K
Q

Always getting error: You must be logged in to the server (Unauthorized) EKS

11/1/2019

I am currently playing around with AWS EKS But I always get error: You must be logged in to the server (Unauthorized) when trying to run kubectl cluster-info command.

I have read a lot of AWS documentation and look at lots of similar issues who face the same problem. Unfortunately, none of them resolves my problem.

So, this is what I did

  1. install all required packages
  2. create a user to access aws-cli name crop-portal
  3. create a role for EKS name crop-cluster
  4. create EKS cluster via AWS console with the role crop-cluster namecrop-cluster(cluster and role have the same name)
  5. run AWS configure for user crop-portal
  6. run aws eks update-kubeconfig --name crop-cluster to update the kube config
  7. run aws sts assume-role --role-arn crop-cluster-arn --role-session-name eks-access
  8. copy accessKey, secreyKey and sessionToken into env variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN accordingly
  9. run aws sts get-caller-indentity and now the result says it used assume role already
{
    "UserId": "AROAXWZGX5HOBZPVGAUKC:botocore-session-1572604810",
    "Account": "529972849116",
    "Arn": "arn:aws:sts::529972849116:assumed-role/crop-cluster/botocore-session-1572604810"
}
  1. run kubectl cluster and always get error: You must be logged in to the server (Unauthorized)

when I run aws-iam-authenticator token -i crop-cluster, it gave me the token and when I run aws-iam-authenticator verify -t token -i crop-portal, it also passed

&{ARN:arn:aws:sts::529972849116:assumed-role/crop-cluster/1572605554603576170 CanonicalARN:arn:aws:iam::529972849116:role/crop-cluster AccountID:529972849116 UserID:AROAXWZGX5HOBZPVGAUKC SessionName:1572605554603576170}

I don't know what is wrong or what I miss. I try so hard to get it works but I really don't know what to do after this. Some people suggest creating a cluster with awscli instead of GUI. I tried both methods and none of them work. Either creating with awscli or GUI is the same for me.

Please someone helps :(

-- W.Phromma
amazon-eks
aws-iam-authenticator
eks
kubectl
kubernetes

Similar Questions

What's the difference between Kops and Eksctl?
Can we schedule spark driver and executer on different node pools on GKE?
Identify Reason for application shutdown in Kubernetes
Jetstack cert-manager and GKE private cluster (failed to verify ACME account)

1 Answer

3/21/2020

I will try to add some more information here and I hope it will be more helpful while setting up the access to the EKS cluster.

When we create the EKS cluster by any method via CloudFormation/CLI/EKSCTL the IAM role/user who created the cluster will automatically binded to the default kubernetes RBAC API group "system:masters" (https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) and in this way creator of the cluster will get the admin access to the cluster.

To verify the role or user for the EKS cluster we can search for the CreateCluster Api call on cloudtrail and it will tell us the creator of the cluster.

Now generally if we use role to create the cluster as you did (For example "crop-cluster"). We have to make sure that we are assuming this role before making any api calls using kubectl and the easiest way to do this is set this role in the kubeconfig file. And we can easily do this by running the below command from the terminal.

aws eks --region region-code update-kubeconfig --name cluster_name --role-arn crop-cluster-arn

Now if we will run the above command then it will set the role with -r flag in the kube config file so in that way we are telling the aws/aws-iam-authenticator that before making any api call it should first assume the role and in this way WE DON'T HAVE TO ASSUME THE ROLE MANUALLY via cli using "aws sts assume-role --role-arn crop-cluster-arn --role-session-name eks-access".

Once kubeconfig file is set properly make sure that CLI is configured properly wit h the IAM user credentials "crop-portal". And we can confirm this by running the "aws sts get-caller-identity" command and output should show us the user ARN in the "Arn" section like below.

   $ aws sts get-caller-identity
   { 
        "Account": "xxxxxxxxxxxxx",
        "UserId": "xxxxxxxxxxxxxx",
        "Arn": "arn:aws:iam::xxxxxxxxxxx:user/crop-portal"
    }

Once that is done you should be directly able to make kubectl command without any issue.

Note: I have assumed that user "crop-portal" does have enogh permission to assume the role "crop-cluster"

Note: For more details we can also refer to answer on this question Getting error "An error occurred (AccessDenied) when calling the AssumeRole operation: Access denied" after setting up EKS cluster

-- Jatin
Source: StackOverflow