<p>I've been following <a href="https://www.linkedin.com/pulse/adding-users-quick-start-kubernetes-aws-jakub-scholz/" rel="nofollow noreferrer">this post</a> to create user access to my kubernetes cluster (running on Amazon EKS). I did create key, csr, approved the request and downloaded the certificate for the user. Then I did create a kubeconfig file with the key and crt. When I run kubectl with this kubeconfig, I'm recognized as <code>system:anonymous</code>.</p>

<pre><code>$ kubectl --kubeconfig test-user-2.kube.yaml get pods
Error from server (Forbidden): pods is forbidden: User "system:anonymous" cannot list pods in the namespace "default"
</code></pre>

<p>I expected the user to be recognized but get denied access.</p>

<pre><code>$ kubectl --kubeconfig test-user-2.kube.yaml version
Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.1", GitCommit:"b1b29978270dc22fecc592ac55d903350454310a", GitTreeState:"clean", BuildDate:"2018-07-18T11:37:06Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.3", GitCommit:"2bba0127d85d5a46ab4b778548be28623b32d0b0", GitTreeState:"clean", BuildDate:"2018-05-28T20:13:43Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}


$ kubectl --kubeconfig test-user-2.kube.yaml config view
apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: REDACTED
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: test-user-2
  name: kubernetes
current-context: kubernetes
kind: Config
preferences: {}
users:
- name: test-user-2
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

# running with my other account (which uses heptio-authenticator-aws)
$ kubectl describe certificatesigningrequest.certificates.k8s.io/user-request-test-user-2
Name:               user-request-test-user-2
Labels:             &lt;none&gt;
Annotations:        &lt;none&gt;
CreationTimestamp:  Wed, 01 Aug 2018 15:20:15 +0200
Requesting User:
Status:             Approved,Issued
Subject:
         Common Name:    test-user-2
         Serial Number:
Events:  &lt;none&gt;
</code></pre>

<p>I did create a ClusterRoleBinding with <code>admin</code> (also tried <code>cluster-admin</code>) roles for this user but that should not matter for this step. I'm not sure how I can further debug 1) if the user is created or not or 2) if I missed some configuration.</p>

<p>Any help is appreciated!</p>

Eren Güven
<p>As mentioned in this <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">article</a>:</p>

<blockquote>
  <p>When you create an Amazon EKS cluster, the IAM entity user or role (for example, for federated users) that creates the cluster is automatically granted system:master permissions in the cluster's RBAC configuration. To grant additional AWS users or roles the ability to interact with your cluster, you must edit the aws-auth ConfigMap within Kubernetes.</p>
</blockquote>

<ol>
<li><p>Check if you have aws-auth ConfigMap applied to your cluster:</p>

<pre><code>kubectl describe configmap -n kube-system aws-auth
</code></pre></li>
<li><p>If ConfigMap is present, skip this step and proceed to step 3.
If ConfigMap is not applied yet, you should do the following:</p></li>
</ol>

<p>Download the stock ConfigMap: </p>

<pre><code>curl -O https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/aws-auth-cm.yaml
</code></pre>

<p>Adjust it using your NodeInstanceRole ARN in the <code>rolearn:</code> . To get NodeInstanceRole value check out <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html" rel="nofollow noreferrer">this manual</a> and you will find it at steps 3.8 - 3.10.</p>

<pre><code>data:
  mapRoles: |
    - rolearn: &lt;ARN of instance role (not instance profile)&gt;
</code></pre>

<p>Apply this config map to the cluster:</p>

<pre><code>kubectl apply -f aws-auth-cm.yaml
</code></pre>

<p>Wait for cluster nodes becoming Ready:</p>

<pre><code>kubectl get nodes --watch
</code></pre>

<ol start="3">
<li><p>Edit <code>aws-auth</code> ConfigMap and add users to it according to the example below:</p>

<pre><code>kubectl edit -n kube-system configmap/aws-auth

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  mapRoles: |
    - rolearn: arn:aws:iam::555555555555:role/devel-worker-nodes-NodeInstanceRole-74RF4UBDUKL6
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
  mapUsers: |
    - userarn: arn:aws:iam::555555555555:user/admin
      username: admin
      groups:
        - system:masters
    - userarn: arn:aws:iam::111122223333:user/ops-user
      username: ops-user
      groups:
        - system:masters
</code></pre></li>
</ol>

<p>Save and exit the editor.</p>

<ol start="4">
<li>Create kubeconfig for your IAM user following <a href="https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html" rel="nofollow noreferrer">this manual</a>.</li>
</ol>
