An error is generated when you try to set the AWS_CREDENTIALS variable while deploying a Tanzu Kubernetes Grid cluster to AWS

Products

• Tanzu Kubernetes Grid

Issue/Introduction

Symptoms:

• When trying to set he AWS_CREDENTIALS variable while deploying a Tanzu Kubernetes Grid cluster to AWS, you see an error similar to the following:

An error occurred (LimitExceeded) when calling the CreateAccessKey operation: Cannot exceed quota for AccessKeysPerUser: 2
 

Environment

VMware Tanzu Kubernetes Grid 1.x
VMware Tanzu Kubernetes Grid Plus 1.x

Cause

This issue can occur when your AWS account (bootstrapper.cluster-api-provider-aws.sigs.k8s.io) is limited to two Access keys and two Access keys already exist. This may occur when you have provisioned Tanzu Kubernetes Grid clusters on AWS multiple times and repeated the steps noted at Prepare to Deploy the Management Cluster to Amazon EC2. These steps should only need to be run once and the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY values should be saved for future use.

Resolution

If you do not have the original AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY values, you will need to remove one of the AWS Access keys so that an additional one can be created and used for provisioning your Tanzu Kubernetes Grid cluster on AWS. You can view and delete Access keys at AWS by navigating to IAM > Users > select the bootstrapper.cluster-api-provider-aws.sigs.k8s.io user > Security credentials.

Note: You will need to update any existing .tkg/config.yaml file with the updated AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY values. You can check for the existence of these by looking for lines similar to the following in the file:
 

AWS_ACCESS_KEY_ID: <encoded:##################=>
AWS_SECRET_ACCESS_KEY: <encoded:N##############################################==>

The encoded values can be obtained by running a command similar to the following:
 

echo "<access key>" | base64 -d