Aws-iam-authenticator: Not able to add a new admin user in EKS

[rajarajanpsj]

I followed the below procedure to add a new admin group to EKS via heptio aws-auth configMap but it is not working.

1. Created an IAM group and added our admin users
2. Created an IAM role with no permissions and added our account as the trusted entity so that the IAM group created in step 1 above can assume this role.
3. Edited the aws-auth configMap for heptio authenticator in EKS to have a mapping for our IAM ROLE ARN (created in Step2) to a group name called eks-admin
4. Edited the cluster-admin ClusterRoleBinding created by default in EKS to add eks-admin group one of the subjects which has cluster-admin role.

kubectl get pods gives me the following error error: You must be logged in to the server (Unauthorized)

It seems I am authenticated but NOT authorized. Theoretically, I expect heptio server side component to return my role arn (which I am assuming from client side heptio binary) along with groupname as eks-admin (which I created in Step3). Kubernetes RBAC should then map the group the cluster-admin role (based on clusterRoleBinding in Step4) and give me admin access. But this is not happening.

Impersonating as that group works, seems to be something around heptio configuration in EKS

root@xxxxx:~# k get pods --as=username --as-group=eks-cluster-admin No resources found. [This is working!]

What am I missing? :-(

[sellers]

Why was this closed w/o and context ? Were you able to resolve your issue? If so, please provide what your conditions were that caused it to be resolved so that others who are seeking answers can learn as well.

[romilpunetha]

It doesnt work for me either. Any solutions?

this is what my configmap look like.

- groups:
      - curefit:eks-admin
      rolearn: arn:aws:iam::[REDACTED]:role/eks-admins
      username: admin:{{SessionName}}
    - groups:
      - curefit:eks-viewer
      rolearn: arn:aws:iam::[REDACTED]:role/eks-all-cluster-viewers-role
      username: viewer:{{SessionName}}