Aws-iam-authenticator: Support credential_process

[thatrevguy]

AWS CLI allows the following configuration for a profile:
https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#sourcing-credentials-from-external-processes

This is perfect for handling SAML auth but it appears aws-iam-authenticator does not know what to do with profiles configured this way.

[matt404]

We're running into this too, would be really great if the authenticator could recognize and use the aws profile correctly, thereby removing a painful extra step.

[nckturner]

The sdks don't support credential_process thus far, as far as I know. It appears that there are issues open and future plans for support, so when that happens we should support it, but I don't think we should implement it outside of the SDK. There are some security concerns, so I can't promise if and when it will be supported.
https://github.com/aws/aws-sdk-go/issues/1834
https://github.com/aws/aws-sdk-go/pull/1874

[lorengordon]

Some new work on this support just dropped, building on the prior PR. Thumbs up or subscribe to the PR if interested:

• https://github.com/aws/aws-sdk-go/pull/2217

[llamahunter]

Support for credential_process was added to the golang aws sdk recently. Please rebuild with the latest library.
https://github.com/aws/aws-sdk-go/blob/60130f3688317259ea1f6d49babbb07838f4e3be/CHANGELOG.md#release-v1160-2018-12-05

[llamahunter]

See pull request #182

[llamahunter]

So, it now works with the above referenced pull request, but aws-iam-authenticator does not cache credentials coming back from SSO, and the SSO process adds significant lag to every invocation.

It appears it is up to the users of credential_process to cache results. For instance, https://github.com/oktadeveloper/okta-aws-cli-assume-role appears to have a wrapper around the awscli that writes the temporary credentials into .aws/credentials until they expire so that they don't need to be fetched each time, drastically speeding up subsequent calls.

[llamahunter]

Hmm... looking further at okta-aws-cli-assume-role, it seems that it has options to save the credentials itself... sometimes. It appears there should be a path to make it work with its credentials_process helper. Will investigate further.

[llamahunter]

I believe this was fixed by https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/182, however there is no caching, see https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/183

[tahoward]

Just tried this out with aws-iam-authenticator v1.12.7 and it appears credential_process is not working?

Config:

- name: arn:aws:eks:us-west-2:<AccountNumber>:cluster/<ClusterName>
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - token
      - -i
      - <ClusterName>
      command: aws-iam-authenticator
      env:
      - name: AWS_PROFILE
        value: <ProfileName>

Throws:

$ kubectl get all
could not get token: NoCredentialProviders: no valid providers in chain. Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors
could not get token: NoCredentialProviders: no valid providers in chain. Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors
could not get token: NoCredentialProviders: no valid providers in chain. Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors

[tahoward]

Don't mind me. Apparently none of your contributions are included in the mentioned version. Works great after local build. Great work!

[nckturner]

Fixed by #182