This error typically occurs when trying to access an Amazon EKS (Elastic Kubernetes Service) cluster without proper authentication. To resolve this issue from Jenkins CI, you need to ensure that the Jenkins environment has the correct AWS credentials and proper configuration to authenticate with your EKS cluster. Here are some steps to resolve this:

1. Make sure your Jenkins instance has the AWS CLI and kubectl installed and properly configured.

2. Ensure that the Jenkins user or the user running the pipeline has the necessary AWS IAM permissions to access the EKS cluster.

3. Configure the AWS credentials in Jenkins. You can do this by setting up AWS credentials in Jenkins' credential store and using them in your pipeline.

4. Update the kubeconfig file in your Jenkins environment to point to the correct EKS cluster. You can use the AWS CLI command aws eks get-token to generate the necessary authentication token.

5. If you're using the Jenkins Kubernetes plugin, make sure it's configured with the correct cluster information and credentials.

6. In your Jenkins pipeline, before running kubectl commands, you may need to update the kubeconfig or set the AWS_PROFILE environment variable to use the correct AWS credentials.

7. If your EKS cluster uses AWS IAM authentication, ensure that the necessary entries are present in the aws-auth ConfigMap of your EKS cluster to allow access from your Jenkins IAM role or user.

By implementing these steps, you should be able to resolve the authentication issue and allow Jenkins to interact with your EKS cluster successfully.
Sources
How to authenticate EKS created by Terraform Cloud OpenID | AWS re:Post
Troubleshooting AWS Deep Learning Containers on EKS - AWS Deep Learning Containers
EKS access without aws-auth | AWS re:Post

Hello,

Greetings,

When encountering the error message "memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials," it indicates an authentication issue between your client (e.g., Jenkins) and your Amazon EKS cluster. To debug and resolve this issue, please follow these steps:

[1] Verify kubectl configuration: Ensure that the kubeconfig file used by Jenkins is correctly configured with the appropriate context and credentials for your EKS cluster. By default, kubectl looks for this file in $HOME/.kube/config. If it's located elsewhere, set the KUBECONFIG environment variable to point to the correct path:

export KUBECONFIG=/path/to/your/kubeconfig

[2] Update kubeconfig with AWS CLI: Use the AWS CLI to update your kubeconfig file with the correct cluster information. Replace <cluster-name> and <region> with your cluster's name and its region:

aws eks update-kubeconfig --name <cluster-name> --region <region>

[3] Ensure you are using the latest version of kubectl and AWS CLI: An outdated kubectl can lead to compatibility issues. Ensure it's updated to match your cluster's version:

Check Version

kubectl version --client

Install the latest version (example for Linux)

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin

Update AWS CLI: Similarly, ensure that the AWS CLI version is updated to version 2.0 or higher:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

[4] Review the IAM Permissions: Confirm that the IAM role or user associated with Jenkins has the necessary permissions to interact with the EKS cluster. This includes actions like eks:DescribeCluster.

Then proceed to check the aws-auth ConfigMap to ensure the IAM entity is mapped correctly:

kubectl edit configmap aws-auth -n kube-system

Add the following under mapUsers or mapRoles, replacing placeholders with your IAM details:

For users:

mapUsers: | 
    - userarn: arn:aws:iam:<account-id>:user/<user-name>
      username: <user-name>
      groups:
          - system:masters

Or for roles:

mapRoles: | 
    - rolearn: arn:aws:iam:<account-id>:role/<role-name>
      username: <role-name>
      groups:
          - system:masters

[5] Test Connectivity from the Jenkins environment: From the Jenkins environment, manually execute kubectl commands to verify access and network reachability:

Check cluster nodes

kubectl get nodes

Retrieve cluster information

kubectl cluster-info

By following these steps, you should be able to diagnose and resolve the authentication issue between your client and the Amazon EKS cluster.

Hi, Just to add to the above. In case you are getting API errors to access an eksctl cluster created by another shell or role you need to map the eksctl with the user arn from "aws sts get-caller-identity".

This works only if the current shell has valid AWS credentials with access to the EKS cluster. If not try a different shell:

eksctl create iamidentitymapping --cluster eksdemo --region us-east-1 --arn arn:aws:iam::Account:user/YourUser --group system:masters --username xyz