Leveraging SA token to access EKS cluster about jwt-to-rbac

[j-zimnowoda]

@pbalogh-sa thanks for your answer.
I did not decode the secret with base64 --decode and that was the issue.
The jet-to-rbac works out of the box - great! It's a very promising solution for having cloud native oidc login to the closter.

Btw, I am going to integrate jwt-to-rbac with the containers platform that I and other folks are working on.
Take a look, there is a lot of valuable and interesting stuff: https://github.com/redkubes/otomi-core

[pbalogh-sa]

I close the issue but feel free to reopen it if you have additional questions.

[j-zimnowoda]

I am really curious if you have ever had this issue. If so, then how have you solved it.
Regards

[Morriz]

Maybe it is just what it says? That "po" does not exist? Did you try with "pod"?

[j-zimnowoda]

Maybe it is just what it says? That "po" does not exist? Did you try with "pod"?

yes, I did. Same error.

[pbalogh-sa]

Hi @j-zimnowoda , I can authenticate with SA token to my EKS cluster.

kubectl --token $TOKEN --server  https://xxxxxx.us-west-2.eks.amazonaws.com --certificate-authority ~/test.crt get pod -n kube-system
NAME                       READY   STATUS    RESTARTS   AGE
aws-node-96g2r             1/1     Running   0          65m
aws-node-dv79l             1/1     Running   0          66m
aws-node-m7hv4             1/1     Running   0          66m
coredns-5946c5d67c-tjbwl   1/1     Running   0          71m
coredns-5946c5d67c-tkdnb   1/1     Running   0          71m
kube-proxy-46sxk           1/1     Running   0          65m
kube-proxy-h5ndg           1/1     Running   0          66m
kube-proxy-jjhht           1/1     Running   0          66m

I got the token by the following command

kubectl get secret test-token-secret -o jsonpath='{.data.token}' |base64 --decode

I didn't annotate the test serviceaccount.

I guess the iam-authenticator shows the error you mentioned:

error: You must be logged in to the server (Unauthorized)

Maybe the aws-iam-authenticator was triggered somehow.