EKS Cluster Permissions Issue for IAM User Despite system:masters Group Access

The issue you're experiencing with your IAM user (dallasinman) not having proper access to your EKS cluster despite being added to the system:masters group in the aws-auth ConfigMap could be due to several factors. Let's explore some potential causes and solutions:

1. AWS IAM Authenticator Configuration: The AWS IAM Authenticator may not be permitting the role ARN used in the ConfigMap. Ensure that the role ARN specified in the aws-auth ConfigMap does not include a path. If it does, remove the path before specifying the role ARN.

2. Access Entry Configuration: Amazon EKS has introduced a new way to manage cluster access called Access Entries. This method is separate from the aws-auth ConfigMap. Check if your cluster is configured to use Access Entries instead of or in addition to the aws-auth ConfigMap. You can create an Access Entry for your IAM user through the EKS console or AWS CLI.

3. Authentication Mode: Verify the authentication mode of your EKS cluster. It could be set to CONFIG_MAP, API_AND_CONFIG_MAP, or API. If it's set to API or API_AND_CONFIG_MAP, you may need to create an Access Entry for your user.

4. IAM Permissions: Double-check that your IAM user has the necessary permissions to interact with the EKS cluster. Ensure they have permissions for eks:DescribeCluster and eks:AccessKubernetesApi at a minimum.

5. kubectl Configuration: Verify that your kubectl is correctly configured to use the right AWS credentials. You can do this by running 'aws sts get-caller-identity' to confirm you're using the correct IAM user.

6. Cluster Access Policy: Check if there are any cluster-level access policies that might be overriding the permissions set in the aws-auth ConfigMap.

7. Region Mismatch: Ensure that your AWS CLI and kubectl are configured to use the same region as your EKS cluster.

To resolve this issue:

1. Create an Access Entry for your IAM user through the EKS console or AWS CLI.
2. Review and update your cluster's authentication mode if necessary.
3. Double-check your IAM permissions and ensure they include all necessary EKS-related actions.
4. Verify your kubectl configuration and AWS credentials.
5. If the issue persists, you may need to review the cluster's access policies and overall IAM configuration to ensure there are no conflicting settings.

Remember, future releases of Amazon EKS may remove the aws-auth ConfigMap authentication source entirely, relying solely on Access Entries and Access Policies. It's a good practice to start using these new methods for managing cluster access.
Sources
Troubleshooting IAM - Amazon EKS
AWS EKS User Access Within the Cluster | AWS re:Post
AccessPolicy - Amazon EKS
Community | Simplified Amazon EKS Cluster Access Management using EKS APIs and AWS Console