<p>I've gone over this <a href="https://aws.amazon.com/premiumsupport/knowledge-center/eks-iam-permissions-namespaces/" rel="nofollow noreferrer">guide</a> to allow one of the pods running on my EKS cluster to access a remote EKS cluster using kubectl.</p>
<p>I'm currently running a pod using <a href="https://hub.docker.com/r/amazon/aws-cli" rel="nofollow noreferrer">amazon/aws-cli</a> inside my cluster, mounting a service account token which allows me to assume an IAM role configured with kubernetes RBAC according to the guide above. I've made sure that the role is correctly assumed by running <code>aws sts get-caller-identity</code> and this is indeed the case.</p>
<p>I've now installed kubectl and configured kube/config like so -</p>
<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: &lt;redacted&gt;
    server: &lt;redacted&gt;
  name: &lt;cluster-arn&gt;
contexts:
- context:
    cluster: &lt;cluster-arn&gt;
    user: &lt;cluster-arn&gt;
  name: &lt;cluster-arn&gt;
current-context: &lt;cluster-arn&gt;
kind: Config
preferences: {}
users:
- name: &lt;cluster-arn&gt;
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - us-east-2
      - eks
      - get-token
      - --cluster-name
      - &lt;cluster-name&gt;
      - --role
      - &lt;role-arn&gt;
      command: aws
      env: null
</code></pre>
<p>However, every operation I try to carry out using kubectl results in this error -<br />
<code>error: You must be logged in to the server (Unauthorized)</code></p>
<p>I've no idea what did I misconfigure, and would appreciate any idea on how to get a more verbose error message.</p>

Yaron Idan
<p>If the AWS CLI is already using the identity of the role you want, then it's not needed to specify the <code>--role</code> &amp; <code>&lt;role-arn&gt;</code> in the kubeconfig args.</p>
<p>By leaving them in, your role from <code>aws sts get-caller-identity</code> will need to have <code>sts:AssumeRole</code> permissions for the role <code>&lt;role-arn&gt;</code>. If they are the same, then the role needs to be able to assume itself - which is redundant.</p>
<p>So I'd try remove those args from the <code>kubeconfig.yml</code> and see if it helps.</p>
