Namespaces “kube-system” is forbidden

Question

I’m having a problem when I install ebs-csi-driver for AWS EKS I used the account with administratoraccess to install via was console but had an error “namespaces “kube-system” is forbidden: User “eks:addon-manager” cannot patch resource “namespaces” in API group “” in the namespace “kube-system”” I don’t know why the administrator permission can not install add-on. I also tried to create IAM role but follow Link but receive error : Error from server (NotFound): serviceaccounts “ebs-csi-controller-sa” not found

I just started with Kubernetes so don’t know how t resolve, Anyone can help ?

I follow Link

Answer 1

Had the same issue, after manually adding "patch" permission under namespace rule the installation was completed. I used the following command to edit that resource.

kubectl edit clusterrole eks:addon-manager

Hope this works for you :)

pd: I assume that this is needed only during the installation so after the I removed that permission.

Answer 2

While creating addon by default it inherit role of nodegroup, by giving permission of "AmazonEKSClusterPolicy" to your nodegroup's role might solve this issue.