Have eks update-kubeconfig use --profile for get-token rather than the AWS_PROFILE env var #9589
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We've run into the situation where we need the
aws eks update-kubeconfig --profile ....
CLI switch to translate intoaws eks get-token --profile
rather than setting theAWS_PROFILE
environment variable. We have some situations where our users have both theAWS_ACCESS_KEY_ID
andAWS_SECRET_ACCESS_KEY
env vars set, as well as some profiles configured in~/.aws/config
. The issue right now is when they useaws eks update-kubeconfig --profile my-profile-in-config .....
it's generating a kubeconfig user entry where the eks token is generated using theAWS_PROFILE=my-profile-in-config
environment variable. This causes the kubernetes context to not work in this situation, because when the token generation call is made, the cli will pick the keys in the environment over theAWS_PROFILE
environment variable, and not use the profile that was used to get the cluster details from the command line. It seems safe enough to me to default to the method that is most likely to use the profile when it was determined a profile was used in theupdate-kubeconfig
call.Reproducing our issue
AWS_ACCESS_KEY_ID
andAWS_SECRET_ACCESS_KEY
env vars set while also having a functioning profile in~/.aws/credentials
or~/.aws/config
using a different user/role.aws eks update-kubeconfig --profile {using-profile-set}
kubectl auth whoami
will not use a token from the profile, but will stop as the order of precedence will use theAWS_ACCESS_KEY_ID
andAWS_SECRET_ACCESS_KEY
env vars overAWS_PROFILE
.