Failed to connect using aws command

[juampa]

Platform

macOS

What happened?

I connect to my cluster using this user:

• name: dev
  user:
  exec:
  apiVersion: client.authentication.k8s.io/v1beta1
  command: aws
  args: ["eks", "get-token", "--cluster-name", "kubernetes", "--profile", "dev"]

But in Kubeterm I get this error:

In k9s app or native kubectl no issues:

❯ kubectl --context dev get nodes
NAME STATUS ROLES AGE VERSION
fargate-....eu-south-2.compute.internal Ready 3d19h v1.32.8-eks-e386d34
ip-10-4....eu-south-2.compute.internal Ready 9d v1.32.8-eks-e386d34
ip-10-4....eu-south-2.compute.internal Ready 47h v1.32.8-eks-e386d34

App version

1.6.5

Cloud provider

AWS

[daimg]

Thanks for reporting this issue.

Do you download kubeterm binary from GitHub release? (Version downloaded from AppStore can't exec external auth plugin because of apple app sandbox).

If so, could you please run following command in terminal to check if path of aws is included?
env -i HOME="$HOME" PATH="/usr/bin:/bin:/usr/sbin:/sbin" "${SHELL:-/bin/zsh}" -ilc 'echo $PATH'

[juampa]

Oh, that’s the reason. I downloaded the app from the App Store. I have other apps like Tailscale downloaded from the store that use Gmail authentication without any issues. Is this something that could be fixed in the future?

[daimg]

It seems that there is no solution for a sandboxed app from AppStore to break Apple app sandbox to execute a command outside of the app's sandbox currently.
In this case, kubeterm need to exec aws in the local machine, which is not within kubeterm's app sandbox.
Currently I don't found a solution for this frankly.

The Gmail auth may be different, it just run google oauth flow. Actually kubeterm also support google auth when loading cluster from GCP.