4

I am following the step guide to set up and kubernetes environment on AWS.

https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html#role-create

It already had some gochchas.. and they have been answered partially.

  1. https://stackoverflow.com/questions/51135795/error-the-server-doesnt-have-resource-type-svc
  2. https://stackoverflow.com/questions/50791303/kubectl-error-you-must-be-logged-in-to-the-server-unauthorized-when-accessing

For some reason, people were able to resolve using these guidelines available in these answers, and I still could not break it.

could not get token: AccessDenied: User: arn:aws:iam::sssssss:user/testprofileUser is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::sssssssss:role/eksServiceRole

What I have done:

  1. I created an IAM user with Admin privileges.(servicesDev).
  2. Created a IAM Role for EKS service (amazonEKSServiceRole)

amazonEKSServiceRole has a trust relationship as below,

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

This is my kubeconfig file,

apiVersion: v1
clusters:
- cluster:
    server: https://7F30ANNSDSDMDCE1.ylq.us-east-1.eks.amazonaws.com
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5RENDQWJDZ0F3SUJBZ0lCQURB...
  name: clouddev
contexts:
- context:
    cluster: clouddev
    user: aws
  name: aws
current-context: aws
kind: Config
preferences: {}
users:
- name: aws
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws-iam-authenticator
      args:
        - "token"
        - "-i"
        - "clouddev"
        - "-r"
        - "arn:aws:iam::xxxxx:role/amazonEKSServiceRole"
      env:
        - name: AWS_PROFILE
          value: "testprofile"

To be clear I have a testprofile setup correctly in ~/.aws/credentials

If anybody can shed some light greatly appreciated.

  • Have you found a resolution to this issue? running into the same thing. – Mr.Budris Feb 21 '19 at 22:26
  • @Mr.Budris The issue was trying to follow the documentation using root user. That is the issue. Rest should go smoothly if you do with with an different AIM – diyoda_ Feb 21 '19 at 22:56
4

You also need to setup the "trust relationship" for the AWSServiceRoleForAmazonEKS role which allows EKS to assume it.

Near the bottom of this link will be details on what to do:

Amazon EKS Service IAM Role

| improve this answer | |
  • 2
    I was unable to resolve the issue with this documentation. I even created a new user and tried with that profile just to make sure that I am creating the EKS cluster using the same user I am trying to connect to it with. – diyoda_ Aug 18 '18 at 9:25
1

The only way I have been able to get this to work is to create the cluster using the CLI :

aws eks create-cluster --name <cluster name> 
   --role-arn <EKS Service Role> 
   --resources-vpc-config subnetIds=<subnet ids>,securityGroupIds=<security group id>

This is suggested in mutilple AWS resources and guides; this exact command to run it is from this SO answer : https://stackoverflow.com/a/53002925/8749874

| improve this answer | |
0

My situation was, I had created the VPC using the root user and created the rest of the infra(eks control plane and worker nodes using a different user). When I recreated everything using same user (But not root user), things got smooth and was able to create a cluster using the aws documentation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.