EKS update-config overwrites user details when using multiple roles against the same cluster
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
I have an EKS cluster where I manage user access using IAM roles. This is roughly what my map roles would look like:
```yaml
- rolearn: arn:aws:iam::123456789123:role/k8s-admin
username: admin
groups:
- system:masters
- rolearn: arn:aws:iam::123456789123:role/k8s-developer
username: developer
groups:
- developers
```
To use `kubectl` with EKS, I need to assume the right role. Therefore, I'll have to provide the role ARN when updating the kubeconfig:
```shell
aws eks update-kubeconfig --name mycluster --role-arn arn:aws:iam::123456789123:role/k8s-admin --alias mycluster-admin
```
So far so good. However, when I try to add my second role to the same kubeconfig...
```shell
aws eks update-kubeconfig --name mycluster --role-arn arn:aws:iam::123456789123:role/k8s-developer --alias mycluster-developer
```
...the user information for the previous config update is overwritten. You can see this in the kubeconfig file:
```yaml
apiVersion: v1
clusters;
- cluster:
certificate-authority-data:
server: https://XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.YYY.us-east-1.eks.amazonaws.com
name: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
contexts:
- context:
cluster: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
user: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
name: mycluster-admin
- context:
cluster: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
user: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
name: mycluster-developer
current-context: mycluster-developer
kind: Config
preferences: {}
users:
- name: arn:aws:eks:us-east-1:123456789123:cluster/mycluster
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- -i
- eks
- -r
- arn:aws:iam::123456789123:role/k8s-developer
command: aws-iam-authenticator
env: null
```
Both contexts remain in the config file, but there's only one user which is attached to both contexts. There should be two users with distinct role ARNs.
I haven't verified this from the code, but I'm guessing the user is overwritten because the same user name is used for both updates.
Contributor guide
Assessment
This issue has not been assessed yet.