Mixing
Could not get token Access Denied with AWS IAM Authenticator
I'm trying to setup AWS IAM Authenticator for my k8s cluster. I have two AWS account: A and B.
The k8s account runs in the B account.
I have created in the A account the following resources:
Policy
Description: Grants permissions to assume the kubernetes-admin role
Policy:
Statement:
- Action: sts:*
Effect: Allow
Resource: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
Sid: KubernetesAdmin
Version: 2012-10-17
The policy is associated to a group and I add my IAM user to the group.
in the B account I have created the following role:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
AWS: arn:aws:iam::<AccountID-A>:root
Version: 2012-10-17
This is the ConfigMap to configure aws-iam-authenticator:
apiVersion: v1
data:
config.yaml: |
# a unique-per-cluster identifier to prevent replay attacks
# (good choices are a random token or a domain name that will be unique to your cluster)
clusterID: k8s.mycluster.net
server:
# each mapRoles entry maps an IAM role to a username and set of groups
# Each username and group can optionally contain template parameters:
# "{{AccountID}}" is the 12 digit AWS ID.
# "{{SessionName}}" is the role session name.
mapRoles:
- roleARN: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
username: kubernetes-admin:{{AccountID}}:{{SessionName}}
groups:
- system:masters
kind: ConfigMap
metadata:
creationTimestamp: 2018-12-13T19:41:39Z
labels:
k8s-app: aws-iam-authenticator
name: aws-iam-authenticator
namespace: kube-system
resourceVersion: "87401"
selfLink: /api/v1/namespaces/kube-system/configmaps/aws-iam-authenticator
uid: 1bc39653-ff0f-11e8-a580-02b4590539ba
The kubeconfig is:
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: <certificate>
server: https://api.k8s.mycluster.net
name: k8s.mycluster.net
contexts:
- context:
cluster: k8s.mycluster.net
namespace: kube-system
user: k8s.mycluster.net
name: k8s.mycluster.net
current-context: k8s.mycluster.net
kind: Config
preferences: {}
users:
- name: k8s.mycluster.net
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
command: aws-iam-authenticator
env:
- name: "AWS_PROFILE"
value: "myaccount"
args:
- "token"
- "-i"
- "k8s.mycluster.net"
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
The result is:
could not get token: AccessDenied: Access denied
status code: 403, request id: 6ceac161-ff2f-11e8-b263-2b0e32831969
Unable to connect to the server: getting token: exec: exit status 1
Any idea? I don't get what i'm missing.
amazon-web-services
kubernetes amazon-iam asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
add a comment |
I'm trying to setup AWS IAM Authenticator for my k8s cluster. I have two AWS account: A and B.
The k8s account runs in the B account.
I have created in the A account the following resources:
Policy
Description: Grants permissions to assume the kubernetes-admin role
Policy:
Statement:
- Action: sts:*
Effect: Allow
Resource: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
Sid: KubernetesAdmin
Version: 2012-10-17
The policy is associated to a group and I add my IAM user to the group.
in the B account I have created the following role:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
AWS: arn:aws:iam::<AccountID-A>:root
Version: 2012-10-17
This is the ConfigMap to configure aws-iam-authenticator:
apiVersion: v1
data:
config.yaml: |
# a unique-per-cluster identifier to prevent replay attacks
# (good choices are a random token or a domain name that will be unique to your cluster)
clusterID: k8s.mycluster.net
server:
# each mapRoles entry maps an IAM role to a username and set of groups
# Each username and group can optionally contain template parameters:
# "{{AccountID}}" is the 12 digit AWS ID.
# "{{SessionName}}" is the role session name.
mapRoles:
- roleARN: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
username: kubernetes-admin:{{AccountID}}:{{SessionName}}
groups:
- system:masters
kind: ConfigMap
metadata:
creationTimestamp: 2018-12-13T19:41:39Z
labels:
k8s-app: aws-iam-authenticator
name: aws-iam-authenticator
namespace: kube-system
resourceVersion: "87401"
selfLink: /api/v1/namespaces/kube-system/configmaps/aws-iam-authenticator
uid: 1bc39653-ff0f-11e8-a580-02b4590539ba
The kubeconfig is:
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: <certificate>
server: https://api.k8s.mycluster.net
name: k8s.mycluster.net
contexts:
- context:
cluster: k8s.mycluster.net
namespace: kube-system
user: k8s.mycluster.net
name: k8s.mycluster.net
current-context: k8s.mycluster.net
kind: Config
preferences: {}
users:
- name: k8s.mycluster.net
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
command: aws-iam-authenticator
env:
- name: "AWS_PROFILE"
value: "myaccount"
args:
- "token"
- "-i"
- "k8s.mycluster.net"
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
The result is:
could not get token: AccessDenied: Access denied
status code: 403, request id: 6ceac161-ff2f-11e8-b263-2b0e32831969
Unable to connect to the server: getting token: exec: exit status 1
Any idea? I don't get what i'm missing.
amazon-web-services
kubernetes amazon-iam asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
What are you using to provision the cluster? You need to set up the Kubernetes API Server to include aws-iam-authenticator as an auth method.
