Unable to list services in AWS EKS

Question

I'm setting up my first Kubernetes EKS cluster by following the Getting Started guide but I can't get past the step that verifies access with kubectl get svc. Instead of the list of services I'm getting:

error: the server doesn't have a resource type "svc"

I've got the aws-iam-authenticator in place, I've got the correct access and secret key for a user that has AWS Admin privileges, I checked everything I could think of yet can't figure out what's causing the error.

Answer 1

Make sure you use kubectl with the the exact same IAM User / Role that you used to create the EKS cluster? Only that IAM User / Role is given system:masters privilege in Kubernetes. If you use a different role you'll see this error, even if that other role has Administrator permissions in its IAM Policy.

---

For example if you created the EKS cluster while logged in with cross-account IAM Role and now you're trying to use it with a different IAM User it won't work.

You can add more IAM users to EKS later but for start you'll have to use the IAM role that created the cluster. For example if you log into some company-login account and the switch role to company-prod account with role Admin you'll have to update the kubeconfig accordingly:

users:
- name: arn:aws:eks:ap-southeast-2:{company-prod-id}:cluster/{cluster-name}
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws-iam-authenticator
      args:
      - token
      - -i
      - cluster-name
      - -r                                          <<< Add this
      - arn:aws:iam::{company-prod-id}:role/Admin   <<< And this
      env:
      - name: AWS_PROFILE
        value: company-login-profile                <<< Must be your login account

Alternatively you can create a cross-account profile for aws-cli as described here: How to “switch role” in aws-cli? In that case you won't need the -r arn:...:role/Admin in kubeconfig as it's already done in ~/.aws/credentials.

Once the role stuff is fixed you should be able to run kubectl get svc.

---

Once the above works you can Add more IAM Users and IAM Roles to EKS / Kubernetes. I suggest you create a dedicated role like, e.g. EKSAdmin and require your IAM users to assume that in order to manage the cluster.

Hope that helps :)