
  5. Usage:
  6.   kfctl build [flags]
  8. Flags:
  9.   -f, --file string   Static config file to use. Can be either a local path or a URL.
  10.   -h, --help          help for build
  11.   -V, --verbose       verbose output default is false
  13.  (kubeflow.error): Code 400 with message: current directory /kf_base/kf070 not empty, please switch directories

This happens if you already initialize your configuration and you try to rerun kfctl build. Delete everything rm -rf * and try again.

EKS Cluster Creation Failure

There are several problems that could lead to cluster creation failure. If you see some errors when creating your cluster using eksctl, please open the CloudFormation console and check your stacks. To recover from failure, you need to follow the guidance from the eksctl output logs. Once you understand the root cause of your failure, you can delete your cluster and rerun kfctl apply -V -f ${CONFIG_FILE}.

Common issues:

  • The default VPC limit is 5 VPCs per region
  • Invalid command arguments
  1. + eksctl create cluster --config-file=/tmp/cluster_config.yaml
  2. [ℹ]  using region us-west-2
  3. [ℹ]  subnets for us-west-2b - public:192.168.0.0/19 private:192.168.96.0/19
  4. [ℹ]  subnets for us-west-2c - public:192.168.32.0/19 private:192.168.128.0/19
  5. [ℹ]  subnets for us-west-2d - public:192.168.64.0/19 private:192.168.160.0/19
  6. [ℹ]  nodegroup "general" will use "ami-0280ac619ed294a8a" [AmazonLinux2/1.12]
  7. [ℹ]  importing SSH public key "/Users/ubuntu/.ssh/id_rsa.pub" as "eksctl-test-cluster-nodegroup-general-11:2a:f6:ba:b0:98:da:b4:24:db:18:3d:e3:3f:f5:fb"
  8. [ℹ]  creating EKS cluster "test-cluster" in "us-west-2" region
  9. [ℹ]  will create a CloudFormation stack for cluster itself and 1 nodegroup stack(s)
  10. [ℹ]  if you encounter any issues, check CloudFormation console or try 'eksctl utils describe-stacks --region=us-west-2 --name=test-cluster'
  11. [ℹ]  building cluster stack "eksctl-test-cluster-cluster"
  12. [✖]  unexpected status "ROLLBACK_IN_PROGRESS" while waiting for CloudFormation stack "eksctl-test-cluster-cluster"
  13. [ℹ]  fetching stack events in attempt to troubleshoot the root cause of the failure
  14. [ℹ]  AWS::CloudFormation::Stack/eksctl-test-cluster-cluster: ROLLBACK_IN_PROGRESS – "The following resource(s) failed to create: [InternetGateway, ServiceRole, NATIP, VPC]. . Rollback requested by user."
  15. [✖]  AWS::EC2::EIP/NATIP: CREATE_FAILED – "Resource creation cancelled"
  16. [✖]  AWS::IAM::Role/ServiceRole: CREATE_FAILED – "Resource creation cancelled"
  17. [ℹ]  AWS::EC2::EIP/NATIP: CREATE_IN_PROGRESS – "Resource creation Initiated"
  18. [✖]  AWS::EC2::VPC/VPC: CREATE_FAILED – "The maximum number of VPCs has been reached. (Service: AmazonEC2; Status Code: 400; Error Code: VpcLimitExceeded; Request ID: xxxxxxxxxx)"
  19. [ℹ]  AWS::IAM::Role/ServiceRole: CREATE_IN_PROGRESS – "Resource creation Initiated"
  20. [ℹ]  AWS::EC2::EIP/NATIP: CREATE_IN_PROGRESS
  21. [✖]  AWS::EC2::InternetGateway/InternetGateway: CREATE_FAILED – "The maximum number of internet gateways has been reached. (Service: AmazonEC2; Status Code: 400; Error Code: InternetGatewayLimitExceeded; Request ID: 7b3c9620-d1fa-4893-9e91-fb94eb3f2ef3)"
  22. [ℹ]  AWS::EC2::VPC/VPC: CREATE_IN_PROGRESS
  23. [ℹ]  AWS::IAM::Role/ServiceRole: CREATE_IN_PROGRESS
  24. [ℹ]  AWS::EC2::InternetGateway/InternetGateway: CREATE_IN_PROGRESS
  25. [ℹ]  AWS::CloudFormation::Stack/eksctl-test-cluster-cluster: CREATE_IN_PROGRESS – "User Initiated"
  26. [ℹ]  1 error(s) occurred and cluster hasn't been created properly, you may wish to check CloudFormation console
  27. [ℹ]  to cleanup resources, run 'eksctl delete cluster --region=us-west-2 --name=test-cluster'
  28. [✖]  waiting for CloudFormation stack "eksctl-test-cluster-cluster" to reach "CREATE_COMPLETE" status: ResourceNotReady: failed waiting for successful resource state
  29. [✖]  failed to create cluster "test-cluster"

