Repository: aws/aws-cli

Issue:
eks update-config - generates incorrect kube-config - missing aws-iam-authenticator command
Version: aws-cli/1.16.156 Python/2.7.5 Linux/3.10.0-957.12.1.el7.x86_64 botocore/1.12.146
kubectl : 1.12.7
iam-aws-authenticator: 1.12.7


```bash
aws --region eu-west-1 eks update-kubeconfig --name XXXXXX
```

it generates 

```
 apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - eks
      - get-token
      - --cluster-name
      -  XXXXXX
      command: aws ---> it should be aws-iam-authenticator
```

Obviously whatever the attempt with the get-token - it should not break the previous mode
or give me the choice
```
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - token
      - -i
      - xxxxx
      command: aws-iam-authenticator
```
The above makes kubectl invoke the aws cli but results to

```
You must specify a region. You can also configure your region by running "aws configure".
```


Discussion:
Using `aws` instead of `aws-iam-authenticator` is intentional, but authentication failing is definitely not. We pushed some changes in the last release to reduce the number of dependencies required (you should only need the `aws` command). Looking into this now.
I understand I think I spotted a related P.R . Kubectl is invoking the aws cli but it fails ..

```
You must specify a region. You can also configure your region by running "aws configure".
```

Interesting, does this always happen? Or is it intermittent?
Always - it makes sense, since the new config instead of `aws-iam-authenticator` - changes the command to `aws` - then the cli is invoked. 

Either the `aws xxx` command that you expect to be executed is not , or there something with kubectl and this ? 

I am using the latest `kubectl` as fetched from the documents 1.12.7

Also a side note - if and when this command makes it prime time -the documentation needs to be updated: https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html . Because now is still part of the official docs still. So this kind of change I have a feeling should be communicated with an EKS blog post? I do also think is a positive step to eliminate the extra binary - but lots of people (eks users) have wired it now on their local machines, or ci servers etc.. so...

I think this is the P.R: https://github.com/aws/aws-cli/pull/4141
Does setting a region in either `~/.aws/config` or setting the `AWS_REGION` env var make the command kubectl is invoking work?


hmm I need to test it - this and currently I have pivoted back to an older version of awscli that does not break this.

But still I don't think this is a safe assumption - because if you think so we do pass the region on the command : aws --region eu-west-1 

So whatever was the intention - the command is not properly templated on kubectl


Maybe you can force this - when you generate the snippet? 

```
apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - eks
      - get-token
      - --region
     - <region>
      - --cluster-name
      -  XXXXXX
```
I'm encountering this issue as well. In my case the issue is intermittent. I can run a kubectl command multiple times in a row and get different errors/success outcomes. For example, running this command:

```
$ kubectl get roles --namespace kube-system

NAME                                             AGE
extension-apiserver-authentication-reader        14d
system::leader-locking-kube-controller-manager   14d
system::leader-locking-kube-scheduler            14d
system:controller:bootstrap-signer               14d
system:controller:cloud-provider                 14d
system:controller:token-cleaner                  14d
```

gives me the expected output. I can execute the same command again a moment later and get:

```
$ kubectl get roles --namespace kube-system

error: You must be logged in to the server (Unauthorized)
```

Occasionally, I'll get this error as well:

```
$ kubectl get roles --namespace kube-system

error: the server doesn't have a resource type "roles"
```

The profile I used to invoke the `eks update-kubeconfig` command does have a region name specified in the config file. Reverting the awscli worked for me as well to resolve the problem.
I'm experiencing this problem as well. Some of the `kubectl` commands succeed, and some fail with `Unauthorized`. There doesn't seem to be clear pattern on which commands this happens on. Looking at the authenticator logs for EKS reveals that there are "access denied" errors with the message `input token was not properly formatted: illegal base64 data at input byte 1071`.

The old configs using aws-iam-authenticator seem to work still just fine, so that can still be used as a workaround.

Resolving patch:
diff --git a/awscli/customizations/eks/update_kubeconfig.py b/awscli/customizations/eks/update_kubeconfig.py
--- a/awscli/customizations/eks/update_kubeconfig.py
+++ b/awscli/customizations/eks/update_kubeconfig.py
@@ -101,7 +101,7 @@ class UpdateKubeconfigCommand(BasicCommand):
     ]
 
     def _display_entries(self, entries):
-        """ 
+        """
         Display entries in yaml format
 
         :param entries: a list of OrderedDicts to be printed
@@ -248,7 +248,7 @@ def _get_cluster_description(self):
                 client = self._session.create_client("eks")
             else:
                 client = self._session.create_client(
-                    "eks", 
+                    "eks",
                     region_name=self._globals.region,
                     endpoint_url=self._globals.endpoint_url,
                     verify=self._globals.verify_ssl
@@ -287,6 +287,9 @@ def get_user_entry(self):
         Return a user entry generated using
         the previously obtained description.
         """
+
+        region = self._get_cluster_description().get("arn").split(":")[3]
+
         generated_user = OrderedDict([
             ("name", self._get_cluster_description().get("arn", "")),
             ("user", OrderedDict([
@@ -294,10 +297,12 @@ def get_user_entry(self):
                     ("apiVersion", API_VERSION),
                     ("args",
                         [
+                            "--region",
+                            region,
                             "eks",
                             "get-token",
                             "--cluster-name",
-                            self._cluster_name
+                            self._cluster_name,
                         ]),
                     ("command", "aws")
                 ]))


