a related question: is it possible to use pulumi to assume an IAM role just for the scope of some specific EKS and k8s commands? I could use

aws sts assume-role

before running pulumi up, but then the pulumi user will inhabit that role for every command. I want to use a specific IAM role just for the scope of some specific k8s commands. I can create an

aws.Provider

to assume a specific role and use that provider for the scope of

aws

commands (eg.

aws.s3.Bucket(... { provider: customProvider })

. However, it doesn't look like I can use a

kubernetes.Provider

to assume a specific IAM role for the scope of some

kubernetes

commands

oh interesting. I found the following snippet in a github issue to change the kubeconfig to assume a particular role. https://github.com/pulumi/pulumi-eks/issues/405#issuecomment-652163657. This updated the

aws eks get-token

command in the kubeconfig to add a new

--role <role-arn>

argument. Seems to have worked fine. Will test some more, but it's looking solid.

I'm currently getting the value of the-aws auth configmap and then trying to figure out a way to push it

awsAuthConfigmap.data.apply(v => {
  console.log(YAML.parse(v.mapRoles))
  let roleMappings = YAML.parse(v.mapRoles)
  let roleMapping = {
    rolearn: "TEST",
    username: "TEST",
    groups: "TEST",
}
  roleMappings.push(roleMapping)
  // console.log(roleMappings)
  
})