title: EKS with Kubectl keeps saying Unauthorized
body: <p>I am currently trying to set up an EKS cluster on AWS with CloudFormation. I have been following the guide on <a href="https://en.sokube.ch/post/aws-kubernetes-aws-elastic-kubernetes-service-eks" rel="nofollow noreferrer">https://en.sokube.ch/post/aws-kubernetes-aws-elastic-kubernetes-service-eks</a>.</p>
  <p>However, after my EKS cluster is successfully created I am unable to interact with it through kubectl as I always get <code>error: You must be logged in to the server (Unauthorized)</code>. I have been stuck on what I am doing wrong.</p>
  <p>One hint that may be the problem is that I created the stack via the AWS Console, and not the AWS CLI, so it is different users. But I don't see why this should be an issue when the CLI user has the full permissions, and I could find no information on how to allow other IAM Users in that case.</p>
  <p>The IMA user that I am logged in with my AWS CLI has the <code>AdministratorAccess</code> policy</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;*&quot;,
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>The console command I run</p>
  <pre><code>~/workspace/Archipelago(master*) » aws eks --region us-west-2 describe-cluster --name archipelago-alpha-eks --query &quot;cluster.status&quot; --output text | cat
  ACTIVE
  ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
  ~/workspace/Archipelago(master*) » aws eks --region us-west-2 update-kubeconfig --name archipelago-alpha-eks
  Added new context arn:aws:eks:us-west-2:075174350620:cluster/archipelago-alpha-eks to /home/kasper/.kube/config
  ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
  ~/workspace/Archipelago(master*) » kubectl get node                                                                                                         
  error: You must be logged in to the server (Unauthorized)
  </code></pre>
  <p>My full CloudFormation</p>
  <pre><code>AWSTemplateFormatVersion: &quot;2010-09-09&quot;
  Description: &quot;&quot;
  
  Parameters:
    env:
      Type: &quot;String&quot;
      Default: &quot;local&quot;
  
  Mappings:
    ServicePrincipals:
      aws-cn:
        ec2: ec2.amazonaws.com.cn
      aws:
        ec2: ec2.amazonaws.com
  
  Resources:
       eksVPC:
          Type: AWS::EC2::VPC
          Properties:
            CidrBlock: 10.0.0.0/16
            EnableDnsSupport: true
            EnableDnsHostnames: true
            Tags:
              - Key: Name
                Value: !Sub &quot;archipelago-${env}-eks-vpc&quot;
              - Key: Project
                Value: !Sub &quot;archipelago-${env}-eks&quot;
      
        eksInternetGateway:
          Type: AWS::EC2::InternetGateway
          Properties:
            Tags:
              - Key: Name
                Value: !Sub &quot;archipelago-${env}-eks-InternetGateway&quot;
              - Key: Project
                Value: !Sub &quot;archipelago-${env}-eks&quot;
      
        eksVPCGatewayAttachment:
          Type: AWS::EC2::VPCGatewayAttachment
          Properties:
            InternetGatewayId: !Ref eksInternetGateway
            VpcId: !Ref eksVPC
      
        eksPublicRouteTable:
          Type: AWS::EC2::RouteTable
          Properties:
            VpcId: !Ref eksVPC
            Tags:
              - Key: Name
                Value: !Sub &quot;archipelago-${env}-eks-RouteTable&quot;
              - Key: Project
                Value: !Sub &quot;archipelago-${env}-eks&quot;
      
        eksPublicRoute:
          DependsOn: eksVPCGatewayAttachment
          Type: AWS::EC2::Route
          Properties:
            RouteTableId: !Ref eksPublicRouteTable
            DestinationCidrBlock: 0.0.0.0/0
            GatewayId: !Ref eksInternetGateway
      
        eksPublicSubnet01:
          Type: AWS::EC2::Subnet
          Properties:
            AvailabilityZone: us-west-2a
            MapPublicIpOnLaunch: true
            CidrBlock: 10.0.0.0/24
            VpcId:
              Ref: eksVPC
            Tags:
              - Key: Name
                Value: !Sub &quot;archipelago-${env}-eks-PublicSubnet01&quot;
              - Key: Project
                Value: !Sub &quot;archipelago-${env}-eks&quot;
      
