<p>When I run the command <code>kubectl get svc</code> from the <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html#eks-configure-kubectl" rel="nofollow noreferrer">tutorial</a> I'm following.</p>
<p>I get: error: You must be logged in to the server (the server has asked for the client to provide credentials).</p>
<p>When I look at my <code>~/.kube/config</code> file all looks good. The user there is the exact same one that I used to create the cluster in the first place.</p>
<p>So I see two options:</p>
<ol>
<li>The user has no IAM policy that allows it to run kubectl get svc which is very probably because all my problems are from IAM</li>
<li>It has something to do with the <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html#aws-auth-users" rel="nofollow noreferrer">IAM principle</a>.</li>
</ol>
<p>So my questions are, what IAM prolicies do I need to run <code>kubectl get svc</code> or alternatively, how do I add an IAM principle to the EKS cluster?  The <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html#aws-auth-users" rel="nofollow noreferrer">doc</a> is using kubectl to add the IAM principle to the cluster which... that's a loop with no end in sight</p>

Jenia Ivanov
<p>Here are some troubleshooting steps which you can try to fix the error:</p>
<ol>
<li>Check if the credentials or certificates are expired.</li>
</ol>
<p>Try running</p>
<pre><code>$ gcloud container clusters get-credentials [cluster-name]
</code></pre>
<p>While renewing kubernetes certificates, replace the values <code>client-certificate-data</code> and <code>client-key-data</code> in file  <code>\~/.kube/config</code> with the values from the updated file in   <code>/etc/kubernetes/kubelet.conf</code> of the same name.</p>
<ol start="2">
<li><p>The authentication is related to one of the pods which is using a service account that has issues like invalid token.</p>
</li>
<li><p>When an EKS cluster is created, the user (or role) that creates the cluster is automatically granted with the system:master permissions in the cluster's RBAC configuration. Other users or roles that need the ability to interact with your cluster, it needs to be added explicitly. Refer to the link <a href="https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/#You.27re_not_the_cluster_creator" rel="nofollow noreferrer">here</a> for the related info.</p>
</li>
</ol>
<p>You can also refer to this github <a href="https://github.com/kubernetes/kubernetes/issues/63128" rel="nofollow noreferrer">link</a> for additional information.</p>
