Your current user or role does not have access to Kubernetes objects on this EKS cluster

user_5317436 0
Viewed 6805

Don't know if this is an error from AWS or something. I created an IAM user and gave it full admin policies. I then used this user to create an EKS cluster using the eksctl CLI but when I logging to AWS console with the root user I got the below error while trying to access the cluster nodes.

Your current user or role does not have access to Kubernetes objects on this EKS cluster This may be due to the current user or role not having Kubernetes RBAC permissions to describe cluster resources or not having an entry in the cluster’s auth config map.

I have these questions

  1. Does not the root user have full access to view every resource from the console?
  2. If the above is true, does it mean when I create a resource from the CLI I must login with the same user to view it?
  3. Or is there way I could attach policies to the root user? Didn't see anything like in the console.

AWS itself does not recommend creating access keys for root user and using it for programmable access, so I'm so confused right now. Someone help

All questions I have seen so far and the link to the doc here are talking about a user or role created in the AWS IAM and not the root user.

eksctl amazon-eks amazon-iam kubernetes amazon-web-services
3 Answers

If you're logged in with the root user and get this error, run the below command to edit the aws-auth configMap:

kubectl edit configmap aws-auth -n kube-system

Then go down to mapUsers and add the following (replace [account_id] with your Account ID)

mapUsers: |
  - userarn: arn:aws:iam::[account_id]:root
    groups:
    - system:masters
user_13543780

From what I've understood, EKS manages user and role permissions through a ConfigMap called aws-auth that resides in the kube-system namespace. So despite being logged in with an AWS user with full administrator access to all services, EKS will still limit your access in the console as it can't find the user or role in its authentication configuration.

When I had this issue, I solved it by editing the aws-auth configmap by adding the following under mapRoles:

- "groups":
  - "system:masters"
  "rolearn": "arn:aws:iam::<aws-account-id>:role/<aws-role-name>"
  "username": "<aws-username>"

Where aws-role-name is the role name shown when logged into the aws console in the top right corner.

I guess this could also done with the eksctl-utility as documented here: https://eksctl.io/usage/iam-identity-mappings/

So, maybe something like:

eksctl create iamidentitymapping --cluster <clusterName> --region=<region> --arn arn:aws:iam::<aws-account-id>:role/<aws-role-name> --group system:masters --username <aws-username>

Using eksctl is probably a better way of doing it, though I haven't tried it myself.

user_179855660

I had this issue today, and solved it by combining answers here. The aws-auth config after it worked looks like this:

apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::671177010163:role/eksctl-manu-eks-new2-nodegroup-ng-NodeInstanceRole-1NYUHVMYFP2TK
      username: system:node:{{EC2PrivateDNSName}}
  mapUsers: "- groups: \n  - system:masters\n  userarn: arn:aws:iam::671177010163:root\n"
kind: ConfigMap
metadata:
  creationTimestamp: "2022-02-13T11:03:30Z"
  name: aws-auth
  namespace: kube-system
  resourceVersion: "11362"
  uid: ac36a1d9-76bc-40dc-95f0-b1e7934357
user_57531450
Related