EKS compatible? about kubernetai HOT 11 CLOSED

0319 07:09:59.530761 1 reflector.go:134] github.com/coredns/coredns/plugin/kubernetes/controller.go:322: Failed to list *v1.Namespace: Unauthorized

Unauthorized errors mean the authentication credentials being used are not valid.

from kubernetai.

This is my coredns kubernetai config (replaced kubernetes default block), the rest is coredns defaults

Is there a reason to use kubernetai instead of the default kubernetes plugin, since it seems you have only one zone cluster.local

Nvm, corefile seems valid.

from kubernetai.

I am using kubernetai to be able to use the plugin more than once in the server block

Unauthorized errors mean the authentication credentials being used are not valid.

You're right, so I wonder if I can really make either this or kubernetes plugin work with EKS. Since the typical authentication method used to access EKS clusters is not using keys but aws-iam-authenticator

from kubernetai.

In general, "Unauthorized" means that the user identity is successfully authenticated, but not authorized to access the resource requested ...

May want to double check that the user account has the list permission for the Namespace resource in RBAC.

from kubernetai.

In general, "Unauthorized" means that the user identity is successfully authenticated, but not authorized to access the resource requested ...

May want to double check that the user account has the list permission for the Namespace resource in RBAC.

I understand what you describe as a Forbidden error, and Unauthorized as when the server does not accept the credentials passed. Nevertheless, I disabled the certificate I am using on the AWS user and tried again using the same credentials (this time they are not valid) and still get the same Unauthorized error.

The way I am authenticating to EKS at the moment is by using credentials that can do a PassRole action to the role assigned to the k8s EKS cluster. So you first need a way to authenticate to the AWS account, and then switch to the Role that has permissions on that cluster. I didn't see any plugin in coredns that supports such authentication yet, since it would be quite custom just for accessing to EKS clusters.

Anyone aware of any other way to authenticate to EKS clusters that can work when connecting to them from any coredns plugin?

from kubernetai.

Ah, OK thanks. In general there is a distinction between authorization and authentication... but it seems that k8s is blurring the terminology in this error message.

from kubernetai.

from kubernetai.

from kubernetai.

@johnbelamaric you're right, I don't see any AWS compatible client-go auth-plugin either. This is the EKS authentication and authorization workflow:
https://docs.aws.amazon.com/eks/latest/userguide/managing-auth.html

It authenticates first to AWS, then RBAC checks if that IAM entity has permissions to run the kubectl command. So the authentication is not made using certs but AWS credentials.

from kubernetai.

@johnbelamaric, yes thanks for that. makes sense. me being dense. @offzale, my apologies for misleading you.

from kubernetai.

@chrisohaver no problem, it could have been the problem also. So was good to check to make sure it wasn't. I am afraid that it is what @johnbelamaric spotted, there is no auth plugin for AWS yet.

from kubernetai.