# Boundary on EKS

**URL:** <https://discuss.hashicorp.com/t/boundary-on-eks/21356>\
**Category:** Boundary\
**Created:** [February 24, 2021, 1:12pm UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356 "2021-02-24T13:12:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![andybritton](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/andybritton/32/17528_2.png) [@andybritton](https://discuss.hashicorp.com/u/andybritton)\
**Post date:** [February 24, 2021, 1:12pm UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356/1 "2021-02-24T13:12:28Z")

</div>

Hi

I’m trying to setup Boundary on EKS. So far I’ve been following the reference architecture for kubernetes. Having gotten to the point of deploying the init container runs the database init command but hangs. I’m using a fresh RDS instance of Postgres 12 and I’ve tried running database migrate which works so I don’t think it’s an issue with connection. Running top inside of the container shows the init command running, any ideas? I’m also using the latest release 0.1.7 for reference.

Thanks

---

<div class="post-metadata">

**Author:** ![andybritton](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/andybritton/32/17528_2.png) [@andybritton](https://discuss.hashicorp.com/u/andybritton)\
**Post date:** [February 24, 2021, 1:47pm UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356/2 "2021-02-24T13:47:58Z")

</div>

So oddly after about 5 minutes it then ran and migrated the db, I’ve not set any resource requests/limits on the pods as per the reference architecture but is it known to be this slow to initialise the first time?

---

<div class="post-metadata">

**Author:** ![jbouse](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jbouse/32/17520_2.png) [@jbouse](https://discuss.hashicorp.com/u/jbouse)\
**Post date:** [June 17, 2022, 4:55pm UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356/3 "2022-06-17T16:55:38Z")

</div>

I’m also attempting to get Boundary deployed in EKS and writing a [Helm Chart](https://github.com/ugns/boundary-chart) to manage it. Testing locally I’m just using Docker Desktop with k8s engine enabled. I’ve split the controller and worker pod deployments to eventually allow both to be independently auto-scaled. The controller pod deployment includes an `initContainer` that executes the database init or migration.

I’ve monitored the logs and see that the init container runs the init/migrate command and I’ve logged into the PostgreSQL database and confirmed it’s gone from a fresh empty database to having multiple tables created and many have records. So I’m not exactly seeing the same issue you are reporting.

The issue I’m seeing is when I go to the controller endpoint `:9200` I’m being told there are no auth methods available. I’ve confirmed this via the browser and Boundary Desktop. Both the controller and worker pods are running, I currently have set `replicas: 1` just to limit scope during development testing.

I’m executing with the `hashicorp/boundary:0.8.1` image and keeping it simple using AEAD for KMS though I have prepared for using Vault Transit or AWS KMS. While I intend to run against a PostgreSQL RDS instance when in AWS, on Docker Desktop I’m using the `14.3` PostgreSQL image.

---

<div class="post-metadata">

**Author:** ![omkensey](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/omkensey/32/40882_2.png) [@omkensey](https://discuss.hashicorp.com/u/omkensey)\
**Post date:** [June 20, 2022, 2:04pm UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356/4 "2022-06-20T14:04:59Z")

</div>

Are there auth methods in an org scope? If not, what options did you pass to `boundary database init`?

---

<div class="post-metadata">

**Author:** ![jbouse](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jbouse/32/17520_2.png) [@jbouse](https://discuss.hashicorp.com/u/jbouse)\
**Post date:** [June 21, 2022, 12:07am UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356/5 "2022-06-21T00:07:39Z")

</div>

I actually found it was because I had mistakenly added the `-skip-*` options to the initial call to `boundary database init`. I deleted the Helm deployment, dropped and re-created the database and redeployed after removing the options and it it create the password auth method for the global scope so I could log into the UI.

I also removed the database migrate/init from being an `initContainer` and instead made it a Job with pre-\* Helm hooks to execute it before the ReplicaSet Deployments as it only needs to execute once as the `boundary server` execution pods will not allow the `boundary database [migrate|init]` process to have exclusive use of the database and locks everything up failing.

---

<div class="post-metadata">

**Author:** ![lucardcoder](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/lucardcoder/32/38837_2.png) [@lucardcoder](https://discuss.hashicorp.com/u/lucardcoder)\
**Post date:** [November 17, 2023, 12:12am UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356/6 "2023-11-17T00:12:15Z")

</div>

Hello! I am trying the helm chart you provided in EKS and it hangs at the boundary-init job. any idea why would that would be?  
job Logs:  
Error creating: pods “boundary-init-” is forbidden: error looking up service account boundary/boundary: serviceaccount “boundary” not found.

---

<div class="post-metadata">

**Author:** ![conor-mccullough](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/conor-mccullough/32/33722_2.png) [@conor-mccullough](https://discuss.hashicorp.com/u/conor-mccullough)\
**Post date:** [November 17, 2023, 12:30am UTC](https://discuss.hashicorp.com/t/boundary-on-eks/21356/7 "2023-11-17T00:30:27Z")

</div>

When you install the Helm chart with your values.yaml, try to add `—debug` and verifying what it’s doing with your serviceaccount.

[This k8s doc on service accounts](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) is a helpful read that might shed light on the issue.

Verifying it exists (`kubectl get serviceaccounts`) would be another first step here. Add -A if you’re using namespaces.
