# EKS 1.21 and HCP Vault 1.8.4 **URL:** \ **Category:** HCP Vault\ **Created:** [November 10, 2021, 3:03pm UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741 "2021-11-10T15:03:07Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![volkorny](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/volkorny/32/23632_2.png) [@volkorny](https://discuss.hashicorp.com/u/volkorny)\ **Post date:** [November 10, 2021, 3:03pm UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741/1 "2021-11-10T15:03:07Z")
Hi all I try to process this guide > **[Peering an AWS VPC with HashiCorp Cloud Platform (HCP) | HashiCorp -...](https://learn.hashicorp.com/tutorials/cloud/amazon-peering-hcp?in=vault%2Fcloud-ops)** > > Create a AWS VPC peering connection with HashiCorp Virtual Network (HVN) with AWS EKS 1.21 and HCP Vault 1.8.4 But I got an error: [ERROR] auth.handler: error authenticating: error=“context deadline exceeded” backoff= in vault-agent-init container and product container stuck in “Init:0/1” state. Please help. I already tried a lot of different issuers: issuer=“kubernetes/serviceaccount” issuer=“[https://kubernetes.default.svc.cluster.local](https://kubernetes.default.svc.cluster.local)” issuer=“[https://oidc.eks.us-west-2.amazonaws.com/id/XXXXXXXXXXXXX](https://oidc.eks.us-west-2.amazonaws.com/id/XXXXXXXXXXXXX)” and also disable\_iss\_validation=true but those options doesn’t work for me. ---
**Author:** ![xka5h](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/xka5h/32/14939_2.png) [@xka5h](https://discuss.hashicorp.com/u/xka5h)\ **Post date:** [November 10, 2021, 4:03pm UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741/2 "2021-11-10T16:03:15Z")
This type of error sometimes can also be due to a network issue somewhere in the interaction between your HCP Vault cluster and the EKS endpoint. Is the kubernetes\_host address you have configured in the Vault auth method only privately accessible from your VPC? If so, you may need to add a route to the HVN in HCP that is peered to your AWS VPC where your EKS cluster is. The route you configure for your HVN should target the CIDR range of the EKS cluster control plane nodes. This might help get past the current error you are facing. ---
**Author:** ![volkorny](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/volkorny/32/23632_2.png) [@volkorny](https://discuss.hashicorp.com/u/volkorny)\ **Post date:** [November 10, 2021, 4:35pm UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741/3 "2021-11-10T16:35:59Z")
It is not problem to test EKS to HCP connection. I just use curl in pod to try to reach VAULT\_PRIVATE\_ADDR. But are there some way to try is KUBE\_HOST reachable from HCP? ---
**Author:** ![volkorny](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/volkorny/32/23632_2.png) [@volkorny](https://discuss.hashicorp.com/u/volkorny)\ **Post date:** [November 10, 2021, 5:06pm UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741/4 "2021-11-10T17:06:26Z")
I have configured connection\_url for postgresql-database-plugin to use internal IP of POSTGRES\_IP 10.7.X.X. And Vault have no any problem to connect to Postgres and create a password: ```auto products-# \du List of roles Role name | Attributes | Member of ----------------------------------------------------+------------------------------------------------------------+----------- postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {} v-token-hc-product-RhrmdvnQyP0xKlfs9uls-1636563793 | Password valid until 2021-11-10 18:03:18+00 | {} products-# ``` So we have tested HCP-AWS network, routes, and Security Groups. All rules configured for 0-65536 port range. ---
**Author:** ![volkorny](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/volkorny/32/23632_2.png) [@volkorny](https://discuss.hashicorp.com/u/volkorny)\ **Post date:** [November 11, 2021, 9:46am UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741/5 "2021-11-11T09:46:58Z")
I have downgraded kubernetes to 1.18 I see this message now: ```auto 2021-11-11T09:45:00.834Z [ERROR] auth.handler: error authenticating: error= | Error making API request. | | URL: PUT https://vault-cluster.private.vault.id-id-id-id-id-id-id-id.aws.hashicorp.cloud:8200/v1/admin/auth/kubernetes/login | Code: 403. Errors: | | * permission denied backoff=32.01s ``` ---
**Author:** ![volkorny](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/volkorny/32/23632_2.png) [@volkorny](https://discuss.hashicorp.com/u/volkorny)\ **Post date:** [November 12, 2021, 2:59pm UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741/6 "2021-11-12T14:59:21Z")
In the first message I have posted the wrong URL to the guide, I have used this one: > **[HCP Vault with Amazon Elastic Kubernetes Service | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/cloud/vault-eks)** > > Connect a Vault client running in Amazon EKS to HashiCorp Cloud Platform (HCP) Vault. ---
**Author:** ![xka5h](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/xka5h/32/14939_2.png) [@xka5h](https://discuss.hashicorp.com/u/xka5h)\ **Post date:** [November 17, 2021, 3:24pm UTC](https://discuss.hashicorp.com/t/eks-1-21-and-hcp-vault-1-8-4/31741/7 "2021-11-17T15:24:01Z")
If you are still experiencing any issues with this, please feel free to file a support ticket by emailing [support@hashicorp.com](mailto:support@hashicorp.com) or directly from the [support portal](https://support.hashicorp.com/hc/en-us).