Test patch:
diff --git a/tests/functional/eks/testdata/invalid_string_cluster_entry b/tests/functional/eks/testdata/invalid_string_cluster_entry
--- a/tests/functional/eks/testdata/invalid_string_cluster_entry
+++ b/tests/functional/eks/testdata/invalid_string_cluster_entry
@@ -15,6 +15,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/invalid_string_clusters b/tests/functional/eks/testdata/invalid_string_clusters
--- a/tests/functional/eks/testdata/invalid_string_clusters
+++ b/tests/functional/eks/testdata/invalid_string_clusters
@@ -14,6 +14,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/invalid_string_context_entry b/tests/functional/eks/testdata/invalid_string_context_entry
--- a/tests/functional/eks/testdata/invalid_string_context_entry
+++ b/tests/functional/eks/testdata/invalid_string_context_entry
@@ -15,6 +15,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/invalid_string_contexts b/tests/functional/eks/testdata/invalid_string_contexts
--- a/tests/functional/eks/testdata/invalid_string_contexts
+++ b/tests/functional/eks/testdata/invalid_string_contexts
@@ -14,6 +14,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/output_combined b/tests/functional/eks/testdata/output_combined
--- a/tests/functional/eks/testdata/output_combined
+++ b/tests/functional/eks/testdata/output_combined
@@ -26,6 +26,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
@@ -36,6 +38,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - region
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/output_combined_changed_ordering b/tests/functional/eks/testdata/output_combined_changed_ordering
--- a/tests/functional/eks/testdata/output_combined_changed_ordering
+++ b/tests/functional/eks/testdata/output_combined_changed_ordering
@@ -4,6 +4,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
@@ -14,6 +16,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - region
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/output_single b/tests/functional/eks/testdata/output_single
--- a/tests/functional/eks/testdata/output_single
+++ b/tests/functional/eks/testdata/output_single
@@ -18,6 +18,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - region
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_bad_cluster b/tests/functional/eks/testdata/valid_bad_cluster
--- a/tests/functional/eks/testdata/valid_bad_cluster
+++ b/tests/functional/eks/testdata/valid_bad_cluster
@@ -15,6 +15,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_bad_cluster2 b/tests/functional/eks/testdata/valid_bad_cluster2
--- a/tests/functional/eks/testdata/valid_bad_cluster2
+++ b/tests/functional/eks/testdata/valid_bad_cluster2
@@ -17,6 +17,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_bad_context b/tests/functional/eks/testdata/valid_bad_context
--- a/tests/functional/eks/testdata/valid_bad_context
+++ b/tests/functional/eks/testdata/valid_bad_context
@@ -15,6 +15,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_bad_context2 b/tests/functional/eks/testdata/valid_bad_context2
--- a/tests/functional/eks/testdata/valid_bad_context2
+++ b/tests/functional/eks/testdata/valid_bad_context2
@@ -17,6 +17,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_bad_user b/tests/functional/eks/testdata/valid_bad_user
--- a/tests/functional/eks/testdata/valid_bad_user
+++ b/tests/functional/eks/testdata/valid_bad_user
@@ -17,6 +17,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_changed_ordering b/tests/functional/eks/testdata/valid_changed_ordering
--- a/tests/functional/eks/testdata/valid_changed_ordering
+++ b/tests/functional/eks/testdata/valid_changed_ordering
@@ -4,6 +4,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_existing b/tests/functional/eks/testdata/valid_existing
--- a/tests/functional/eks/testdata/valid_existing
+++ b/tests/functional/eks/testdata/valid_existing
@@ -18,6 +18,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_no_cluster b/tests/functional/eks/testdata/valid_no_cluster
--- a/tests/functional/eks/testdata/valid_no_cluster
+++ b/tests/functional/eks/testdata/valid_no_cluster
@@ -13,6 +13,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_no_context b/tests/functional/eks/testdata/valid_no_context
--- a/tests/functional/eks/testdata/valid_no_context
+++ b/tests/functional/eks/testdata/valid_no_context
@@ -13,6 +13,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_no_current_context b/tests/functional/eks/testdata/valid_no_current_context
--- a/tests/functional/eks/testdata/valid_no_current_context
+++ b/tests/functional/eks/testdata/valid_no_current_context
@@ -17,6 +17,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/functional/eks/testdata/valid_old_data b/tests/functional/eks/testdata/valid_old_data
--- a/tests/functional/eks/testdata/valid_old_data
+++ b/tests/functional/eks/testdata/valid_old_data
@@ -26,6 +26,8 @@ users:
     exec:
       apiVersion: client.authentication.k8s.io/v1alpha1
       args:
+      - --region
+      - us-west-2
       - eks
       - get-token
       - --cluster-name
diff --git a/tests/unit/customizations/eks/test_update_kubeconfig.py b/tests/unit/customizations/eks/test_update_kubeconfig.py
--- a/tests/unit/customizations/eks/test_update_kubeconfig.py
+++ b/tests/unit/customizations/eks/test_update_kubeconfig.py
@@ -174,6 +174,8 @@ def setUp(self):
                     ("apiVersion", API_VERSION),
                     ("args",
                         [
+                            "--region",
+                            "region",
                             "eks",
                             "get-token",
                             "--cluster-name",