aws-auth configMap for EKS

AWS IAM Authenticator for Kubernetes get information from aws-auth ConfigMap. https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html

system:masters
system:anonymous
system:basic-user
system:unauthenticated

Examples

• kubectl edit -n kube-system configmap/aws-auth
• kubectl describe -n kube-system configmap/aws-auth
• kubectl -n kube-system get configmap aws-auth -o=yaml

Terraform

• Terraform EKS module: create_aws_auth_configmap, manage_aws_auth_configmap
• Terraform resource: kubernetes_config_map_v1_data

Errors

• The SSO session associated with this profile has expired or is otherwise invalid. To refresh this SSO session run aws sso login with the corresponding profile.
• Your current user or role does not have access to Kubernetes objects on this EKS cluster
• Error: Unauthorized

Activities

• Enabling IAM principal access to your cluster
• Grant IAM users access to Kubernetes with a ConfigMap

Related

• eksct create iamidentitymapping
• EKS single sign-on using AWS SSO
• Terraform EKS module: aws_auth_roles
• Amazon EKS authorization
• eksctl get iamidentitymapping --cluster your-eks-cluster
• Error: getting auth ConfigMap: Unauthorized
• kind: ClusterRole
• HelmRoleArn and KubernetesRoleArn
• system:masters, system:serviceaccount:
• Terraform resource: kubernetes_config_map
• kubectl get configmap -n kube-system
• service-account-controller
• kubectl get clusterroles
• cluster_endpoint_public_access
• eks:
• EKS API

See also

• AWS IAM Authenticator for Kubernetes: aws-auth, kubectl edit -n kube-system configmap/aws-auth, eksctl create iamidentitymapping, mapUsers:, mapRoles:, mapAccounts:, EKS API
• EKS RBAC, Amazon EKS authentication, Amazon EKS authorization, aws eks get-token, aws-auth ConfigMap, aws-iam-authenticator, eksctl create iamidentitymapping, eksctl get iamidentitymapping, eks:AccessKubernetesApi, eks-connector, K8s Cluster roles, AmazonEKSAdminPolicy, AmazonEKSClusterAdminPolicy, AmazonEKSAdminViewPolicy, AmazonEKSEditPolicy, AmazonEKSViewPolicy, AmazonEKSAutoNodePolicy, AmazonEKSBlockStoragePolicy, AmazonEKSLoadBalancingPolicy, AmazonEKSNetworkingPolicy, AmazonEKSComputePolicy, AmazonEKSClusterInsightsPolicy, kubernetes_cluster_role_v1
• Kubernetes Authentication, bearer tokens, certificate authentication, Service accounts, CertificateSigningRequest, aws-auth, EKS Authentication, kind: Config, gke-gcloud-auth-plugin