>>> Replaced by https://github.com/catalinpan/km <<<
Km is a thin wrapper for kubectl which helps with the EKS kubeconfig management. Any other command will be proxied to kubectl so km command can be used in the same way as kubectl.
Check km -h for all the available options.
Tested with EKS access via iam assume role with/without MFA enabled.
- the clusters secured with MFA will need to be re-added using the
--mfa-profileflag (check the examples below). This change will allow the management of the clusters without MFA including non AWS EKS cluster.
- aws-iam-authenticator (eks clusters only)
- jq
- awscli >= 1.16 (configured like on the example, eks clusters only)
- kubectl >= 1.15
- yubikey, ykman (optional)
- gnu-sed, gnu-grep (MacOS)
- fzf
brew install fzf brew install grep brew install gnu-sed curl -L https://raw.githubusercontent.com/cststack/km/master/bin/km -o /usr/local/bin/km chmod +x /usr/local/bin/km - multiple EKS clusters can be configured. If they have the same name they can be assigned aliases.
- context change for the cluster and the namespace (fzf is required for this)
- run any kubectl commands via km
- if ykman is installed and the Yubikey is plugged there is no need to input the MFA token at all. Make sure the
--mfa-profilematches the profile used for authentication in ykman.
With iam-role resolved from ~/.aws/credentials from the aws_profile
km add --region eu-west-1 --profile aws_profile --cluster-name aws-eks-eu-west-1 --cluster-alias eks-dev With iam-role
km add --region eu-west-1 --profile aws_profile --cluster-name aws-eks-eu-west-1 --cluster-alias eks-dev --iam-role arn:aws:iam::111111111111:role/EksRole With iam-role resolved from ~/.aws/credentials from the aws_profile and MFA
km add --region eu-west-1 --profile aws_profile --cluster-name aws-eks-eu-west-1 --cluster-alias eks-dev --mfa-profile mfaProfileName/myAwsSsoProfile With iam-role and MFA
km add --region eu-west-1 --profile aws_profile --cluster-name aws-eks-eu-west-1 --cluster-alias eks-dev --iam-role arn:aws:iam::111111111111:role/EksRole --mfa-profile mfaProfileName/myAwsSsoProfile Import a KUBECONFIG file.
km --import-kubeconfig pathToKubeConfigFile The usual kubectl commands should be used to clear any cluster config from kubeconfig.
[default] region = eu-west-1 aws_access_key_id = xxxxxxxxxxxxxxxx aws_secret_access_key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx mfa_serial = arn:aws:iam::000000000000:mfa/AWS_USERNAME [aws_profile] role_arn = arn:aws:iam::111111111111:role/EksRole region = eu-west-1 source_profile = default mfa_serial = arn:aws:iam::000000000000:mfa/AWS_USERNAME or
[myAwsSsoProfile] region = eu-west-1 aws_access_key_id = xxxxxxxxxxxxxxxx aws_secret_access_key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx mfa_serial = arn:aws:iam::000000000000:mfa/AWS_USERNAME [aws_profile] role_arn = arn:aws:iam::111111111111:role/EksRole region = eu-west-1 source_profile = myAwsSsoProfile mfa_serial = arn:aws:iam::000000000000:mfa/AWS_USERNAME