<p>I'm trying to deploy an EKS self managed with Terraform. While I can deploy the cluster with addons, vpc, subnet and all other resources, it always fails at helm:</p>
<pre><code>Error: Kubernetes cluster unreachable: the server has asked for the client to provide credentials
with module.eks-ssp-kubernetes-addons.module.ingress_nginx[0].helm_release.nginx[0]
on .terraform/modules/eks-ssp-kubernetes-addons/modules/kubernetes-addons/ingress-nginx/main.tf line 19, in resource &quot;helm_release&quot; &quot;nginx&quot;:
resource &quot;helm_release&quot; &quot;nginx&quot; {
</code></pre>
<p>This error repeats for <code>metrics_server</code>, <code>lb_ingress</code>, <code>argocd</code>, but <code>cluster-autoscaler</code> throws:</p>
<pre><code>Warning: Helm release &quot;cluster-autoscaler&quot; was created but has a failed status.
with module.eks-ssp-kubernetes-addons.module.cluster_autoscaler[0].helm_release.cluster_autoscaler[0]
on .terraform/modules/eks-ssp-kubernetes-addons/modules/kubernetes-addons/cluster-autoscaler/main.tf line 1, in resource &quot;helm_release&quot; &quot;cluster_autoscaler&quot;:
resource &quot;helm_release&quot; &quot;cluster_autoscaler&quot; {
</code></pre>
<p>My <code>main.tf</code> looks like this:</p>
<pre><code>terraform {

  backend &quot;remote&quot; {}

  required_providers {
    aws = {
      source  = &quot;hashicorp/aws&quot;
      version = &quot;&gt;= 3.66.0&quot;
    }
    kubernetes = {
      source  = &quot;hashicorp/kubernetes&quot;
      version = &quot;&gt;= 2.7.1&quot;
    }
    helm = {
      source  = &quot;hashicorp/helm&quot;
      version = &quot;&gt;= 2.4.1&quot;
    }
  }
}

data &quot;aws_eks_cluster&quot; &quot;cluster&quot; {
  name = module.eks-ssp.eks_cluster_id
}

data &quot;aws_eks_cluster_auth&quot; &quot;cluster&quot; {
  name = module.eks-ssp.eks_cluster_id
}

provider &quot;aws&quot; {
  access_key = &quot;xxx&quot;
  secret_key = &quot;xxx&quot;
  region     = &quot;xxx&quot;
  assume_role {
    role_arn = &quot;xxx&quot;
  }
}

provider &quot;kubernetes&quot; {
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
  token                  = data.aws_eks_cluster_auth.cluster.token
}

provider &quot;helm&quot; {
  kubernetes {
    host                   = data.aws_eks_cluster.cluster.endpoint
    token                  = data.aws_eks_cluster_auth.cluster.token
    cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
  }
}
</code></pre>
<p>My <code>eks.tf</code> looks like this:</p>
<pre><code>module &quot;eks-ssp&quot; {
    source = &quot;github.com/aws-samples/aws-eks-accelerator-for-terraform&quot;

    # EKS CLUSTER
    tenant            = &quot;DevOpsLabs2b&quot;
    environment       = &quot;dev-test&quot;
    zone              = &quot;&quot;
    terraform_version = &quot;Terraform v1.1.4&quot;

    # EKS Cluster VPC and Subnet mandatory config
    vpc_id             = &quot;xxx&quot;
    private_subnet_ids = [&quot;xxx&quot;,&quot;xxx&quot;, &quot;xxx&quot;, &quot;xxx&quot;]

    # EKS CONTROL PLANE VARIABLES
    create_eks         = true
    kubernetes_version = &quot;1.19&quot;

  # EKS SELF MANAGED NODE GROUPS
    self_managed_node_groups = {
    self_mg = {
      node_group_name        = &quot;DevOpsLabs2b&quot;
      subnet_ids             = [&quot;xxx&quot;,&quot;xxx&quot;, &quot;xxx&quot;, &quot;xxx&quot;]
      create_launch_template = true
      launch_template_os     = &quot;bottlerocket&quot;       # amazonlinux2eks  or bottlerocket or windows
      custom_ami_id          = &quot;xxx&quot;
      public_ip              = true                   # Enable only for public subnets
      pre_userdata           = &lt;&lt;-EOT
            yum install -y amazon-ssm-agent \
            systemctl enable amazon-ssm-agent &amp;&amp; systemctl start amazon-ssm-agent \
        EOT

      disk_size     = 10
      instance_type = &quot;t2.small&quot;
      desired_size  = 2
      max_size      = 10
      min_size      = 0
      capacity_type = &quot;&quot; # Optional Use this only for SPOT capacity as  capacity_type = &quot;spot&quot;

      k8s_labels = {
        Environment = &quot;dev-test&quot;
        Zone        = &quot;&quot;
        WorkerType  = &quot;SELF_MANAGED_ON_DEMAND&quot;
      }

      additional_tags = {
        ExtraTag    = &quot;t2x-on-demand&quot;
        Name        = &quot;t2x-on-demand&quot;
        subnet_type = &quot;public&quot;
      }
      create_worker_security_group = false # Creates a dedicated sec group for this Node Group
    },
  }
}

    enable_amazon_eks_vpc_cni             = true
        amazon_eks_vpc_cni_config = {
        addon_name               = &quot;vpc-cni&quot;
        addon_version            = &quot;v1.7.5-eksbuild.2&quot;
        service_account          = &quot;aws-node&quot;
        resolve_conflicts        = &quot;OVERWRITE&quot;
        namespace                = &quot;kube-system&quot;
        additional_iam_policies  = []
        service_account_role_arn = &quot;&quot;
        tags                     = {}
    }
    enable_amazon_eks_kube_proxy          = true
        amazon_eks_kube_proxy_config = {
        addon_name               = &quot;kube-proxy&quot;
        addon_version            = &quot;v1.19.8-eksbuild.1&quot;
        service_account          = &quot;kube-proxy&quot;
        resolve_conflicts        = &quot;OVERWRITE&quot;
        namespace                = &quot;kube-system&quot;
        additional_iam_policies  = []
        service_account_role_arn = &quot;&quot;
        tags                     = {}
    }

    #K8s Add-ons
    enable_aws_load_balancer_controller   = true
    enable_metrics_server                 = true
    enable_cluster_autoscaler             = true
    enable_aws_for_fluentbit              = true
    enable_argocd                         = true
    enable_ingress_nginx                  = true

    depends_on = [module.eks-ssp.self_managed_node_groups]
}
</code></pre>

<p>OP has confirmed in the comment that the problem was resolved:</p>
<blockquote>
<p>Of course. I think I found the issue. Doing &quot;kubectl get svc&quot; throws: &quot;An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::xxx:user/terraform_deploy is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::xxx:user/terraform_deploy&quot;</p>
<p>Solved it by using my actual role, that's crazy. No idea why it was calling itself.</p>
</blockquote>
<p>For similar problem look also <a href="https://github.com/hashicorp/terraform-provider-helm/issues/400" rel="nofollow noreferrer">this issue</a>.</p>
