aws / aws/aws-cli

EKS kubeconfig profile setting doesn't work when using environment varialbles for authentication

Open
#7,794 8 comments 19 reactions 0 assignees View on GitHub
bug customization eks eks-kubeconfig p2
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

When leveraging and external authentication application (i.e. jumpcloud) to generate AWS credentials they are set as environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. If referencing them in a profile to assume a role in another account and using the `--profile` cli option with `aws eks update-kubeconfig` it adds the profile to the token generation mechanism using the `AWS_PROFILE` environment variable.

https://github.com/aws/aws-cli/blob/e8110b30fd079020af12c468f67867ef9fc69d01/awscli/customizations/eks/update_kubeconfig.py#L336-L340

Based on the documentation https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#id1 this will get ignored on `kubectl` commands because the other environment variables are already set. If the command is manually changed in the kubeconfig file to include the profile with the `--profile` argument then authentication works successfully. Perhaps this conditional could be changed to extend the executable arguments just like are done for the role_arn in line 330?

### Expected Behavior

`aws --profile XXXX eks update-kubeconfig --region us-west-1 --name eks-cluster-name` would update the kubeconfig file with a command that allows `kubectl` to be run successfully for that context.

### Current Behavior

The generated kubeconfig does not work for that context. Manually editing the kubeconfig file and adding argments for `--profile XXXXXX` allow kubectl to run successfully.

### Reproduction Steps

Set environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` with valid credentials to and AWS user that can assume a role in another account. Then used those for authentication to the second AWS account via `~/.aws/config` with

```
[profile account2]
region = us-east-1
role_arn = arn:aws:iam::XXXXXXXXXXXX:role/AssumeRole
credential_source = Environment
```
Create an EKS cluster in the second account with the assumed role.

Generate a kubeconfig with `aws --profile account2 eks update-kubeconfig --region {region} --name {eks-cluster-name}`. Try to use that kubeconfig to interact with the cluster.

### Possible Solution

```
if self._session.profile:
generated_user["user"]["exec"]["args"].extend([
"--profile",
self._session.profile)
])
```

### Additional Information/Context

_No response_

### CLI version used

aws-cli/2.11.6 Python/3.11.2

### Environment details (OS name and version, etc.)

Darwin/22.3.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.