<p>I am new to EKS and Kubernetes - </p>

<p>Here is what happened</p>

<ol>
<li>A EKS cluster was created with a specific IAM Role</li>
<li>When trying to connect to the cluster with kubectl commands it was throwing </li>
</ol>

<p><code>error You must be logged in to the server (Unauthorized)</code></p>

<p>I followed the steps detailed here </p>

<p><a href="https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/</a></p>

<ol>
<li><p>Assumed to the role that created the EKS cluster</p></li>
<li><p>Exported them to new profile <code>dev</code> in aws credentials</p></li>
<li><p>Ran <code>AWS_PROFILE=dev kubectl get nodes</code>. It was able to list all my nodes. </p></li>
</ol>

<p>Note: I had already run <code>aws eks --region &lt;region&gt; update-kubeconfig --name &lt;cluster-name&gt;</code></p>

<ol start="4">
<li>Now I tried to add the role/SAML User that is trying to access the EKS cluster by applying the configmap as below and ran <code>AWS_PROFILE=dev kubectl apply -f aws-auth.yaml</code></li>
</ol>

<p><code>aws-auth.yaml</code> being </p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:sts::******:assumed-role/aws_dev/abc@def.com
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
</code></pre>

<p>notice the role arn is a SAML User assumed to <code>aws_dev</code> role that tries to connect to the cluster.</p>

<p>Once this was applied, the response was <code>configmap/aws-auth configured</code></p>

<p>I now tried to execute <code>kubectl get nodes</code> without the <code>AWS_PROFILE=dev</code> and it fails again with <code>error You must be logged in to the server (Unauthorized)</code>.</p>

<p>I also executed <code>AWS_PROFILE=dev kubectl get nodes</code> which previously worked but fails now.</p>

<p>I am guessing the aws-auth information messed up and is there a way to revert the <code>kubectl apply</code> that was done above.</p>

<p>any kubectl command fails now. What might be happening? How can I rectify this?</p>

<p>You get an authorization error when your AWS Identity and Access Management (IAM) entity isn't authorized by the role-based access control (RBAC) configuration of the Amazon EKS cluster. This happens when the Amazon EKS cluster is created by an IAM user or role that's different from the one used by aws-iam-authenticator.</p>

<p>Check the resolution <a href="https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/" rel="nofollow noreferrer">here</a>.</p>

<p><a href="https://stackoverflow.com/questions/50791303/kubectl-error-you-must-be-logged-in-to-the-server-unauthorized-when-accessing">kubectl error You must be logged in to the server (Unauthorized) when accessing EKS cluster</a></p>
