kubectl error You must be logged in to the server (Unauthorized) when accessing EKS cluster

0

Hi guys!

I am doing the hands-on lab on AWS EKS and CodePipeline topic. See the link below

https://000062.awsstudygroup.com/

I am stuck in step 4.6 when I create a Pipeline using CloudFormation template. The Code Build failed because of an error as I attached in the photo.

Please help me check!

Enter image description here

1 Answer
1
Accepted Answer

Hello there,

The error: You must be logged in to the server (Unauthorized) you encountered is because the kubectl in the CodeBuild is not configured properly for Amazon EKS or the IAM user or role credentials that you are using do not map to a Kubernetes RBAC user with sufficient permissions in your Amazon EKS cluster.

Things to check:

  1. The Service role for CodeBuild service: eks-CodeBuildServiceRole should have this permission below. It gives it full access to EKS.
    {
      "Sid": "EKSAccessPolicy",
      "Effect": "Allow",
      "Action": [
        "eks:*"
      ],
      "Resource": "*"
    }
  1. Mapping of the Service role for CodeBuild to a Kubernetes RBAC user. From terminal Cloud9 to which you have connected EKS cluster, verify the configMap aws-auth has the right entry for the IAM role: eks-CodeBuildServiceRole with the command:
kubectl edit configmaps aws-auth -n kube-system

The eks-CodeBuildServiceRole should be mapped to masters. Be sure your AWS_ACCOUNT_ID is substituted in the snippet below:

- groups:
  - system:masters
  rolearn: arn:aws:iam::{$AWS_ACCOUNT_ID}}:role/eks-CodeBuildServiceRole
  username: codebuild-eks

I was able to reproduce the steps in the guide. See the CodeBuild result. Enter image description here

answered 3 months ago
  • Thanks for your helps! Let me check again! I think the problem is in Mapping of the Service role for CodeBuild to a Kubernetes RBAC user.

  • Hi, I substituted my AWS_ACCOUNT_ID in aws-auth.yaml file but the same error still occur. Please help me check!

    • groups: - system:masters rolearn: arn:aws:iam::47314953xxxx:role/eks-CodeBuildServiceRole username: codebuild-eks

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions