<p>I want to edit a configmap from <code>aws-auth</code> during a vagrant deployment to give my vagrant user access to the EKS cluster. I need to add a snippet into the existing <code>aws-auth</code> configmap. How do i do this programmatically?</p>

<p>If you do a <code>kubectl edit -n kube-system configmap/aws-auth</code> you get</p>

<pre><code>apiVersion: v1
data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::123:role/nodegroup-abc123
      username: system:node:{{EC2PrivateDNSName}}
kind: ConfigMap
metadata:
  creationTimestamp: "2019-05-30T03:00:18Z"
  name: aws-auth
  namespace: kube-system
  resourceVersion: "19055217"
  selfLink: /api/v1/namespaces/kube-system/configmaps/aws-auth
  uid: 0000-0000-0000
</code></pre>

<p>i need to enter this bit in there somehow.</p>

<pre><code>  mapUsers: |
    - userarn: arn:aws:iam::123:user/sergeant-poopie-pants
      username: sergeant-poopie-pants
      groups:
      - system:masters
</code></pre>

<p>I've tried to do a <code>cat &lt;&lt;EOF &gt; {file} EOF</code> then patch from file. But that option doesn't exist in <code>patch</code> only in the <code>create</code> context.</p>

<p>I also found this: <a href="https://stackoverflow.com/q/54571185/267490">How to patch a ConfigMap in Kubernetes</a></p>

<p>but it didn't seem to work. or perhaps i didn't really understand the proposed solutions.</p>

Eli
<p>First, note that the <code>mapRoles</code> and <code>mapUsers</code> are actually treated as a string, even though it is structured data (yaml).</p>

<p>While this problem is solvable by jsonpatch, it is much easier using <a href="https://stedolan.github.io/jq/" rel="nofollow noreferrer"><code>jq</code></a> and <code>kubectl apply</code> like this:</p>

<pre><code>kubectl get cm aws-auth -o json \
  | jq --arg add "`cat add.yaml`" '.data.mapUsers = $add' \
  | kubectl apply -f -
</code></pre>

<p>Where <code>add.yaml</code> is something like this (notice the lack of extra indentation):</p>

<pre><code>- userarn: arn:aws:iam::123:user/sergeant-poopie-pants
  username: sergeant-poopie-pants
  groups:
  - system:masters
</code></pre>

<p>See also <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html</a> for more information.</p>
