EKS kubeconfig profile setting doesn't work when using environment varialbles for authentication
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the bug
When leveraging and external authentication application (i.e. jumpcloud) to generate AWS credentials they are set as environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. If referencing them in a profile to assume a role in another account and using the `--profile` cli option with `aws eks update-kubeconfig` it adds the profile to the token generation mechanism using the `AWS_PROFILE` environment variable.
https://github.com/aws/aws-cli/blob/e8110b30fd079020af12c468f67867ef9fc69d01/awscli/customizations/eks/update_kubeconfig.py#L336-L340
Based on the documentation https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#id1 this will get ignored on `kubectl` commands because the other environment variables are already set. If the command is manually changed in the kubeconfig file to include the profile with the `--profile` argument then authentication works successfully. Perhaps this conditional could be changed to extend the executable arguments just like are done for the role_arn in line 330?
### Expected Behavior
`aws --profile XXXX eks update-kubeconfig --region us-west-1 --name eks-cluster-name` would update the kubeconfig file with a command that allows `kubectl` to be run successfully for that context.
### Current Behavior
The generated kubeconfig does not work for that context. Manually editing the kubeconfig file and adding argments for `--profile XXXXXX` allow kubectl to run successfully.
### Reproduction Steps
Set environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` with valid credentials to and AWS user that can assume a role in another account. Then used those for authentication to the second AWS account via `~/.aws/config` with
```
[profile account2]
region = us-east-1
role_arn = arn:aws:iam::XXXXXXXXXXXX:role/AssumeRole
credential_source = Environment
```
Create an EKS cluster in the second account with the assumed role.
Generate a kubeconfig with `aws --profile account2 eks update-kubeconfig --region {region} --name {eks-cluster-name}`. Try to use that kubeconfig to interact with the cluster.
### Possible Solution
```
if self._session.profile:
generated_user["user"]["exec"]["args"].extend([
"--profile",
self._session.profile)
])
```
### Additional Information/Context
_No response_
### CLI version used
aws-cli/2.11.6 Python/3.11.2
### Environment details (OS name and version, etc.)
Darwin/22.3.0
Contributor guide
Assessment
This issue has not been assessed yet.