Skip to content

Have eks update-kubeconfig use --profile for get-token rather than the AWS_PROFILE env var #9589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

bshelton229
Copy link

We've run into the situation where we need the aws eks update-kubeconfig --profile .... CLI switch to translate into aws eks get-token --profile rather than setting the AWS_PROFILE environment variable. We have some situations where our users have both the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars set, as well as some profiles configured in ~/.aws/config. The issue right now is when they use aws eks update-kubeconfig --profile my-profile-in-config ..... it's generating a kubeconfig user entry where the eks token is generated using the AWS_PROFILE=my-profile-in-config environment variable. This causes the kubernetes context to not work in this situation, because when the token generation call is made, the cli will pick the keys in the environment over the AWS_PROFILE environment variable, and not use the profile that was used to get the cluster details from the command line. It seems safe enough to me to default to the method that is most likely to use the profile when it was determined a profile was used in the update-kubeconfig call.

Reproducing our issue

  • Have an environment with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars set while also having a functioning profile in ~/.aws/credentials or ~/.aws/config using a different user/role.
  • aws eks update-kubeconfig --profile {using-profile-set}
  • Without this change kubectl auth whoami will not use a token from the profile, but will stop as the order of precedence will use the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars over AWS_PROFILE.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant