aws eks get-token

aws eks get-token get a token for authentication with an Amazon EKS cluster. This can be used as an alternative to the aws-iam-authenticator.

Examples

• aws eks get-token --cluster-name
• TOKEN=$(aws eks get-token --cluster-name)

aws eks get-token --cluster-name  your-cluster-name.eu-central-1.eksctl.io
{"kind": "ExecCredential", "apiVersion": "client.authentication.k8s.io/v1beta1", "spec": {}, "status": {"expirationTimestamp": "2022-07-28T14:31:47Z", "token": "k8s-aws-v1.aHR0cHM6Ly9zdHMuZXUtY2VudHJhbC0xLmFtYXpvbmLVNpZ25lZEhlYWRlcnM9aG9zdCUzQngtazhzLWF3cy1pZCZYLUFtei1TaWduYXR1cmU9OGU3OWNmMGI4ZTMzMjQxMzk4OGRlZjViYWNhZGEyMDNkYjE5NzM0ZjBiZGYwMjEwMjRlYTRkYjMzMGExMTZiYw"}}

Terraform

 provider "kubernetes" {
  host                   = var.cluster_endpoint
  cluster_ca_certificate = base64decode(var.cluster_ca_cert)
  exec {
    api_version = "client.authentication.k8s.io/v1alpha1"
    args        = ["eks", "get-token", "--cluster-name", var.cluster_name]
    command     = "aws"
  }
}

Related

• aws eks list-clusters
• aws eks update-kubeconfig --name
• ~/.kube/config, args:, exec:
• aws sts get-caller-identity
• aws sts get-session-token
• EKS Cluster authentication
• read -r -d
• kind: Config
• Token

Errors

• error: You must be logged in to the server (Unauthorized)
• Error when retrieving token from sso: Token has expired and refresh failed

See also

• aws eks get-token, aws eks update-kubeconfig
• EKS RBAC, Amazon EKS authentication, Amazon EKS authorization, aws eks get-token, aws-auth ConfigMap, aws-iam-authenticator, eksctl create iamidentitymapping, eksctl get iamidentitymapping, eks:AccessKubernetesApi, eks-connector, K8s Cluster roles, AmazonEKSAdminPolicy, AmazonEKSClusterAdminPolicy
• AWS EKS:AWS::EKS, aws eks [ create-cluster | list-clusters | describe-cluster | update-kubeconfig | list-updates | list-addons | update-cluster-version | update-nodegroup-version | get-token | create-addon ]

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/get-token.html