<p><code>kubectl version</code> on CodeBuild prints error...</p>

<pre><code>[Container] 2019/08/26 04:07:32 Running command kubectl version 
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.0", GitCommit:"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529", GitTreeState:"clean", BuildDate:"2019-06-19T16:40:16Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"} 
error: You must be logged in to the server (the server has asked for the client to provide credentials)
</code></pre>

<blockquote>
  <p>error: You must be logged in to the server (the server has asked for the client to provide credentials)</p>
</blockquote>

<p>I'm using Amazon EKS Cluster.
It seems some authentication setup missing...?</p>

<p>What I did:</p>

<ol>
<li>Setup codebuild project (a new service role <code>codebuild-hoge-service-role</code> is created).</li>
<li>Added <code>eks:DescribeCluster</code> Policy to the role as inline policy because <code>aws eks update-kubeconfig</code> requires it.</li>
<li>Edit <code>configmap/aws-auth</code> to bind the role and RBAC by <code>kubectl edit -n kube-system configmap/aws-auth</code> on my local device, adding new config to <code>mapRoles</code> like:</li>
</ol>

<pre><code>   mapRoles: |
     - rolearn: .....
     - rolearn: arn:aws:iam::999999999999:role/service-role/codebuild-hoge-service-role
     ¦ username: codebuild
     ¦ groups:
     ¦   - system:masters

</code></pre>

<p>That's all.
Not enough? Is there anything I missed?</p>

<p>Also I tried another approach to debug and it worked successfully..</p>

<ol>
<li>Create a IAM User and IAM Role. He can switch to the role (assume role).</li>
<li>Edit <code>configmap/aws-auth</code> and Add config for the role. (same as failure process)</li>
<li>Switch role on local and execute <code>kubectl version</code>. It worked!!</li>
</ol>

<p>buildspec.yml</p>

<pre><code>version: 0.2
phases:
  install:
    runtime-versions:
      docker: 18
    commands:
      - curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.15.0/bin/linux/amd64/kubectl
      - chmod +x ./kubectl
      - mv -f ./kubectl /usr/local/bin/kubectl
  pre_build:
    commands:
      - aws eks update-kubeconfig --name mycluster
      - kubectl version
  build:
    commands:
      - kubectl get svc -A
</code></pre>

<p>I had the same issue. I just had to create another role with same Trusted Relationship and policy as the original one. BUT it worked.</p>
<p>The only thing I did different was not add the path <strong>/service-role/</strong>, so the ARN looked like: <code>arn:aws:iam::123456789012:role/another-codebuild-role</code>.</p>
