Lens: add profile support

[snowmoonsoftware]

What would you like to be added:
When adding a cluster, prompt for which aws profile to use

Why is this needed:
I have multiple environments and to prevent errors I explicitly do not have a default profile

Environment you are Lens application on:
EKS

• Kubernetes distribution: [EKS, AKS, GKE, Rancher, ...]
• Desktop OS:
  MacOS

[jakolehm]

AWS_PROFILE can be defined in EKS kubeconfig (as env), see https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html.

[o6uoq]

I have not found a way to use Lens to use multiple AWS profiles and/or multiple EKS clusters, no way to use the app/product as I cannot connect to an AWS based EKS cluster as yet which is not default.

[ozkologlu]

Even with AWS_PROFILE evn var set in kubeconfig still getting an error connecting to EKS (connection works fine in a terminal)

Connecting ...
Authentication proxy started
could not get token: NoCredentialProviders: no valid providers in chain. Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors
2020/04/03 08:35:49 http: proxy error: getting credentials: exec: exit status 1

[Nuru]

I have Lens working with multiple clusters each requiring a different IAM role. It is definitely able to be done.

I believe the appropriate requirement for Lens is to work when kubectl works and present an error when it does not. It is asking too much for Lens to extend beyond the capabilities of kubectl.

The additional challenge with Lens is that it launches as a separate process, and therefore does not have access to your environment variables. If you need AWS authentication, you must configure your authentication in a way that aws CLI can obtain credentials without reference to your environment variables.

@snowmoonsoftware you do not need to specify a default AWS profile. You do, however, need to set up your kubeconfig and the rest of your environment to allow kubecfg to work on the command line without environment variables.

As @jakolehm pointed out, you can write your kubeconfig to specify an aws CLI command to run. This kubeconfig does not have to be the one you use for anything but Lens, you can write/paste it into Lens as a custom kubeconfig, and it can specify the AWS PROFILE to use and any other enviornment variable values you want to set, including AWS_CONFIG_FILE. The aws CLI can get credentials from a variety of sources besides environment variables, including files like ~/.aws/config, ~/.aws/credentials, and ~/.aws/cli/cache/* or via the AWS metadata server.

There are a number of open source tools to help you do this securely, too many to list. The whole arena of security and authentication is large and complex, and I do not think it fair to ask Lens to weigh into it. I am in favor of avoiding feature and scope creep and drawing the line at Lens requiring you to supply a kubeconfig that works on your machine, the way you have your machine set up, in the environment you have Lens running.

@ozkologlu after you configure your kubeconfig to use an AWS_PROFILE, you need to configure the profile in your ~/.aws/config to get credentials from somewhere other than environment variables, as I explained above.