Troubleshooting
| Symptom | Check |
|---|---|
aws sso login / token errors |
Re-auth (aws sso login) before AWS or kubectl steps |
| Cannot open Argo CD UI | Identity Center AWS IAM Identity Center (formerly AWS SSO) — organization-wide workforce identity. CLI access uses `aws sso login`. For the EKS managed Argo CD capability it is the only supported UI auth (local Argo CD users are not supported). IAM Identity Center docs user mapped ADMIN on the capability (Argo CD capability) |
| Application never syncs | destination.server must be the EKS cluster ARN — not destination.name: in-cluster alone, not kubernetes.default.svc |
| Argo CD Settings → Repositories empty | Expected — capability role GitPull on pulse-deploy, not a UI-registered repo |
| kpack Kubernetes-native build service that runs CNB builds on-cluster and pushes images to a registry. build fails on git |
Secret codecommit-credentials + kpack-sa patch; SSO cannot mint CodeCommit HTTPS credentials |
| kpack / ClusterBuilder 401 Unauthorized on ECR Amazon Elastic Container Registry — stores OCI images built by kpack; EKS pulls from here. |
Create/refresh ecr-credentials — IRSA alone is not enough; passwords expire ~12h |
| kpack IRSA policy missing | Rendered file demo/.generated/kpack/irsa-policy.json from kpack via GitOps |
| Build pod Pending / slow first build | Auto Mode may show empty nodes until capacity scales (several extra minutes) |
ImagePullBackOff on Pulse |
Wait for pulse:main in ECR; tag must match demo/deploy/base/deployment.yaml |
| Old app after kpack rebuild | Mutable tag main — kubectl rollout restart deployment/pulse -n default |
| CodeCommit AWS managed Git hosting — GitHub alternative used for app source and deploy manifests in this lab. push fails |
git-remote-codecommit or HTTPS git credentials; set user.email / user.name if commit rejects author |
| kpack Image not rebuilding | kubectl describe image pulse; confirm CodeCommit revision advanced |
| Capability delete leaves apps | deletePropagationPolicy is RETAIN — delete Applications first (Teardown) |
Useful commands
Section titled “Useful commands”kubectl describe image pulsekubectl get builds -Akubectl -n argocd get applications -o widekubectl -n argocd describe application pulsekubectl -n argocd describe application kpackaws ecr describe-images --repository-name pulseLocal Pulse smoke test (no AWS)
Section titled “Local Pulse smoke test (no AWS)”cd demo/app && go run ./cmd/pulsecurl -s localhost:8080/healthz