<p>I've deployed a test EKS cluster with the appropiate configMap, and users that are SSO'd in can access the clusters via exporting session creds <em>(AWS_ACCESS_KEY_ID, SECRET_ACCESS_KEY_ID, AWS_SESSION_TOKEN etc)</em> and having the aws-iam-authenticator client installed in their terminal. The problem comes in when users attempt to use an <code>aws sso</code> profile stored in <code>~/.aws/config</code> using the aws-iam-authenticator. The error that's recieved when running any <code>kubectl</code> command is the following:    </p>

<pre><code> $ kubectl get all
    could not get token: NoCredentialProviders: no valid providers in chain. Deprecated.
        For verbose messaging see aws.Config.CredentialsChainVerboseErrors
</code></pre>

<p>I've tested this on my local machine (AWS CLI v2) and I haven't had any success. I've exported an AWS profile found in the <code>~/.aws/config</code> file via <code>export AWS_PROFILE=User1</code> and running <code>aws sts get-caller-identity</code> correctly shows the profile being exported. I've switched between mulitple named profiles and each one gets the correct identity and permissions, however, when running any <code>kubectl</code> command I get the above error. I've also tried symlinking <code>config</code> -> <code>credentials</code> but no luck. The only way it works is if I export the access_key, secret_key, and session_token to the environment variables. </p>

<p>I suppose I can live with having to paste in the dynamic creds that come from AWS SSO, but my need to solve solutions won't let me give up :(. I was following the thread found in this github <a href="http://%20https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/141" rel="nofollow noreferrer">issue</a> but no luck. The kube config file that I have setup is spec'd to AWS's documentation. </p>

<p>I suspect there may be something off with the <code>aws-iam-authenticator</code> server deployment, but nothing shows in the pod logs. Here's a snippet from the tools github <a href="https://github.com/kubernetes-sigs/aws-iam-authenticator" rel="nofollow noreferrer">page</a>, which I <code>think</code> I followed correctly, but I did skip step 3 for reasons that I forgot: </p>

<blockquote>
  <p>The Kubernetes API integrates with AWS IAM Authenticator for
  Kubernetes using a token authentication webhook. When you run
  aws-iam-authenticator server, it will generate a webhook configuration
  file and save it onto the host filesystem. You'll need to add a single
  additional flag to your API server configuration:</p>
</blockquote>

<p><strong>Kube Config File</strong></p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    server: &lt;endpoint-url&gt;
    certificate-authority-data: &lt;base64-encoded-ca-cert&gt;
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: aws
  name: aws
current-context: aws
kind: Config
preferences: {}
users:
- name: aws
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws-iam-authenticator
      args:
        - "token"
        - "-i"
        - "eks-cluster-name"
        - "-r"
        - "EKS-ADMIN-ROLE:ARN:::::::"
      env:
        - name: AWS_PROFILE
          value: "USER"
</code></pre>

RomeNYRR
<p>The AWS CLI v2 now <a href="https://aws.amazon.com/blogs/developer/aws-cli-v2-now-supports-aws-single-sign-on/" rel="nofollow noreferrer">supports</a> AWS SSO so I decided to update my Kube config file to leverage the <code>aws</code> command instead of <code>aws-iam-authenticator</code>. Authentication via SSO is now a breeze! It looks like AWS wanted to get away from having to have an additional binary to be able to authenticate in to EKS clusters which is fine by me! Hope this helps. </p>
