Registry / aws / eks-token

eks-token

JSON →
library0.3.0pypypi✓ verified 86d ago

eks-token is a Python library that provides an alternative to the `aws eks get-token` CLI command, allowing programmatic generation of authentication tokens for Amazon EKS clusters. It is currently at version 0.3.0 and is actively maintained, with releases typically tied to feature enhancements or dependency updates.

pip install eks-token
INSTALL
IMPORT
SIG · EKS-TOKEN
E
eks-token
awspythonv0.3.0
Install
5.5s avg
Import
1184ms
Disk
86MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v0.3.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.920 runs
installs and imports cleanly · install 0.0s · import 1.204s · 86.4MB
glibc
py 3.103.920 runs
installs and imports cleanly · install 5.5s · import 1.165s · 88MB
86MB installed
● package 86MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

get_token
from eks_token import get_token

This quickstart demonstrates how to use `eks-token` to retrieve an EKS authentication token. It shows basic usage with a cluster name and illustrates how to extract the actual token string. Ensure your AWS credentials are configured (e.g., via `~/.aws/credentials` or environment variables) and you have the necessary IAM permissions to interact with EKS. The `apiVersion` in the output now reflects `v1beta1` as of `eks-token` v0.2.0.

import os from eks_token import get_token from pprint import pprint # Replace with your EKS cluster name. Can also be set via an environment variable. cluster_name = os.environ.get('EKS_CLUSTER_NAME', 'your-eks-cluster-name') if cluster_name == 'your-eks-cluster-name': print("Please set the EKS_CLUSTER_NAME environment variable or update the 'cluster_name' variable in the script.") else: try: # Get the token for the specified EKS cluster response = get_token(cluster_name=cluster_name) pprint(response) # Extract the token string token = response['status']['token'] print(f"\nExtracted EKS Token: {token[:30]}...{token[-5:]}") # Example of getting token for a specific IAM role (optional) # role_arn = os.environ.get('EKS_ROLE_ARN', 'arn:aws:iam::123456789012:role/YourEKSViewerRole') # if role_arn != 'arn:aws:iam::123456789012:role/YourEKSViewerRole': # token_with_role = get_token(cluster_name=cluster_name, role_arn=role_arn)['status']['token'] # print(f"\nToken with role: {token_with_role[:30]}...{token_with_role[-5:]}") except Exception as e: print(f"An error occurred: {e}") print("Ensure your AWS credentials are configured and you have permissions to describe the EKS cluster.")
Debug
Known issues
breakingThe API version for the generated `ExecCredential` object was updated from `client.authentication.k8s.io/v1alpha1` to `client.authentication.k8s.io/v1beta1`.
fix
Ensure any Kubernetes client code consuming the output of `eks-token` is compatible with `client.authentication.k8s.io/v1beta1`. Most modern Kubernetes client libraries should support this.
affects: >=0.2.0
gotchaThe `eks-token` library relies on properly configured AWS credentials, typically through the `awscli` configuration or environment variables, even though it bypasses direct `aws eks get-token` CLI execution. Without valid credentials, it will fail to obtain a token.
fix
Verify your AWS CLI is installed and configured correctly by running `aws sts get-caller-identity`. Ensure the IAM principal has permissions for `eks:DescribeCluster` and `sts:GetCallerIdentity` for the target EKS cluster.
affects: All versions
gotchaOlder versions of `eks-token` (prior to v0.1.4) had a strict dependency on an exact `awscli` version, which could lead to installation or runtime issues if the user's installed `awscli` did not match.
fix
Upgrade to `eks-token` version 0.1.4 or newer. This version fixed the issue by requiring a minimum AWS CLI version rather than an exact one, improving compatibility.
affects: <0.1.4
Errors
Common errors & fixes
An error occurred: An error occurred (ExpiredTokenException) when calling the GetCallerIdentity operation: The security token included in the request is expired
Your AWS temporary credentials (e.g., from an assumed role or SSO) have expired.
fix
Refresh your AWS credentials. For AWS CLI, you might need to re-authenticate (e.g., `aws sso login` or renew your temporary credentials).
An error occurred: An error occurred (AccessDeniedException) when calling the DescribeCluster operation: User: arn:aws:iam::123456789012:user/your-user is not authorized to perform: eks:DescribeCluster on resource: arn:aws:eks:REGION:123456789012:cluster/your-eks-cluster-name because no identity-based policy allows the eks:DescribeCluster action
The IAM principal (user or role) attempting to get the EKS token does not have the necessary permissions (`eks:DescribeCluster`) for the specified EKS cluster.
fix
Grant `eks:DescribeCluster` permission to the IAM user or role. Additionally, ensure the principal has `sts:GetCallerIdentity` permission.
An error occurred: No credentials found to sign the token.
The Python environment or the underlying `boto3` library cannot find any AWS credentials configured.
fix
Ensure AWS credentials are configured. This can be done by setting environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`), configuring the AWS CLI (`aws configure`), or using an IAM role for EC2 instances/EKS pods.
Upgrade
Version history
0.3.0latest on PyPI · released Jan 3, 2025
Audit
Dependencies
boto3requiredUsed for interacting with AWS services to generate EKS authentication tokens.
awsclioptionalRelies on AWS CLI configuration for credentials, although it replaces direct CLI calls.
Agent activity
11 hits · last 30 days
node
10
Resources
eks-token — pip install eks-token · libregistry