        eksPublicSubnet02:
          Type: AWS::EC2::Subnet
          Properties:
            AvailabilityZone: us-west-2b
            MapPublicIpOnLaunch: true
            CidrBlock: 10.0.1.0/24
            VpcId:
              Ref: eksVPC
            Tags:
              - Key: Name
                Value: !Sub &quot;archipelago-${env}-eks-PublicSubnet02&quot;
              - Key: Project
                Value: !Sub &quot;archipelago-${env}-eks&quot;
      
        eksPublicSubnet01RouteTableAssociation:
          Type: AWS::EC2::SubnetRouteTableAssociation
          Properties:
            SubnetId: !Ref eksPublicSubnet01
            RouteTableId: !Ref eksPublicRouteTable
      
        eksPublicSubnet02RouteTableAssociation:
          Type: AWS::EC2::SubnetRouteTableAssociation
          Properties:
            SubnetId: !Ref eksPublicSubnet02
            RouteTableId: !Ref eksPublicRouteTable
      
        eksSecurityGroup:
          Type: AWS::EC2::SecurityGroup
          Properties:
            GroupDescription: Cluster communication with worker nodes
            VpcId: !Ref eksVPC
            Tags:
              - Key: Name
                Value: !Sub &quot;archipelago-${env}-eks-SecurityGroup&quot;
              - Key: Project
                Value: !Sub &quot;archipelago-${env}-eks&quot;
      
        eksIAMRole:
          Type: AWS::IAM::Role
          Properties:
            AssumeRolePolicyDocument:
              Version: &quot;2012-10-17&quot;
              Statement:
                - Effect: Allow
                  Principal:
                    Service:
                      - eks.amazonaws.com
                  Action:
                    - &quot;sts:AssumeRole&quot;
            RoleName: EKSClusterRole
            ManagedPolicyArns:
              - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
      
        eksCluster:
          Type: AWS::EKS::Cluster
          Properties:
            Name: !Sub &quot;archipelago-${env}-eks&quot;
            Version: 1.19
            RoleArn:
              &quot;Fn::GetAtt&quot;: [&quot;eksIAMRole&quot;, &quot;Arn&quot;]
            ResourcesVpcConfig:
              SecurityGroupIds:
                - !Ref eksSecurityGroup
              SubnetIds:
                - !Ref eksPublicSubnet01
                - !Ref eksPublicSubnet02
          DependsOn: [eksIAMRole, eksPublicSubnet01, eksPublicSubnet02, eksSecurityGroup]
      
        eksNodeInstanceRole:
          Type: AWS::IAM::Role
          Properties:
            AssumeRolePolicyDocument:
              Version: &quot;2012-10-17&quot;
              Statement:
                - Effect: Allow
                  Principal:
                    Service:
                      - !FindInMap [ServicePrincipals, !Ref &quot;AWS::Partition&quot;, ec2]
                  Action:
                    - &quot;sts:AssumeRole&quot;
            ManagedPolicyArns:
              - !Sub &quot;arn:${AWS::Partition}:iam::aws:policy/AmazonEKSWorkerNodePolicy&quot;
              - !Sub &quot;arn:${AWS::Partition}:iam::aws:policy/AmazonEKS_CNI_Policy&quot;
              - !Sub &quot;arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly&quot;
            Path: /
      
        eksNodeGroup:
          Type: AWS::EKS::Nodegroup
          Properties:
            ClusterName: !Sub &quot;archipelago-${env}-eks&quot;
            NodeRole:
              &quot;Fn::GetAtt&quot;: [&quot;eksNodeInstanceRole&quot;, &quot;Arn&quot;]
            AmiType: AL2_x86_64
            InstanceTypes:
              - t3a.medium
            NodegroupName: !Sub &quot;archipelago-${env}-eks-NodeGroup01&quot;
            RemoteAccess:
              Ec2SshKey: !Sub &quot;archipelago-${env}-eks-key&quot;
            ScalingConfig:
              MinSize: 1
              DesiredSize: 1
              MaxSize: 3
            Labels:
              Project: !Sub &quot;archipelago-${env}-eks&quot;
            Subnets:
              - !Ref eksPublicSubnet01
              - !Ref eksPublicSubnet02
          DependsOn: [eksCluster, eksNodeInstanceRole]
  </code></pre>