EKS with Kubectl keeps saying Unauthorized

user_313237 0
Viewed 3649

I am currently trying to set up an EKS cluster on AWS with CloudFormation. I have been following the guide on https://en.sokube.ch/post/aws-kubernetes-aws-elastic-kubernetes-service-eks.

However, after my EKS cluster is successfully created I am unable to interact with it through kubectl as I always get error: You must be logged in to the server (Unauthorized). I have been stuck on what I am doing wrong.

One hint that may be the problem is that I created the stack via the AWS Console, and not the AWS CLI, so it is different users. But I don't see why this should be an issue when the CLI user has the full permissions, and I could find no information on how to allow other IAM Users in that case.

The IMA user that I am logged in with my AWS CLI has the AdministratorAccess policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

The console command I run

~/workspace/Archipelago(master*) » aws eks --region us-west-2 describe-cluster --name archipelago-alpha-eks --query "cluster.status" --output text | cat
ACTIVE
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
~/workspace/Archipelago(master*) » aws eks --region us-west-2 update-kubeconfig --name archipelago-alpha-eks
Added new context arn:aws:eks:us-west-2:075174350620:cluster/archipelago-alpha-eks to /home/kasper/.kube/config
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
~/workspace/Archipelago(master*) » kubectl get node                                                                                                         
error: You must be logged in to the server (Unauthorized)

My full CloudFormation

AWSTemplateFormatVersion: "2010-09-09"
Description: ""

Parameters:
  env:
    Type: "String"
    Default: "local"

Mappings:
  ServicePrincipals:
    aws-cn:
      ec2: ec2.amazonaws.com.cn
    aws:
      ec2: ec2.amazonaws.com

Resources:
     eksVPC:
        Type: AWS::EC2::VPC
        Properties:
          CidrBlock: 10.0.0.0/16
          EnableDnsSupport: true
          EnableDnsHostnames: true
          Tags:
            - Key: Name
              Value: !Sub "archipelago-${env}-eks-vpc"
            - Key: Project
              Value: !Sub "archipelago-${env}-eks"
    
      eksInternetGateway:
        Type: AWS::EC2::InternetGateway
        Properties:
          Tags:
            - Key: Name
              Value: !Sub "archipelago-${env}-eks-InternetGateway"
            - Key: Project
              Value: !Sub "archipelago-${env}-eks"
    
      eksVPCGatewayAttachment:
        Type: AWS::EC2::VPCGatewayAttachment
        Properties:
          InternetGatewayId: !Ref eksInternetGateway
          VpcId: !Ref eksVPC
    
      eksPublicRouteTable:
        Type: AWS::EC2::RouteTable
        Properties:
          VpcId: !Ref eksVPC
          Tags:
            - Key: Name
              Value: !Sub "archipelago-${env}-eks-RouteTable"
            - Key: Project
              Value: !Sub "archipelago-${env}-eks"
    
      eksPublicRoute:
        DependsOn: eksVPCGatewayAttachment
        Type: AWS::EC2::Route
        Properties:
          RouteTableId: !Ref eksPublicRouteTable
          DestinationCidrBlock: 0.0.0.0/0
          GatewayId: !Ref eksInternetGateway
    
      eksPublicSubnet01:
        Type: AWS::EC2::Subnet
        Properties:
          AvailabilityZone: us-west-2a
          MapPublicIpOnLaunch: true
          CidrBlock: 10.0.0.0/24
          VpcId:
            Ref: eksVPC
          Tags:
            - Key: Name
              Value: !Sub "archipelago-${env}-eks-PublicSubnet01"
            - Key: Project
              Value: !Sub "archipelago-${env}-eks"
    
      eksPublicSubnet02:
        Type: AWS::EC2::Subnet
        Properties:
          AvailabilityZone: us-west-2b
          MapPublicIpOnLaunch: true
          CidrBlock: 10.0.1.0/24
          VpcId:
            Ref: eksVPC
          Tags:
            - Key: Name
              Value: !Sub "archipelago-${env}-eks-PublicSubnet02"
            - Key: Project
              Value: !Sub "archipelago-${env}-eks"
    
      eksPublicSubnet01RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
          SubnetId: !Ref eksPublicSubnet01
          RouteTableId: !Ref eksPublicRouteTable
    
      eksPublicSubnet02RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
          SubnetId: !Ref eksPublicSubnet02
          RouteTableId: !Ref eksPublicRouteTable
    
      eksSecurityGroup:
        Type: AWS::EC2::SecurityGroup
        Properties:
          GroupDescription: Cluster communication with worker nodes
          VpcId: !Ref eksVPC
          Tags:
            - Key: Name
              Value: !Sub "archipelago-${env}-eks-SecurityGroup"
            - Key: Project
              Value: !Sub "archipelago-${env}-eks"
    
      eksIAMRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - eks.amazonaws.com
                Action:
                  - "sts:AssumeRole"
          RoleName: EKSClusterRole
          ManagedPolicyArns:
            - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
    
      eksCluster:
        Type: AWS::EKS::Cluster
        Properties:
          Name: !Sub "archipelago-${env}-eks"
          Version: 1.19
          RoleArn:
            "Fn::GetAtt": ["eksIAMRole", "Arn"]
          ResourcesVpcConfig:
            SecurityGroupIds:
              - !Ref eksSecurityGroup
            SubnetIds:
              - !Ref eksPublicSubnet01
              - !Ref eksPublicSubnet02
        DependsOn: [eksIAMRole, eksPublicSubnet01, eksPublicSubnet02, eksSecurityGroup]
    
      eksNodeInstanceRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - !FindInMap [ServicePrincipals, !Ref "AWS::Partition", ec2]
                Action:
                  - "sts:AssumeRole"
          ManagedPolicyArns:
            - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEKSWorkerNodePolicy"
            - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEKS_CNI_Policy"
            - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
          Path: /
    
      eksNodeGroup:
        Type: AWS::EKS::Nodegroup
        Properties:
          ClusterName: !Sub "archipelago-${env}-eks"
          NodeRole:
            "Fn::GetAtt": ["eksNodeInstanceRole", "Arn"]
          AmiType: AL2_x86_64
          InstanceTypes:
            - t3a.medium
          NodegroupName: !Sub "archipelago-${env}-eks-NodeGroup01"
          RemoteAccess:
            Ec2SshKey: !Sub "archipelago-${env}-eks-key"
          ScalingConfig:
            MinSize: 1
            DesiredSize: 1
            MaxSize: 3
          Labels:
            Project: !Sub "archipelago-${env}-eks"
          Subnets:
            - !Ref eksPublicSubnet01
            - !Ref eksPublicSubnet02
        DependsOn: [eksCluster, eksNodeInstanceRole]
amazon-eks amazon-iam kubernetes aws-cli
1 Answers

User or role that created EKS cluster is the only IAM entity that has access to EKS cluster. From documentation:

When you create an Amazon EKS cluster, the IAM entity user or role, such as a federated user that creates the cluster, is automatically granted system:masters permissions in the cluster's RBAC configuration in the control plane. This IAM entity does not appear in the ConfigMap, or any other visible configuration, so make sure to keep track of which IAM entity originally created the cluster. To grant additional AWS users or roles the ability to interact with your cluster, you must edit the aws-auth ConfigMap within Kubernetes.

Kubernetes has its own permissions model, so you need to use above link to add additional users to your EKS cluster.

You may edit aws-auth configmap to look like this:

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapUsers: |
    - userarn: YOUR_IAM_USER_ARN
      username: YOUR_USER_NAME
      groups:
        - system:masters
user_113749210
Related