aws / aws/aws-cli

EKS update-config overwrites user details when using multiple roles against the same cluster

Open
#4,079 23 comments 27 reactions 0 assignees View on GitHub
customization eks-kubeconfig feature-request has-pr p2
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

I have an EKS cluster where I manage user access using IAM roles. This is roughly what my map roles would look like:

```yaml
- rolearn: arn:aws:iam::123456789123:role/k8s-admin
username: admin
groups:
- system:masters
- rolearn: arn:aws:iam::123456789123:role/k8s-developer
username: developer
groups:
- developers
```

To use `kubectl` with EKS, I need to assume the right role. Therefore, I'll have to provide the role ARN when updating the kubeconfig:

```shell
aws eks update-kubeconfig --name mycluster --role-arn arn:aws:iam::123456789123:role/k8s-admin --alias mycluster-admin
```

So far so good. However, when I try to add my second role to the same kubeconfig...

```shell
aws eks update-kubeconfig --name mycluster --role-arn arn:aws:iam::123456789123:role/k8s-developer --alias mycluster-developer
```

...the user information for the previous config update is overwritten. You can see this in the kubeconfig file:

```yaml
apiVersion: v1
clusters;
- cluster:
certificate-authority-data:
server: https://XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.YYY.us-east-1.eks.amazonaws.com
name: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
contexts:
- context:
cluster: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
user: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
name: mycluster-admin
- context:
cluster: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
user: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
name: mycluster-developer
current-context: mycluster-developer
kind: Config
preferences: {}
users:
- name: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- -i
- eks
- -r
- arn:aws:iam::123456789123:role/k8s-developer
command: aws-iam-authenticator
env: null
```

Both contexts remain in the config file, but there's only one user which is attached to both contexts. There should be two users with distinct role ARNs.

I haven't verified this from the code, but I'm guessing the user is overwritten because the same user name is used for both updates.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.