Why is there an aws command embedded in the EKS kube config file?

July 22, 2022

I’m curious about something in the kube config file generated by the aws eks update-kubeconfig command. At the bottom of the file, there is this construct:

- name: arn:aws:eks:us-west-2:redacted:cluster/u62d2e14b31f0270011485fd3
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - --region
      - us-west-2
      - eks
      - get-token
      - --cluster-name
      - u62d2e14b31f0270011485fd3
      command: aws

It is clearly an invocation of the aws eks get-token command. Why is this here? Does this command get automatically called?

>Solution :

Why is this here?

The command gets an IAM token using your IAM account and pass along to EKS via the HTTP header Authorization: Bearer <token> for authentication. See here for details.

Does this command get automatically called?

Yes, by kubectl.