Passing EKS token to other kubectl cli commands

Question

Say I get an EKS token using:

aws eks get-token --region us-west-2 --cluster-name eks1

the result looks like:

{"status": {"token": "k8s-aws-v1.aHR0.....Ni"}, "kind": "ExecCredential", "apiVersion": "client.authentication.k8s.io/v1alpha1", "spec": {}}

how can I pass the token to other cli commands? something like:

kubectl get svc --token="$token-from-above"

without the token, I keep getting this error:

error: You must be logged in to the server (Unauthorized)

but my AWS creds are present, which is why I can get the token. I assume it's the same token as generated by aws-iam-authenticator token -i eks1

I tried running this:

export AWS_SESSION_TOKEN="$token-from-above"
kubectl get svc

that did not work either, same error.

obvious I extracted the token from the JSON before using it, that part is correct, I double checked — , May 20 '19 at 20:06
it's possible that the aws token doesn't work with the `kubectl` commands just the `aws` commands? — , May 20 '19 at 20:29
Is there any update on this issue? I am facing the same situation. — allenwang, Sep 04 '22 at 03:46

bilby91 · Answer 1 · 2019-05-21T01:05:09.607

3

Make sure that you don't have any of this env variables configured:

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY

Most (if not all) of the aws tools will honor those configurations over anything else. I've been fooled by this when trying to use AWS_PROFILE for example.

edited May 21 '19 at 01:05

answered May 20 '19 at 20:54

bilby91

904
1
8
20

just curious why would that be? – May 20 '19 at 21:57
@MrCholo Just updated the answer with some extra information. Hope that makes sense. – bilby91 May 21 '19 at 01:05

score 3 · Answer 2 · answered May 20 '19 at 23:11

@MrCholo, have you made sure to configure your KUBECONFIG to use the exec credential flow? With EKS and/or the authenticator you don't need to generate the token and then inject it into each request kubectl has a way of exec'ing the binary for you. We've baked all this into the update-kubeconfig cli command which you can see https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html#eks-configure-kubectl

But what it will look like is something like this:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: XXX
    server: XXX
  name: XXX
contexts:
- context:
    cluster: XXX
    user: XXX
  name: XXX
current-context: XXX
kind: Config
preferences: {}
users:
- name: XXX
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - eks
      - get-token
      - --region us-west-2 
      - --cluster-name eks1
      command: aws
      env: null

You'll need to make sure you have at least the 1.10+ kubectl client version which you can check by using kubectl version --client --short.

Other things to note, this token isn't an AWS IAM token, it's a generated and signed URL which the API server uses to validate who the user is. The underlaying request is actually aws sts get-caller-identity but we don't complete the request, we mearly sign the URL then base64 encode it and encapsulate it in JSON to submit to the api server. Once it gets passed into the api server the token is sent to the authenticator web server in the control plane which decodes then "completes" the STS call to return who you are which it then uses to validate if you are in the white list of users.

Hopefully that helps.

Passing EKS token to other kubectl cli commands

2 Answers2