Anthos Service Mesh on AWS EKS - istiod - no certificate returned for the CSR

[olsson]

Hello,

I'm trying to install Anthos Service Mesh on AWS EKS cluster.  Below there is a command which I'm using to instal ASM:

./asmcli install \
  --verbose \
  --fleet_id ${fleet_project_id} \
  --kubeconfig ${kubeconfig} \
  --output_dir ${output_dir} \
  --platform multicloud \
  --enable_all \
  --ca mesh_ca

The problem is that, the installation is not finished with success because, istiod components can not go into Running state. It's because of the error:

2023-04-05T20:01:59.436053Z warn discovery is not ready: <nil>
2023-04-05T20:02:02.294910Z error failed to create discovery service: failed generating key and cert by kubernetes: no certificate returned for the CSR: "csr-workload-xzcb47kh26j2qrhfbb"
Error: failed to create discovery service: failed generating key and cert by kubernetes: no certificate returned for the CSR: "csr-workload-xzcb47kh26j2qrhfbb"

Does anybody knows what can be an issue ?

[bkauf]

Hello, it looks like you are missing the --attached-cluster option.   If you search this page for EKS you will find the correct EKS installation command

./asmcli install \
  --fleet_id FLEET_PROJECT_ID \
  --kubeconfig KUBECONFIG_FILE \
  --output_dir DIR_PATH \
  --platform multicloud \
  --enable_all \
  --option attached-cluster \
  --ca mesh_ca