<p>I am trying to understand where do these username field is mapped to in the Kubernetes cluster.</p>
<p>This is a sample configmap:</p>
<pre><code>apiVersion: v1
data:
  mapRoles: |
    - rolearn: arn:aws:iam::111122223333:role/eksctl-my-cluster-nodegroup
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
  mapUsers: |
    - userarn: arn:aws:iam::111122223333:user/admin
      username: admin
      groups:
        - system:masters
    - userarn: arn:aws:iam::444455556666:user/ops-user
      username: ops-user
      groups:
        - eks-console-dashboard-full-access-group
</code></pre>
<ol>
<li><p>If I change the username from <code>system:node:{{EC2PrivateDNSName}}</code> to something like <code>mynode:{{EC2PrivateDNSName}}</code> does it really make any difference? Does It make any sense to the k8's cluster by adding the <code>system:</code> prefix ?.</p>
</li>
<li><p>And where can I see these users in k8's. Can I query it using <code>kubectl</code> just like <code>k get pods</code>, as  <code>kubectl get usernames</code>. Is it a dummy user name we are providing to map with or does it hold any special privileges.</p>
</li>
<li><p>From where do these names <code>{{EC2PrivateDNSName}}</code> comes from. Are there any other variables available? I can't see any information related to this from the documentation.</p>
</li>
</ol>
<p>Thanks in advance!</p>

Kishor Unnikrishnan
<p>Posting the answer as a community wiki, feel free to edit and expand.</p>
<hr />
<ol>
<li>As you can read in <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#core-component-roles" rel="nofollow noreferrer">documentation</a>, <code>system:node</code> require to have prefix <code>system</code>. If you delete <code>system</code>, it won't work correctly:</li>
</ol>
<blockquote>
<p><strong>system:node</strong><br />
Allows access to resources required by the kubelet,  <strong>including read access to all secrets, and write access to all pod status objects</strong>.
You should use the  Node authorizer  and  NodeRestriction admission plugin  instead of the  system:node  role, and allow granting API access to kubelets based on the Pods scheduled to run on them.
The  system:node  role only exists for compatibility with Kubernetes clusters upgraded from versions prior to v1.8.</p>
</blockquote>
<ol start="2">
<li>You can view RBAC users using external plugin example <a href="https://github.com/FairwindsOps/rbac-lookup" rel="nofollow noreferrer">RBAC Lookup</a> and use a command:<code>rbac-lookup</code></li>
</ol>
<blockquote>
<p>RBAC Lookup is a CLI that allows you to easily find Kubernetes roles and cluster roles bound to any user, service account, or group name. Binaries are generated with goreleaser for each release for simple installation.</p>
</blockquote>
<ol start="3">
<li>Names will come from your AWS IAM. You can read more about it <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">here</a>:</li>
</ol>
<blockquote>
<p>Access to your cluster using AWS IAM entities is enabled by the AWS IAM Authenticator for Kubernetes which runs on the Amazon EKS control plane. The authenticator gets its configuration information from the <code>aws-auth</code>  <code>ConfigMap</code>. For all <code>aws-auth</code>  <code>ConfigMap</code> settings.</p>
</blockquote>
