We are running Calico in our EKS clusters in AWS and are now trying to migrate our management of Spark jobs to EMR on EKS. It turns out that EMR on EKS generates service accounts with very long names and we are experiencing errors like this:
Failed to create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container “6989d862f6a83506d31d36f39a9341979d8b1e3d689440003654ab52f37c03ea” network for pod “00000002u4k06332q3b-rs9bp”: networkPlugin cni failed to set up pod “00000002u4k06332q3b-rs9bp_ipedia-01” network: error with field Metadata.Labels (value) = ‘emr-containers-sa-spark-client-029354679212-2nuauonu2i0xe6wam1s74smvgqb0fyib5’ (must be no more than 63 characters)kubelet ip-10-135-235-56.ec2.internal
The service account name is: emr-containers-sa-spark-client-029354679212-2nuauonu2i0xe6wam1s74smvgqb0fyib5
I understand that service account is a selection criteria for network policy. I was wondering if it is possible to configure Calico to not provide service account as an option for network policies? If that is not possible does Calico have any recommendations regarding running EMR on EKS?