Aws-iam-authenticator: EKS heptio authentication using IAM without AWSCLI

[softwarecoolie]

Hi , i followed getting started on aws EKS, and kubectl and this tool is all we need right? do i still need to set something on my box for AWS role?
i get this

kubectl get all could not get token: NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors could not get token: NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors could not get token: NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors error: the server doesn't have a resource type "cronjobs"

[softwarecoolie]

https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html

[jrnt30]

That typically indicates that your aws credentials are not being properly sourced. Depending on how your organization manages credentials this would change.

You should be able to follow any of the options at https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials. Ex. if you created a ~/.aws/credentials that would work without the actual AWS CLI being installed or simply exporting the environment variables referenced should also work.

[nckturner]

@softwarecoolie to echo what @jrnt30 said, you should be able to use anything in the default aws credential chain, which includes the environment variables and config files.

[softwarecoolie]

Thank you @nckturner @jrnt30 , i was able to get it to working but missing the whole point... getting started EKS says no need of AWSCLI, proved the role etc info to heptio and it would authenticate for kubectl.. didnt work.. following worked

1. created user with EKS admin and added iam get role and iam pass role
2. created role with above user as trusted entity
3. in awscli credentials i had save access key and secret.. ( basically anyone who gets hold of my credentials they can have fun whatever crazy role setup i do on console)

may be i am missing something!

[nckturner]

So the only things that matter in terms of authenticating to your cluster with kubectl are that your IAM identity that heptio authenticator is using is the same as the one that was used to create the cluster, and that your kubeconfig correctly specifies the cluster name, the endpoint, and the ca cert of the cluster. Which user did you use to create the cluster?

[softwarecoolie]

A new user with EksAdminPolicy ..I created cluster from cli where when it
didn't work I had used console page I wasn't logged in as eks user I created

On Fri, Jun 8, 2018, 13:16 Nicholas Turner [e-mail] wrote:

So the only things that matter in terms of authenticating to your cluster
with kubectl are that your IAM identity that heptio authenticator is using
is the same as the one that was used to create the cluster, and that your
kubeconfig correctly specifies the cluster name, the endpoint, and the ca
cert of the cluster. Which user did you use to create the cluster?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/heptio/authenticator/issues/89#issuecomment-395877862,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AHSDy7GPBtOZ_beEtG6eyxxTxfkQi0Pmks5t6tuQgaJpZM4UdjIK
.

[nckturner]

Sounds like you used a different user to create and access the cluster. The cli is not required, but you do need aws credentials from your environment. To add users, you will need to modify create and modify the config map as per the docs.

[hfern]

To add users, you will need to modify create and modify the config map as per the docs.

Further reading: https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html

[coconup]

For the least perspicacious such as myself, if you created the EKS cluster with an IAM User (with usename and pass) through the AWS console, you'll need to click on that user and hit "Create access key". The keys that are generated can then go into your ~/.aws/credentials file in order for kubectl & co. to pick them up when doing things from the command line.

[AKArunkumar]

Warning CleanupLoadBalancerFailed <invalid> (x809 over 2d) service-controller Error cleaning up load balancer (will retry): error getting LB for service default/dev-clients-app-svc: NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors

is any one came across this bug?

[george-haddad]

So here's an interesting bit, I am getting the error mentioned in this issue, I created the EKS cluster while logged into the AWS console but not as a regular IAM User. I'm logged in via SSO SAML2.0 connection where my org is the identity provider. So essential my AWS account has no created users, just role arns so in that case how do I get this to work 😂

[george-haddad]

So here's an interesting bit, I am getting the error mentioned in this issue, I created the EKS cluster while logged into the AWS console but not as a regular IAM User. I'm logged in via SSO SAML2.0 connection where my org is the identity provider. So essential my AWS account has no created users, just role arns so in that case how do I get this to work 😂

This resolved it Edit trust relationship of user