How to authenticate EKS created by Terraform Cloud OpenID

0

Hello,

I'm having some trouble authenticating to my cluster. I'm using Terraform Cloud and TF authenticates to my AWS account through OpenID Connect dynamic credentials.

When I apply my terraform and create the cluster, it seems like the cluster is getting created by a temporary user. Here's the log output for that:

time="2023-10-02T12:47:16Z" level=info msg="mapping IAM user" groups="[system:m*sters]" user="arn:aws:sts::xxxxxxxxxxxx:assumed-role/terraform-cloud/terraform-run-qv1pR6d3pzXBwxxx" username=kubernetes-admin

Then I'm trying to interact with the cluster:

$ aws eks update-kubeconfig --name test-cluster --region eu-west-1
Updated context arn:aws:eks:eu-west-1:xxxxxxxxxxxx:cluster/test-cluster in /home/user/.kube/config

and then

$ kubectl get pods
E1002 15:21:29.954692  244039 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E1002 15:21:30.364086  244039 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E1002 15:21:30.768898  244039 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E1002 15:21:31.176616  244039 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
E1002 15:21:31.581822  244039 memcache.go:265] couldn't get current server API group list: the server has asked for the client to provide credentials
error: You must be logged in to the server (the server has asked for the client to provide credentials)

I tried to find a relevant document but I couldn't. Can you please help?

Thanks

Omur
已提問 8 個月前檢視次數 745 次
1 個回答
1

Hello, Omur.

So when you create an EKS the admin permissions have the user who created a cluster so if you must log in inside EKS you can do two things:

  • use user credentials that create a cluster
  • modify awsauth and add another role or user

Best regards, Andrii

profile picture
專家
已回答 8 個月前
profile picture
專家
已審閱 17 天前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南