– Grant David Bachman
Dec 15 '18 at 19:04
I've solved the issue. I'll reply down with the solution
– Mazzy
Dec 15 '18 at 22:51
Please post the solution so it can be helpful for others.
– Crou
Jan 2 at 11:11
add a comment |
I'm trying to setup AWS IAM Authenticator for my k8s cluster. I have two AWS account: A and B.
The k8s account runs in the B account.
I have created in the A account the following resources:
Policy
Description: Grants permissions to assume the kubernetes-admin role
Policy:
Statement:
- Action: sts:*
Effect: Allow
Resource: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
Sid: KubernetesAdmin
Version: 2012-10-17
The policy is associated to a group and I add my IAM user to the group.
in the B account I have created the following role:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
AWS: arn:aws:iam::<AccountID-A>:root
Version: 2012-10-17
This is the ConfigMap to configure aws-iam-authenticator:
apiVersion: v1
data:
config.yaml: |
# a unique-per-cluster identifier to prevent replay attacks
# (good choices are a random token or a domain name that will be unique to your cluster)
clusterID: k8s.mycluster.net
server:
# each mapRoles entry maps an IAM role to a username and set of groups
# Each username and group can optionally contain template parameters:
# "{{AccountID}}" is the 12 digit AWS ID.
# "{{SessionName}}" is the role session name.
mapRoles:
- roleARN: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
username: kubernetes-admin:{{AccountID}}:{{SessionName}}
groups:
- system:masters
kind: ConfigMap
metadata:
creationTimestamp: 2018-12-13T19:41:39Z
labels:
k8s-app: aws-iam-authenticator
name: aws-iam-authenticator
namespace: kube-system
resourceVersion: "87401"
selfLink: /api/v1/namespaces/kube-system/configmaps/aws-iam-authenticator
uid: 1bc39653-ff0f-11e8-a580-02b4590539ba
The kubeconfig is:
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: <certificate>
server: https://api.k8s.mycluster.net
name: k8s.mycluster.net
contexts:
- context:
cluster: k8s.mycluster.net
namespace: kube-system
user: k8s.mycluster.net
name: k8s.mycluster.net
current-context: k8s.mycluster.net
kind: Config
preferences: {}
users:
- name: k8s.mycluster.net
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
command: aws-iam-authenticator
env:
- name: "AWS_PROFILE"
value: "myaccount"
args:
- "token"
- "-i"
- "k8s.mycluster.net"
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
The result is:
could not get token: AccessDenied: Access denied
status code: 403, request id: 6ceac161-ff2f-11e8-b263-2b0e32831969
Unable to connect to the server: getting token: exec: exit status 1
Any idea? I don't get what i'm missing.
amazon-web-services
kubernetes amazon-iam asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
I'm trying to setup AWS IAM Authenticator for my k8s cluster. I have two AWS account: A and B.
The k8s account runs in the B account.
I have created in the A account the following resources:
Policy
Description: Grants permissions to assume the kubernetes-admin role
Policy:
Statement:
- Action: sts:*
Effect: Allow
Resource: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
Sid: KubernetesAdmin
Version: 2012-10-17
The policy is associated to a group and I add my IAM user to the group.
in the B account I have created the following role:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
AWS: arn:aws:iam::<AccountID-A>:root
Version: 2012-10-17
This is the ConfigMap to configure aws-iam-authenticator:
apiVersion: v1
data:
config.yaml: |
# a unique-per-cluster identifier to prevent replay attacks
# (good choices are a random token or a domain name that will be unique to your cluster)
clusterID: k8s.mycluster.net
server:
