AWS EKS support for kubernetes has some quirks. The most-troublesome one is the fact that only the entity that creates a cluster can manage it. For example, if Amir creates a cluster using his AWS IAM credentials and promptly resigns, no one else in your company can manage that cluster. Even AWS support will not be able to delete it – or so they told me.

The simplest method I have found for making a cluster manageable by others is to edit the aws-auth config map for the cluster. You can add individual users and roles to the system:masters group for the cluster. (I am partial to adding roles and then managing role membership as a way to control who can access the cluster…)

Pulling together advice from a few web sites, this is the summary of what I am doing:

Prerequisites

• AWS CLI
• Kubectl
• Eksctl
• Default editor configured on your shell

Steps

• Ensure that you are using the proper identity and AWS credentials

1. Use aws sts get-caller-identity to ensure that you are using the proper credentials
2. You can change credentials using aws configure
3. Use eksctl utils write-kubeconfig --cluster <cluster-name> to configure your kubeconfig for the cluster you want to add users to.
4. Use kubectl edit configmap aws-auth --namespace kube-system to modify the aws-auth ConfigMap for the cluster. Your default editor will open. On a brand-new cluster, the mapUsers section of the file will be empty. Add users following the YAML format shown in the mapUsers section, below, as a guide. Or add a role to the mapRoles section.
   
   You should not edit any other part of the file – in fact, we are warned that messing up this file can lead to everyone being locked out of the cluster. Proceed with caution. the values shown, below, are for example purposes only. DO NOT COPY THEM.
   
   apiVersion: v1
data:
mapRoles: |
- groups:
- system:bootstrappers
- system:nodes
rolearn: arn:aws:iam::nnnnnnnnnnnn:role/cluster-name-nodegroup-ng-NodeInstanceRole-BL7FPEHQ
username: system:node:{{EC2PrivateDNSName}}
mapUsers: |
- userarn: arn:aws:iam::nnnnnnnn:user/user.name
username: user.name
groups:
- system:masters
- userarn: arn:aws:iam::nnnnnnnn:user/user.name2
username: user.name2
groups:
- system:masters
kind: ConfigMap
metadata:
creationTimestamp: "2022-11-24T22:07:34Z"
name: aws-auth
namespace: kube-system
resourceVersion: "1577569"
uid: 123456-e129-4fe0-9ecb-246425fba343
 
5. Save the file. kubectl will take care of updating the cluster. It may take a minute or two, but eventually the users /roles you added will be able to manage the cluster.