kubectl error You must be logged in to the server (Unauthorized) when accessing EKS cluster

Hello there,

The error: You must be logged in to the server (Unauthorized) you encountered is because the kubectl in the CodeBuild is not configured properly for Amazon EKS or the IAM user or role credentials that you are using do not map to a Kubernetes RBAC user with sufficient permissions in your Amazon EKS cluster.

Things to check:

1. The Service role for CodeBuild service: eks-CodeBuildServiceRole should have this permission below. It gives it full access to EKS.

    {
      "Sid": "EKSAccessPolicy",
      "Effect": "Allow",
      "Action": [
        "eks:*"
      ],
      "Resource": "*"
    }

2. Mapping of the Service role for CodeBuild to a Kubernetes RBAC user. From terminal Cloud9 to which you have connected EKS cluster, verify the configMap aws-auth has the right entry for the IAM role: eks-CodeBuildServiceRole with the command:

kubectl edit configmaps aws-auth -n kube-system

The eks-CodeBuildServiceRole should be mapped to masters. Be sure your AWS_ACCOUNT_ID is substituted in the snippet below:

- groups:
  - system:masters
  rolearn: arn:aws:iam::{$AWS_ACCOUNT_ID}}:role/eks-CodeBuildServiceRole
  username: codebuild-eks

I was able to reproduce the steps in the guide. See the CodeBuild result.