aws eks get-token regresses providing token expiration

[tbarrella]

With

aws-iam-authenticator token -i <cluster>

the output includes an "expirationTimestamp" key in the token "status", but with

aws eks get-token --cluster-name <cluster>

that field is missing. As a result, aws-cli >1.16.154 undoes kubernetes-sigs/aws-iam-authenticator#160, which is necessary to prevent issues when using files from update-kubeconfig with Go clients for >15 minutes. Would it be hard to restore "expirationTimestamp"?

[sgundapu]

@tbarrella is this what you are seeing?
kubernetes-sigs/aws-iam-authenticator#133 (comment)

Is your application failing because of client-go is caching the token?
It makes sense for us to add the expirationTimestamp along with the token, since client side code is using that to refresh the token. I will look into adding that back.

[tbarrella]

Yeah, with the same application I'd also observed what that comment describes using aws-iam-authenticator until switching from v0.3.0 to v0.4.0. Thank you!

[justnance]

@tbarrella and @sgundapu - Thank you for posting this issue. It appears the CLI does not have control over the resolution of this issue and it is being addressed under issue #133 under the kubernetes-sigs/aws-iam-authenticator repo.

[tbarrella]

Sorry, I'm confused because issue 133 had already been closed and was addressed (with the fix released in aws-iam-authenticator v0.4.0) before aws-cli 1.16.155 was released. To maybe clarify or restate, another way to put the issue is that

aws eks update-kubeconfig

provides a kubeconfig with an exec command that no longer provides an expiration timestamp with its tokens as it did before 1.16.155. Since 133 is already closed, is there another open issue for fixing this behavior of awscli?

[sgundapu]

@justnance there is some work on our end in the CLI to add "expirationTimestamp", I will close the issue once that is pushed out into the CLI and verified.

[justnance]

@tbarrella - We are still working on getting this resolved. Thanks for your patience.

[justnance]

Related PR #4141 has been merged but pending release.

[sgundapu]

@tbarrella fix has been deployed. You will see the expiration timestamp once you start using the updated aws-cli. Thanks!

[tbarrella]

Cool, we see it working in 1.16.191! Thank you for releasing this! Will close this

[danyalg]

Hey, aws eks get-token --cluster-name => I still received expired token (2 hours behind my timezone ) , I am using latest aws cli and configure according aws documentation any idea?

[japzio]

also observed that aws eks get-token --cluster-name still generates token even if local credentials(access/secret keys) has already been expired, and as expected that the token is invalid when logging in to k8s dashboard. not a major issue seem to be confusing sometimes.