Skip to content

Comments

Assume Role to find EKS cluster for config update#9364

Closed
5nafu wants to merge 1 commit intoaws:developfrom
5nafu:develop
Closed

Assume Role to find EKS cluster for config update#9364
5nafu wants to merge 1 commit intoaws:developfrom
5nafu:develop

Conversation

@5nafu
Copy link

@5nafu 5nafu commented Mar 13, 2025

Issue #, if available: #8554

Description of changes:

This PR will assume a given role when trying to update the kubeconfig.

While aws eks update-kubeconfig --role-arn... would add the required parameters to the user section of the configfile, but will fail finding the cluster if the original profile does not have access. This PR will fix the issue and assume the role before getting the cluster description.

This commit will assume a given role when trying to update the
kubeconfig.

While `aws eks update-kubeconfig --role-arn...` would add the required
parameters to the user section of the configfile, but will fail finding
the cluster if the original profile does not have access.
This commit will fix the issue and assume the role before getting the
cluster description.

Fixes aws#8554
@djtung
Copy link

djtung commented Apr 14, 2025

Hi, I'm on the team working on EKS at AWS. As I understand:

  1. The current documentation specifies that --role-arn is meant for "cluster authentication" (kubectl connection), not for the AWS CLI's cluster discovery process.
  2. This fix overloads the --role-arn parameter by using it for both:
    • AWS CLI cluster discovery
    • Kubernetes cluster authentication
  3. This change would be breaking for existing customers who may have tools/scripts relying on the current documented behaviour

Better would be to implement the suggestions from here, perhaps with the latter of providing another parameter so that the two roles can be clearly separated. If you're willing to make that change for adding a new parameter (and update the documentation), we'd be happy to approve it.

@sdomme
Copy link
Contributor

sdomme commented Apr 15, 2025

HI @djtung, thank you very much for your feedback. We reworked this contribution in #9443 in favour to your suggestions. We confirmed with @5nafu, that this PR is superseded by the new request.
Please have a look. Thnaks

@aemous
Copy link
Contributor

aemous commented Apr 30, 2025

We confirmed with @5nafu, that this PR is superseded by the new request.

Closing this PR as it has been superseded, and the reworked version has been merged.

@aemous aemous closed this Apr 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants