Hi I am using pulumi/eks to create a cluster and n...
# general
s
Hi I am using pulumi/eks to create a cluster and nodegroup. We use aws sso to switch between profiles. We logged with sso to the corresponding account and fetched our credentials. We then set the profile using
export AWS_PROFILE=XXXX
to set our profile. When we run pulumi up we are getting an error.
Copy code
Error: It looks like you're using AWS profiles. Please specify this profile in providerCredentialOpts
I think this issue only happens when using crossrails EKS and not aws-classic(could be wrong here). I know there is a profile key in providerCredentialOpts I can add, but we can't ensure everyone who uses pulumi uses the same naming for their aws profiles. Am I missing something here?
b
@stocky-petabyte-29883 the provider/generated kubeconfig that is created uses aws profiles if you're using profiles as the auth mechanism. you can see that by outputting the kubeconfig generated, it ends up looking a bit like this:
Copy code
{
  "apiVersion": "v1",
  "clusters": [
    {
      "cluster": {
        "certificate-authority-data": "<redacted>",
        "server": "<redacted>"
      },
      "name": "kubernetes"
    }
  ],
  "contexts": [
    {
      "context": {
        "cluster": "kubernetes",
        "user": "aws"
      },
      "name": "aws"
    }
  ],
  "current-context": "aws",
  "kind": "Config",
  "users": [
    {
      "name": "aws",
      "user": {
        "exec": {
          "apiVersion": "<http://client.authentication.k8s.io/v1alpha1|client.authentication.k8s.io/v1alpha1>",
          "args": [
            "eks",
            "get-token",
            "--cluster-name",
            "lbriggs-eks-example-eksCluster-a60dd34"
          ],
          "command": "aws",
          "env": [
            {
              "name": "AWS_PROFILE",
              "value": "pulumi-dev-sandbox"
            }
          ]
        }
      }
    }
  ]
}
if you don't want the generated kubeconfig to use aws profiles, you can do the following: • auth with SSO • generate temporary credentials using sts (handy go binary to help you here: https://github.com/jaxxstorm/aws-sso-creds) • unset
AWS_PROFILE
👍 1