Resource Not Found in delete all

  1. + kubectl get ns/kubeflow
  2. Error from server (NotFound): namespaces "kubeflow" not found
  3. + kubectl get ns/kubeflow
  4. Error from server (NotFound): namespaces "kubeflow" not found
  5. + echo 'namespace kubeflow successfully deleted.'

You can ignore any Kubernetes “resource not found” errors that occur during the deletion phase.

InvalidParameterException in UpdateCluster

  1. + logging_components='"api","audit","authenticator","controllerManager","scheduler"'
  2. ++ aws eks update-cluster-config --name benchmark-0402222-sunday-satur --region us-west-2 --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'
  4. An error occurred (InvalidParameterException) when calling the UpdateClusterConfig operation: No changes needed for the logging config provided

The Amazon EKS UpdateCluster API operation will fail if you have invalid parameters. For example, if you already enabled logs in your EKS cluster, and you choose to create Kubeflow on existing cluster and also enable logs, you will get this error.

FSX Mount Failure

  1. Mounting command: mount
  2. Mounting arguments: -t lustre fs-0xxxxx2a216cf.us-west-2.amazonaws.com@tcp:/fsx /var/lib/kubelet/pods/224c2c96-5a91-11e9-b7e6-0a2a42c99f84/volumes/kubernetes.io~csi/fsx-static/mount
  3. Output: mount.lustre: Can't parse NID 'fs-0xxxxx2a216cf.us-west-2.amazonaws.com@tcp:/fsx'
  5. This mount helper should only be invoked via the mount (8) command,
  6. e.g. mount -t lustre dev dir
  8. usage: mount.lustre [-fhnvV] [-o <mntopt>] <device> <mountpt>
  9.   <device>: the disk device, or for a client:
  10.     <mgsnid>[:<altmgsnid>...]:/<filesystem>[/<subdir>]
  11.   <filesystem>: name of the Lustre filesystem (e.g. lustre1)
  12.   <mountpt>: filesystem mountpoint (e.g. /mnt/lustre)
  13.   -f|--fake: fake mount (updates /etc/mtab)

The Amazon FSx dnsName is incorrect, you can delete your pod using this persistent volume claim. The next step is to delete the PV and PVC. Next correct your input and reapply the PV and PVC.

  1. kubectl delete pod ${pod_using_pvc}
  2. ks delete default -c ${COMPONENT}
  3. ks param set ${COMPONENT} dnsName fs-0xxxxx2a216cf.fsx.us-west-2.amazonaws.com
  4. ks apply default -c ${COMPONENT}

Incompatible eksctl version

If you see this error when you run apply platform, it means your eksctl cli version is not compatible with eksctl.io version in cluster_config.yaml. Please upgrade your eksctl and try again.v1alpha5 is introduced from 0.1.31.

We are working with eksctl team to make sure feature release support backward compatibility at least for one version.

  1. loading config file "${KF_DIR}/aws_config/cluster_config.yaml": no kind "ClusterConfig" is registered for version "eksctl.io/v1alpha5" in scheme "k8s.io/client-go/kubernetes/scheme/register.go:60"