# each mapRoles entry maps an IAM role to a username and set of groups
# Each username and group can optionally contain template parameters:
# "{{AccountID}}" is the 12 digit AWS ID.
# "{{SessionName}}" is the role session name.
mapRoles:
- roleARN: arn:aws:iam::<AccountID-B>:role/kubernetes-admin
username: kubernetes-admin:{{AccountID}}:{{SessionName}}
groups:
- system:masters
kind: ConfigMap
metadata:
creationTimestamp: 2018-12-13T19:41:39Z
labels:
k8s-app: aws-iam-authenticator
name: aws-iam-authenticator
namespace: kube-system
resourceVersion: "87401"
selfLink: /api/v1/namespaces/kube-system/configmaps/aws-iam-authenticator
uid: 1bc39653-ff0f-11e8-a580-02b4590539ba
The kubeconfig is:
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: <certificate>
server: https://api.k8s.mycluster.net
name: k8s.mycluster.net
contexts:
- context:
cluster: k8s.mycluster.net
namespace: kube-system
user: k8s.mycluster.net
name: k8s.mycluster.net
current-context: k8s.mycluster.net
kind: Config
preferences: {}
users:
- name: k8s.mycluster.net
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
command: aws-iam-authenticator
env:
- name: "AWS_PROFILE"
value: "myaccount"
args:
- "token"
- "-i"
- "k8s.mycluster.net"
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
The result is:
could not get token: AccessDenied: Access denied
status code: 403, request id: 6ceac161-ff2f-11e8-b263-2b0e32831969
Unable to connect to the server: getting token: exec: exit status 1
Any idea? I don't get what i'm missing.
amazon-web-services
kubernetes amazon-iam amazon-web-services
kubernetes amazon-iam asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
asked Dec 13 '18 at 23:33
MazzyMazzy
4,8092285150
4,8092285150
What are you using to provision the cluster? You need to set up the Kubernetes API Server to include aws-iam-authenticator as an auth method.
– Grant David Bachman
Dec 15 '18 at 19:04
I've solved the issue. I'll reply down with the solution
– Mazzy
Dec 15 '18 at 22:51
Please post the solution so it can be helpful for others.
– Crou
Jan 2 at 11:11
add a comment |
What are you using to provision the cluster? You need to set up the Kubernetes API Server to include aws-iam-authenticator as an auth method.
– Grant David Bachman
Dec 15 '18 at 19:04
I've solved the issue. I'll reply down with the solution
– Mazzy
Dec 15 '18 at 22:51
Please post the solution so it can be helpful for others.
– Crou
Jan 2 at 11:11
What are you using to provision the cluster? You need to set up the Kubernetes API Server to include aws-iam-authenticator as an auth method.
– Grant David Bachman
Dec 15 '18 at 19:04
What are you using to provision the cluster? You need to set up the Kubernetes API Server to include aws-iam-authenticator as an auth method.
– Grant David Bachman
Dec 15 '18 at 19:04
I've solved the issue. I'll reply down with the solution
– Mazzy
Dec 15 '18 at 22:51
I've solved the issue. I'll reply down with the solution
– Mazzy
Dec 15 '18 at 22:51
Please post the solution so it can be helpful for others.
– Crou
Jan 2 at 11:11
Please post the solution so it can be helpful for others.
– Crou
Jan 2 at 11:11
add a comment |
2 Answers
2
active
oldest
votes
the way to make it work properly is to remove
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
and pass the role to assume to the AWS_PROFILE env var
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
add a comment |
to add to this - my solution was to do the following:
in ~/.kube directory:
aws eks update-kubeconfig --name eks-dev-cluster --role-arn=XXXXXXXXXXXX
this creates a file config-my-eks-cluster
vi config-my-eks-cluster
comment out the two lines mentioned above:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- -i
- eks-dev-cluster
#- -r
#- arn:aws:iam::XXXXXXXXX:role/eks-dev-role (the role you made for eks)
command: aws-iam-authenticator
Then make sure you export your user profile with:
export AWS_PROFILE=XXXXXXXXX (the user you used to create the cluster in the console or through the cli)
The run:
kubectl get svc --v=10
this will put output into verbose mode and give you details on any errors that creep up.
