title: Not able to join worker nodes using kubectl with updated aws-auth configmap
body: <p>I'm setting up AWS EKS cluster using terraform from an EC2 instance. Basically the setup includes EC2 launch configuration and autoscaling for worker nodes. After creating the cluster, I am able to configure kubectl with aws-iam-authenticator. When I did</p>
  
  <pre><code>kubectl get nodes 
  </code></pre>
  
  <p>It returned </p>
  
  <blockquote>
    <p>No resources found</p>
  </blockquote>
  
  <p>as the worker nodes were not joined. So I tried updating <code>aws-auth-cm.yaml</code> file </p>
  
  <pre><code>apiVersion: v1
  kind: ConfigMap
  metadata:
    name: aws-auth
    namespace: kube-system
  data:
    mapRoles: |
      - rolearn: &lt;ARN of instance role (not instance profile)&gt;
        username: system:node:{{EC2PrivateDNSName}}
        groups:
          - system:bootstrappers
          - system:nodes
  </code></pre>
  
  <p>with IAM role ARN of the worker node. And did</p>
  
  <pre><code>kubectl apply -f aws-auth-cm.yaml
  </code></pre>
  
  <p>It returned </p>
  
  <blockquote>
    <p>ConfigMap/aws-auth created</p>
  </blockquote>
  
  <p>Then I understood that role ARN configured in <code>aws-auth-cm.yaml</code> is the wrong one. So I updated the same file with the exact worker node role ARN.</p>
  
  <p>But this time I got 403 when I did <code>kubectl apply -f aws-auth-cm.yaml</code> again.</p>
  
  <p>It returned </p>
  
  <blockquote>
    <p>Error from server (Forbidden): error when retrieving current
    configuration of: Resource: "/v1, Resource=configmaps",
    GroupVersionKind: "/v1, Kind=ConfigMap" Name: "aws-auth", Namespace:
    "kube-system" Object: &amp;{map["apiVersion":"v1" "data":map["mapRoles":"-
    rolearn: arn:aws:iam::XXXXXXXXX:role/worker-node-role\n  username:
    system:node:{{EC2PrivateDNSName}}\n  groups:\n    -
    system:bootstrappers\n    - system:nodes\n"] "kind":"ConfigMap"
    "metadata":map["name":"aws-auth" "namespace":"kube-system"
    "annotations":map["kubectl.kubernetes.io/last-applied-configuration":""]]]}
    from server for: "/home/username/aws-auth-cm.yaml": configmaps
    "aws-auth" is forbidden: User
    "system:node:ip-XXX-XX-XX-XX.ec2.internal" cannot get resource
    "configmaps" in API group "" in the namespace "kube-system"</p>
  </blockquote>
  
  <p>I'm not able to reconfigure the ConfigMap after this step.</p>
  
  <p>I'm getting 403 for commands like </p>
  
  <pre><code>kubectl apply
  kubectl delete
  kubectl edit 
  </code></pre>
  
  <p>for configmaps. Any help?</p>