<p>I'm trying to run kubectl in a EKS Cluster created from a third-party (Gitlab), and I need to access this cluster with kubectl to install metrics server.</p>
<p>But I can't access this cluster with kubectl.
I did everything from the documentation.
I have setted the trust relationship in the IAM Role of the cluster like above:</p>
<pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;eks.amazonaws.com&quot;,
        &quot;AWS&quot;: [
          &quot;arn:aws:sts::123456789012:assumed-role/AzureAD_AWS_Admin/me@mycompany.com&quot;,
          &quot;arn:aws:iam::123456789012:root&quot;
        ]
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
</code></pre>
<p>And I have tested assume-role with the external-id like the command above, and everything run seamlessly!</p>
<p><code>aws sts assume-role --role-arn arn:aws:iam::123456789012:role/eksServiceRole --external-id 2ffd8b2c3d8edaf02104a081af4b78d82f6e770f --role-session-name my_test</code></p>
<p>So, I followed <a href="https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/" rel="nofollow noreferrer">these steps to assume role and grant permission to my user</a> (For the step: <strong>Add designated_user to the ConfigMap if the cluster_creator is an IAM role</strong>) to use kubectl.</p>
<p>But when I run <code>kubectl get pods</code> I have this message again:</p>
<p><code>error: You must be logged in to the server (Unauthorized)</code></p>

mayconfsbrito
<p>I had the same problem when following the Gitlab instructions. This <a href="https://wahlnetwork.com/2020/09/22/gitlab-ci-runners-on-amazon-eks-using-terraform/" rel="nofollow noreferrer">guide</a> helps out:</p>
<p>In the aws-services -&gt; IAM -&gt; Roles -&gt; select the role you defined for gitlab.</p>
<p>Now you could either (1) simply add your user to the trusted entities, or (2) update them only temporarily and edit the aws-auth config.</p>
<hr />
<p>(1) Add another statement with your account ID without the external ID condition:</p>
<pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;AWS&quot;: &quot;arn:aws:iam::[account]:user/username&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    },
    {
      // Leave untouched
    }
  ]
}
</code></pre>
<hr />
<p>(2) Edit the trusted entities by removing the externalId condition and change it to your user-account id (which you configured aws-cli with):</p>
<pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;AWS&quot;: &quot;arn:aws:iam::[gitlabsaccount]:root&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
      &quot;Condition&quot;: {
        &quot;StringEquals&quot;: {
          &quot;sts:ExternalId&quot;: &quot;[externalId]&quot;
        }
      }
    }
  ]
}
</code></pre>
<p>-&gt;</p>
<pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;AWS&quot;: &quot;arn:aws:iam::[account]:user/username&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
</code></pre>
<p>Then run the cli-command to reconfigure your kubectl cluster access with this role:</p>
<pre><code>aws --region [region] eks update-kubeconfig --name [cluster-name] --role-arn arn:aws:iam::[account]:role/[role-name]
</code></pre>
<p>Lastly, use the permissions to add yourself to the aws-auth config map:</p>
<pre><code>kubectl edit -n kube-system configmap/aws-auth
</code></pre>
<p>and then add your account:</p>
<pre><code>apiVersion: v1
data:
  mapRoles: |
    ...
  mapUsers: |
    ---
    - userarn: arn:aws:iam::[account]:user/[username]
      username: [username]
      groups:
      - system:masters
...
</code></pre>
<p>Do not forget to change back the gitlab-user for the role and external condition.</p>
