title: EKS Kubernetes user with RBAC seen as system:anonymous
body: <p>I've been following <a href="https://www.linkedin.com/pulse/adding-users-quick-start-kubernetes-aws-jakub-scholz/" rel="nofollow noreferrer">this post</a> to create user access to my kubernetes cluster (running on Amazon EKS). I did create key, csr, approved the request and downloaded the certificate for the user. Then I did create a kubeconfig file with the key and crt. When I run kubectl with this kubeconfig, I'm recognized as <code>system:anonymous</code>.</p>
  
  <pre><code>$ kubectl --kubeconfig test-user-2.kube.yaml get pods
  Error from server (Forbidden): pods is forbidden: User "system:anonymous" cannot list pods in the namespace "default"
  </code></pre>
  
  <p>I expected the user to be recognized but get denied access.</p>
  
  <pre><code>$ kubectl --kubeconfig test-user-2.kube.yaml version
  Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.1", GitCommit:"b1b29978270dc22fecc592ac55d903350454310a", GitTreeState:"clean", BuildDate:"2018-07-18T11:37:06Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"darwin/amd64"}
  Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.3", GitCommit:"2bba0127d85d5a46ab4b778548be28623b32d0b0", GitTreeState:"clean", BuildDate:"2018-05-28T20:13:43Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
  
  
  $ kubectl --kubeconfig test-user-2.kube.yaml config view
  apiVersion: v1
  clusters:
  - cluster:
      insecure-skip-tls-verify: true
      server: REDACTED
    name: kubernetes
  contexts:
  - context:
      cluster: kubernetes
      user: test-user-2
    name: kubernetes
  current-context: kubernetes
  kind: Config
  preferences: {}
  users:
  - name: test-user-2
    user:
      client-certificate-data: REDACTED
      client-key-data: REDACTED
  
  # running with my other account (which uses heptio-authenticator-aws)
  $ kubectl describe certificatesigningrequest.certificates.k8s.io/user-request-test-user-2
  Name:               user-request-test-user-2
  Labels:             &lt;none&gt;
  Annotations:        &lt;none&gt;
  CreationTimestamp:  Wed, 01 Aug 2018 15:20:15 +0200
  Requesting User:
  Status:             Approved,Issued
  Subject:
           Common Name:    test-user-2
           Serial Number:
  Events:  &lt;none&gt;
  </code></pre>
  
  <p>I did create a ClusterRoleBinding with <code>admin</code> (also tried <code>cluster-admin</code>) roles for this user but that should not matter for this step. I'm not sure how I can further debug 1) if the user is created or not or 2) if I missed some configuration.</p>
  
  <p>Any help is appreciated!</p>