"aws-auth" is forbidden in the namespace "kube-system"

[theFong]

Describe the Bug

I made a minor change to my terraform code after a couple of months and am getting this permission error in the eks-cluster module.

Expected Behavior

I was expecting my minor change (adding a new variable to the terraform code) to work.

Steps to Reproduce

  source  = "cloudposse/eks-cluster/aws"
  version = "0.46.0"

Screenshots

│ Error: configmaps "aws-auth" is forbidden: User "system:anonymous" cannot get resource "configmaps" in API group "" in the namespace "kube-system"
│ 
│   with module.eks_cluster.kubernetes_config_map.aws_auth_ignore_changes[0],
│   on .terraform/modules/eks_cluster/auth.tf line 115, in resource "kubernetes_config_map" "aws_auth_ignore_changes":
│  115: resource "kubernetes_config_map" "aws_auth_ignore_changes" {

Environment

Spacelift, terraform 1.1.6

Additional Context

Any help would be much appreciated! I also requested to join the slack if this kinda of issue would fit better there.

Thanks :)

[mya-crabnebula]

For us, this problem is manifesting when we try and enable logging for the cluster. Its not clear why it's attempting to access the config map from a quick code read, but I'm probably missing something.

[nitrocode]

This might be a duplicate of #166

[Nightbr]

Some error here:

• module version: "2.9.0"

Terraform v1.5.4
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.17.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.23.0
+ provider registry.terraform.io/hashicorp/null v3.2.1
+ provider registry.terraform.io/hashicorp/random v3.5.1
+ provider registry.terraform.io/hashicorp/tls v4.0.4

╷
│ Error: configmaps "aws-auth" is forbidden: User "system:anonymous" cannot get resource "configmaps" in API group "" in the namespace "kube-system"
│ 
│   with module.eks_cluster.kubernetes_config_map.aws_auth_ignore_changes[0],
│   on .terraform/modules/eks_cluster/auth.tf line 123, in resource "kubernetes_config_map" "aws_auth_ignore_changes":
│  123: resource "kubernetes_config_map" "aws_auth_ignore_changes" {
│ 
╵

EDIT:

Here is the fix: #166 (comment)

Add kube_exec_auth_enabled = true to reefresh the token to be able to access the aws-auth config map!

[slps970093]

v3.0.0 kube_exec_auth_enabled = true
The problem still exists