EKS update-config should support naming the user with the passed in alias

[elijah-roberts]

Is your feature request related to a problem? Please describe.
I have multiple aws role to k8s role mappings per cluster. The eks update-config command supports setting the AWS_PROFILE variable under the user config if you pass in --profile. However, it defaults the username to the cluster arn, so if I do this with multiple roles it gets overwritten

Describe the solution you'd like
There is already precedent for overriding the context name by passing an --alias. If I run the following:
aws eks update-kubeconfig --name <clustername> --alias prod-admin --profile prod-admin-role

AND

aws eks update-kubeconfig --name <clustername> --alias prod-support --profile prod-support-role

I would like for the following config to be created:

- context:
    cluster: arn:aws:eks:us-west-2:redacted:cluster/prod-cluster
    user: prod-admin
  name: prod-admin
- context:
    cluster: arn:aws:eks:us-west-2:redacted:cluster/prod-cluster
    user: prod-support
  name: prod-support
kind: Config
preferences: {}
users:
- name: prod-admin
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - us-west-2
      - eks
      - get-token
      - --cluster-name
      - prod-cluster
      command: aws
      env:
      - name: AWS_PROFILE
        value: prod-admin-role
- name: prod-support
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - us-west-2
      - eks
      - get-token
      - --cluster-name
      - prod-cluster
      command: aws
      env:
      - name: AWS_PROFILE
        value: prod-support-role

This will allow me to simply run a command to loop through all my roles, list eks-clusters, and define contexts for each cluster and role.

Describe alternatives you've considered
I could create a separate utility to do this, but honestly even forking this repo and making the small change would be easier.

Additional context

I have this working locally, and it is a 2 line change to match existing functionality with context naming.

[elijah-roberts]

Here is an example loop command for setting up your kube config:

for profile in $(cat ~/.aws/credentials | grep '\[' | column -t -s '[]');
 do for cluster in $(aws eks list-clusters --profile $profile --output text | awk '{ print $2 }'); 
do aws eks update-kubeconfig --name $cluster --profile $profile --alias $(<add sed/awk logic here for parsing cluster and profile names to create alias>) 
;done 
; done

[elijah-roberts]

@kyleknap @vz10 FYI, not sure who needs to review this, it does not give me an option to assign.

Let me know if you need anything else from me.

Edit:

Realized I forgot the pr link #5165

[kdaily]

Hi @elijah-roberts, notifying the maintainer of this feature for a review. I can't provide an ETA, but will let you know when I hear back.

[nckturner]

@elijah-roberts Can you explain what you mean "There is already precedent for overriding the context name by passing an --alias."? Overall I think this makes a lot of sense.

[nckturner]

Nvm, I understand now. See the PR for my comments that perhaps we should use a --user flag to avoid changing current behavior.

[elijah-roberts]

@nckturner that is totally fair.. just added a user-alias flag, and updated tests.

[potto007]

I just ran into this while working on having two different role configurations for the same EKS cluster... When trying --alias I had expected that the cluster name, context name, and user name would all be assigned the alias... as it's presently implemented, the behavior seems more like a bug than a feature... consider:

I add cluster with k8sDev role to kubeconfig:

aws eks update-kubeconfig --profile <my-sso-profile> --name <my-eks-cluster> --alias test-dev --role-arn 'arn:aws:iam::<myaccountid>:role/k8sDev'
cat ~/.kube/config

####    ~/.kube/config contents    ###
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: [REDACTED]
    server: [REDACTED]
  name: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
contexts:
- context:
    cluster: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
    user: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
  name: test-dev
current-context: test-dev
kind: Config
preferences: {}
users:
- name: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - <myregion>
      - eks
      - get-token
      - --cluster-name
      - <clustername>
      - --role
      - arn:aws:iam::<myaccountid>:role/k8sDev
      command: aws
      env:
      - name: AWS_PROFILE
        value: <my-sso-profile>

####   

Now, I add cluster with k8sAdmin role to kubeconfig:

aws eks update-kubeconfig --profile <my-sso-profile> --name <my-eks-cluster> --alias test-admin --role-arn 'arn:aws:iam::<myaccountid>:role/k8sAdmin'
cat ~/.kube/config

####    ~/.kube/config contents    ###
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: [REDACTED]
    server: [REDACTED]
  name: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
contexts:
- context:
    cluster: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
    user: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
  name: test-admin
current-context: test-admin
kind: Config
preferences: {}
users:
- name: arn:aws:eks:<myregion>:<myaccountid>:cluster/<clustername>
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - <myregion>
      - eks
      - get-token
      - --cluster-name
      - <clustername>
      - --role
      - arn:aws:iam::<myaccountid>:role/k8sAdmin
      command: aws
      env:
      - name: AWS_PROFILE
        value: <my-sso-profile>

####   

What I expected to see in my kubeconfig, which I'm presently doing manually:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: [REDACTED]
    server: [REDACTED]
  name: test-admin
- cluster:
    certificate-authority-data: [REDACTED]
    server: [REDACTED]
  name: test-dev
contexts:
- context:
    cluster: test-admin
    user: test-admin
  name: test-admin
- context:
    cluster: test-dev
    user: test-dev
  name: test-dev
current-context: test-dev
kind: Config
preferences: {}
users:
- name: test-admin
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - <myregion>
      - eks
      - get-token
      - --cluster-name
      - <clustername>
      - --role
      - arn:aws:iam::<myaccountid>:role/k8sAdmin
      command: aws
      env:
      - name: AWS_PROFILE
        value: <my-sso-profile>
- name: test-dev
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - <myregion>
      - eks
      - get-token
      - --cluster-name
      - <clustername>
      - --role
      - arn:aws:iam::<myaccountid>:role/k8sDev
      command: aws
      env:
      - name: AWS_PROFILE
        value: <my-sso-profile>

####   

[joshdk]

👋🏻 Hello folks. Just ran into this edge-case while trying to configure multiple kubectl contexts for the same cluster, backed by different aws profiles.

Having existing kubeconfig users be overridden was unexpected, and requires manual kubeconfig surgery to properly undo and re-configure.

Having either a --user flag to name the underlying context user, or naming the user based off of the --profile/AWS_PROFILE by default would be very desirable.

Thank you!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.