edited Jan 22 at 5:27
slfan
6,971205571
answered Jan 22 at 5:09
texasdavetexasdave
435
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53771593%2fcould-not-get-token-access-denied-with-aws-iam-authenticator%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
the way to make it work properly is to remove
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
and pass the role to assume to the AWS_PROFILE env var
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
add a comment |
the way to make it work properly is to remove
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
and pass the role to assume to the AWS_PROFILE env var
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
add a comment |
the way to make it work properly is to remove
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
and pass the role to assume to the AWS_PROFILE env var
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
the way to make it work properly is to remove
- "-r"
- "arn:aws:iam::<AccountID-B>:role/kubernetes-admin"
and pass the role to assume to the AWS_PROFILE env var
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
answered Jan 2 at 15:32
MazzyMazzy
4,8092285150
4,8092285150
add a comment |
add a comment |
to add to this - my solution was to do the following:
in ~/.kube directory:
aws eks update-kubeconfig --name eks-dev-cluster --role-arn=XXXXXXXXXXXX
this creates a file config-my-eks-cluster
vi config-my-eks-cluster
comment out the two lines mentioned above:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- -i
- eks-dev-cluster
#- -r
#- arn:aws:iam::XXXXXXXXX:role/eks-dev-role (the role you made for eks)
command: aws-iam-authenticator
Then make sure you export your user profile with:
export AWS_PROFILE=XXXXXXXXX (the user you used to create the cluster in the console or through the cli)
The run:
kubectl get svc --v=10
this will put output into verbose mode and give you details on any errors that creep up.
edited Jan 22 at 5:27
slfan
6,971205571
answered Jan 22 at 5:09
texasdavetexasdave
435
add a comment |
to add to this - my solution was to do the following:
in ~/.kube directory:
aws eks update-kubeconfig --name eks-dev-cluster --role-arn=XXXXXXXXXXXX
this creates a file config-my-eks-cluster
vi config-my-eks-cluster
comment out the two lines mentioned above:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- -i
- eks-dev-cluster
#- -r
#- arn:aws:iam::XXXXXXXXX:role/eks-dev-role (the role you made for eks)
command: aws-iam-authenticator
Then make sure you export your user profile with:
export AWS_PROFILE=XXXXXXXXX (the user you used to create the cluster in the console or through the cli)
The run:
kubectl get svc --v=10
this will put output into verbose mode and give you details on any errors that creep up.
edited Jan 22 at 5:27
slfan
6,971205571
answered Jan 22 at 5:09
texasdavetexasdave
435
add a comment |
to add to this - my solution was to do the following:
in ~/.kube directory:
aws eks update-kubeconfig --name eks-dev-cluster --role-arn=XXXXXXXXXXXX
this creates a file config-my-eks-cluster
vi config-my-eks-cluster
comment out the two lines mentioned above:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- -i
- eks-dev-cluster
#- -r
#- arn:aws:iam::XXXXXXXXX:role/eks-dev-role (the role you made for eks)
command: aws-iam-authenticator
Then make sure you export your user profile with:
export AWS_PROFILE=XXXXXXXXX (the user you used to create the cluster in the console or through the cli)
The run:
kubectl get svc --v=10
this will put output into verbose mode and give you details on any errors that creep up.
edited Jan 22 at 5:27
slfan
6,971205571
answered Jan 22 at 5:09
texasdavetexasdave
435
to add to this - my solution was to do the following:
in ~/.kube directory:
aws eks update-kubeconfig --name eks-dev-cluster --role-arn=XXXXXXXXXXXX
this creates a file config-my-eks-cluster
vi config-my-eks-cluster
comment out the two lines mentioned above:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- -i
- eks-dev-cluster
#- -r
#- arn:aws:iam::XXXXXXXXX:role/eks-dev-role (the role you made for eks)
command: aws-iam-authenticator
Then make sure you export your user profile with:
export AWS_PROFILE=XXXXXXXXX (the user you used to create the cluster in the console or through the cli)
The run:
kubectl get svc --v=10
this will put output into verbose mode and give you details on any errors that creep up.
edited Jan 22 at 5:27
slfan
6,971205571
answered Jan 22 at 5:09
texasdavetexasdave
435
edited Jan 22 at 5:27
slfan
6,971205571
edited Jan 22 at 5:27
slfan
6,971205571
edited Jan 22 at 5:27
slfan
6,971205571
6,971205571
answered Jan 22 at 5:09
texasdavetexasdave
435
answered Jan 22 at 5:09
texasdavetexasdave
435
answered Jan 22 at 5:09
texasdavetexasdave
435
435
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53771593%2fcould-not-get-token-access-denied-with-aws-iam-authenticator%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What are you using to provision the cluster? You need to set up the Kubernetes API Server to include aws-iam-authenticator as an auth method.
– Grant David Bachman
Dec 15 '18 at 19:04
I've solved the issue. I'll reply down with the solution
– Mazzy
Dec 15 '18 at 22:51
Please post the solution so it can be helpful for others.
– Crou
Jan 2 at 11:11