Skip to content

Add assume-role-arn option to update-kubeconfig command for cross-account access #9443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: develop
Choose a base branch
from

Conversation

sdomme
Copy link

@sdomme sdomme commented Apr 15, 2025

Issue #, if available: #8554

This PR supersedes #9364

Description of changes:

This change introduces support for assuming an IAM role when retrieving cluster information in the update-kubeconfig command. By specifying the --assume-role-arn argument, users can assume a cross-account IAM role to access cluster details. The implementation updates the EKSClient to handle role assumption using the AWS STS service and injects the temporary credentials into the EKS client configuration. This enhancement improves cross-account compatibility and simplifies cluster management in multi-account environments.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…ount access

This update improves the `update-kubeconfig` functionality by adding:
* Support for assuming an IAM role when retrieving cluster details.

These changes ensure better compatibility with cross-account access
@aemous
Copy link
Contributor

aemous commented Apr 17, 2025

@sdomme Can you please run ./scripts/new-change and commit a new changelog entry using the configuration below before we merge it?

{
  "type": "feature",
  "category": "``eks``",
  "description": "Add assume-role-arn option to update-kubeconfig command for cross-account access"
}

The resulting file should be identical to this one.

@sdomme
Copy link
Author

sdomme commented Apr 17, 2025

@aemous Does the name of the files also need to be identical? Because I got one generated with a different name.

@aemous
Copy link
Contributor

aemous commented Apr 17, 2025

@aemous Does the name of the files also need to be identical? Because I got one generated with a different name.

The file names can be different

@AndrewAsseily
Copy link
Contributor

AndrewAsseily commented Apr 18, 2025

Hi @sdomme,

  1. Could you update the parameter description as you see fit or verify that no changes to the description are necessary: https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html
    (Note that our docs generation will automatically handle the Options section documentation.)
  2. Would you consider adding an example of the new argument to our update-kubeconfig examples? While not required, it would be a valuable addition for customers. If you do add an example, please ensure it follows our example style guide.

EDIT: Approving this PR otherwise.

@codecov-commenter
Copy link

codecov-commenter commented Apr 21, 2025

Codecov Report

Attention: Patch coverage is 94.44444% with 1 line in your changes missing coverage. Please review.

Project coverage is 93.39%. Comparing base (5f07db1) to head (b54856e).
Report is 78 commits behind head on develop.

Files with missing lines Patch % Lines
awscli/customizations/eks/update_kubeconfig.py 94.44% 1 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff            @@
##           develop    #9443   +/-   ##
========================================
  Coverage    93.39%   93.39%           
========================================
  Files          210      210           
  Lines        16983    16993   +10     
========================================
+ Hits         15861    15871   +10     
  Misses        1122     1122           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@AndrewAsseily AndrewAsseily self-requested a review April 21, 2025 17:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants