docs: Add EKS kubeconfig authentication integration PRD by Benbentwo · Pull Request #1884 · cloudposse/atmos

Benbentwo · 2025-12-17T20:32:28Z

what

Add comprehensive PRD for EKS kubeconfig authentication integration
Define integration pattern following ECR PR feat: Add ECR authentication #1859
Document configuration schema, AWS SDK usage, and CLI command design
Enhance existing atmos aws eks update-kubeconfig command (not create new atmos auth command)

why

Establishes design before implementation to ensure alignment with ECR integration pattern
Provides reference for implementation of dependent components (EKS integration, kubeconfig manager)
Uses existing atmos aws command namespace to avoid leaking AWS-specific commands into atmos auth
Enables parallel development once ECR PR feat: Add ECR authentication #1859 is merged

references

Relates to: DEV-3815
Depends on: ECR Authentication PR #1859

Summary by CodeRabbit

Documentation
- Added a comprehensive PRD for EKS kubeconfig integration with Atmos authentication, covering architecture and configuration schemas, CLI kubeconfig workflows (integration and explicit cluster modes), multi-cluster support and merge behavior, XDG-compliant kubeconfig storage, AWS integration approach, generated kubeconfig output and environment handling, testing strategy, security considerations, deployment/metrics, and proposed future enhancements.

github-actions · 2025-12-17T20:33:21Z

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

chatgpt-codex-connector

💡 Codex Review

https://github.com/cloudposse/atmos/blob/06d35291f317e8c878175dd5986a59c1c6f7ed28/.#L1
Review blocked by sandbox failures

I could not inspect commit f299290df3dce056df7c5cb7ee23b27cdb0fce89 because every command (e.g., pwd, ls) fails immediately with the sandbox error error running landlock: Sandbox(LandlockRestrict), so the repository contents and diff are inaccessible. Please re-run in an environment where basic shell access works, or retry in Code mode.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codecov · 2025-12-17T20:44:52Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.60%. Comparing base (7091aa6) to head (eed0739).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1884   +/-   ##
=======================================
  Coverage   76.59%   76.60%           
=======================================
  Files         832      832           
  Lines       79524    79524           
=======================================
+ Hits        60914    60917    +3     
+ Misses      14814    14812    -2     
+ Partials     3796     3795    -1

Flag	Coverage Δ
unittests	`76.60% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

coderabbitai · 2025-12-17T20:48:14Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a new PRD specifying EKS kubeconfig generation as an Atmos Integration: defines integration schema and CLI modes, describes AWS SDK v2 usage (DescribeCluster, token via exec/STS), XDG kubeconfig merging, package layout, testing, security, examples, and roadmap.

Changes

Cohort / File(s)	Summary
EKS Kubeconfig PRD `docs/prd/eks-kubeconfig.md`	Adds a new product requirements document describing EKS kubeconfig as an Integration (ECR-style). Introduces types (`EKSCluster`, `KubeconfigSettings`, extended `IntegrationSpec`), AWS SDK v2 usage (`eks:DescribeCluster`, token via exec/STS), XDG-compliant kubeconfig storage and merge rules, CLI modes (`--integration` / `--name`), package layout (EKS SDK wrapper, kubeconfig manager, integration impl, CLI command), error taxonomy, testing plan, security considerations, examples, and roadmap.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    participant User
    participant CLI as Atmos CLI
    participant Integration as EKS Integration
    participant AWS as AWS EKS/STS
    participant KubeMgr as Kubeconfig Manager (XDG)

    Note over CLI,Integration: User runs `atmos auth eks-kubeconfig` (integration or explicit)
    User->>CLI: request update (--integration / --name)
    CLI->>Integration: resolve integration config (EKSCluster, region, role, kubeconfig settings)
    Integration->>AWS: DescribeCluster (eks:DescribeCluster)
    AWS-->>Integration: cluster endpoint, cert, metadata
    Integration->>AWS: fetch token via exec-plugin flow / STS (assume-role / get-token)
    AWS-->>Integration: token / credentials
    Integration->>KubeMgr: generate kubeconfig (contexts, users, exec plugin config)
    KubeMgr->>KubeMgr: merge with existing kubeconfig(s) (XDG + KUBECONFIG)
    KubeMgr-->>CLI: write status / path
    CLI-->>User: operation result (non-blocking for login failures)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

aknysh
milldr

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding a PRD document for EKS kubeconfig authentication integration, which matches the file addition and PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch feature/dev-3815-create-atmos-auth-identity-for-eks-using-aws-go-sdk

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

docs/prd/eks-kubeconfig.md

Added PR links to milestones across all initiatives: Auth Initiative: - EKS Kubeconfig → PR #1884 - ECR Authentication → PR #1859 - GitHub Apps → PR #1683 Developer Experience: - Streaming Terraform UI → PR #1908 - Native CI integration → PR #1891 Workflows: - Unified task execution → PR #1901 - New workflow step types → PR #1899 Extensibility: - Added !unset YAML function → PR #1521 - Added !append YAML function → PR #1513 Vendoring: - Vendor registry pattern → PR #1889 - Just-in-time vendoring → PR #1877 - Component workdir provisioning → PR #1876 Terragrunt Parity: - Multi-stack formats → PR #1842 CI/CD: - CI Summary Templates → PR #1891 - Terraform command registry → PR #1891

* feat: Add comprehensive roadmap page with initiatives and milestones - Add Roadmap component with interactive initiative cards - Create MilestoneList, MilestoneDrawer, and ProgressBar components - Add Tooltip component for PR/issue titles with theme-aware styling - Implement responsive design with flexbox alignment fixes - Add extensive roadmap data with documented milestones across 10 initiatives - Add changelog and docs links to all relevant milestones - Update Docusaurus navbar with Roadmap link 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Address CodeRabbit review comments for roadmap components - Fix type mismatch: use undefined instead of null for selectedMilestone - Make changelogSlugs optional in Initiative interface - Replace fragile status className construction with explicit mapping - Reduce tooltip z-index from 9999 to 1002 (just above drawer) - Add scroll/resize listeners for tooltip position updates - Improve keyboard accessibility with tabIndex, aria-describedby, role="tooltip" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: Update Customizable list output description Focus on custom column views rather than output formats. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: Move Component-aware tab completion to DX initiative Tab completion is more about developer experience than discoverability. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor(roadmap): rename 'Customizable list output' to 'Customizable list columns' Clarifies that this is an improvement to existing list commands (added Q1 2025), not a new feature. The Q4 2025 milestone added customizable column support. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs(roadmap): update initiative names and add new milestones - Rename 'Migration & Code Generation' to 'Feature Parity with Terragrunt' - Rename 'Quality & Community' to 'Code Quality and Community' - Change 'Learning section' to 'New learning section' - Add Native Terraform to migration guides list - Add Roadmap milestone to Documentation initiative 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): correct design patterns docs link Changed /design-patterns/design-patterns to /design-patterns 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): add 'Request a Feature' link to initiatives section Adds a prominent link to GitHub feature request issue template for users who want to suggest new features for the roadmap. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): add 'View Features' link to GitHub issues Adds a link to browse existing feature requests and issues alongside the 'Request a Feature' link. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): rename 'View Features' to 'View Issues' 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor(roadmap): reorganize Feature Parity with Terragrunt initiative Changes to Feature Parity with Terragrunt: - Keep: File-scoped locals - Rename: Stack name field → Imperative stack names - Rename: Generate section inheritance → File generation (generate blocks) - Rename: Backend provisioning → Automatic backend provisioning - Add: AWS context YAML functions (!aws.account-id, !aws.region, etc.) - Remove: Metadata inheritance (merged into other features) Moved to Extensibility & Custom Components: - !literal YAML function - metadata.name for component workspace keys 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): add planned Terragrunt parity features - Automatic source provisioning (no vendoring required) - Concurrent component provisioning - plan --all and apply --all commands - Automatic provider caching 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): update DX milestones - Update parent directory search description to emphasize running from any directory - Add filesystem paths for components feature 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): use neutral blue gradient for progress bars Replace orange/red colors with lighter blues to avoid 'behind schedule' connotation - progress just means 'not as far along yet', not delayed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor(roadmap): reorganize quality and docs initiatives - Rename 'Code Quality and Community' to 'Code Quality and Test Coverage' - Rename 'Documentation Overhaul' to 'Documentation Overhaul and Community Announcements' - Move 'Changelog introduction' from quality to docs initiative - Rename migration guides milestone to 'Added migration guides' 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): add nightly releases and PR feature releases to quality initiative 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): add 'Push for stability' to quality initiative 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): clarify backend provisioning vs backend generation Backend provisioning is about provisioning the backend itself (S3 bucket, DynamoDB table) for cold-start scenarios, not just generating backend.tf files. * fix(roadmap): remove DynamoDB from backend provisioning description DynamoDB locking is no longer needed for S3 state backends. * fix(roadmap): mention native S3 state locking for backend provisioning * feat(roadmap): mark --all flags as shipped, add PR links for planned features - Mark 'plan --all' and 'apply --all' as shipped (Q4 2025) - Add PR #1877 link for automatic source provisioning - Add PR #1882 link for automatic provider caching * feat(roadmap): add comprehensive PR links to milestones Added PR links to milestones across all initiatives: Auth Initiative: - EKS Kubeconfig → PR #1884 - ECR Authentication → PR #1859 - GitHub Apps → PR #1683 Developer Experience: - Streaming Terraform UI → PR #1908 - Native CI integration → PR #1891 Workflows: - Unified task execution → PR #1901 - New workflow step types → PR #1899 Extensibility: - Added !unset YAML function → PR #1521 - Added !append YAML function → PR #1513 Vendoring: - Vendor registry pattern → PR #1889 - Just-in-time vendoring → PR #1877 - Component workdir provisioning → PR #1876 Terragrunt Parity: - Multi-stack formats → PR #1842 CI/CD: - CI Summary Templates → PR #1891 - Terraform command registry → PR #1891 * feat(roadmap): improve milestone labels with descriptive context Update milestone labels to describe what each feature does rather than just listing the command or feature name: - Discoverability: Change "Added `atmos list stacks`" to "`atmos list stacks` to browse all configured stacks" etc. - Auth: Change "EKS Kubeconfig integration" to "Automatic EKS kubeconfig tied to identities" and similar for ECR 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): add Featured Improvements section with 6 key highlights Add a prominent Featured Improvements section near the top of the roadmap page showcasing major capabilities: 1. Dev Container Support - Consistent development environments 2. Toolchain Management - Automatic tool installation and versioning 3. Cloud Authentication - Unified identity layer across clouds 4. Beautiful Workflows - Multi-step automation with typed inputs 5. Source Provisioning - Just-in-time component fetching (in-progress) 6. Native CI/CD Support - Local = CI experience (in-progress) Also fixes: - Provider auto-generation marked as shipped (Q3 2025) - Devcontainer docs link corrected 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): enhance featured section and milestone grouping - Add PRD links to featured items (devcontainer, keyring-backends, provisioner-system, terraform-registry-migration) - Fix statuses: Toolchain Management and Beautiful Workflows changed from shipped to in-progress - Update quarters: Native CI/CD, Toolchain, Workflows, and Source Provisioning set to Q1 2026 - Add sorting by status (shipped first) and quarter (earlier first) - Implement milestone grouping with categories (Featured Improvements, Everything Else) and priorities (high, nice-to-have) - Add PR links for Toolchain Management (#1686) and Beautiful Workflows (#1899) - Update Cloud Authentication description with "Zero local config required" - Rename "Initiatives" section to "Major Initiatives" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(roadmap): add benefits field, clickable featured cards, and overall progress stats - Add benefits field to all 89 milestones explaining "Why It Matters" - Add benefits to 6 featured items with benefit-focused explanations - Create FeaturedDrawer component for featured card detail view - Make featured cards clickable with drawer showing description/benefits - Create RoadmapStats component showing overall progress (shipped/in-progress/planned) - Add animated progress bar with color-coded segments - Expand changelog-check.yml to also require roadmap.js updates for minor/major PRs - Update CLAUDE.md with roadmap update requirements 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): simplify drawer links to reduce visual noise Remove heavy background colors from drawer link buttons and convert them to simple inline text links that wrap horizontally. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): use plain colors for drawer links, one per line - Change links to use neutral emphasis colors instead of brand colors - Display each link on its own line for cleaner vertical layout 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style(roadmap): use brightening instead of underline for drawer link hover Change drawer link hover behavior to brighten text color instead of adding underline for cleaner visual feedback. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs(roadmap): add CI/local parity to cloud auth benefits Highlight that cloud authentication works identically in CI and locally, a key differentiator for the unified auth system. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style(roadmap): increase gap between progress bar and Major Initiatives Add more breathing room between the Overall Progress section and the Major Initiatives heading below it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style(roadmap): double gap between progress bar and Major Initiatives Increase bottom margin from 3rem to 6rem for more visual separation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs(roadmap): mark Terragrunt parity milestones as featured Mark all major Terragrunt feature parity milestones as featured: - File-scoped locals - Imperative stack names - File generation (generate blocks) - Automatic backend provisioning - AWS context YAML functions - Multi-stack formats (YAML, JSON and HCL) - Automatic provider caching - Automatic source provisioning - Provider auto-generation - Concurrent component provisioning Also link PR #1876 (workdir provisioning) to concurrent component provisioning milestone. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): address CodeRabbit review feedback - Add target="_blank" and rel="noopener noreferrer" to external GitHub links in FeaturedSection.tsx (PRD and PR links) - Add target="_blank" and rel="noopener noreferrer" to external GitHub links in InitiativeCard.tsx (issues and PRs) - Add target="_blank" and rel="noopener noreferrer" to external GitHub links in FeaturedDrawer.tsx (PRD and PR links) - Guard against division by zero in RoadmapStats.tsx progress bar width calculations 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs(blog): introduce the Atmos product roadmap Add a blog post announcing the new public product roadmap page, highlighting: - Featured improvements like Dev Containers, Cloud Auth, and Workflows - Major initiatives including Terragrunt parity and documentation overhaul - Overall progress tracking across all milestones - How to get involved and provide feedback 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs(roadmap): reconcile changelog announcements with roadmap Add missing changelog links to existing milestones: - workflow-file-auto-discovery - automatic-backend-provisioning - path-based-component-resolution - aws-yaml-functions - product-roadmap Add new milestones for shipped features: - Auth: auth shell, SSO auto-provisioning, identity flag for describe - DX: terminal themes, helpful errors, provenance tracking, global env, metadata inheritance, interactive terraform prompts - Extensibility: !random, !env stack manifest support, circular dependency detection, deferred evaluation, boolean flags Update progress percentages: - Auth: 80% → 85% - DX: 75% → 90% - Extensibility: 50% → 80% 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(roadmap): correct broken documentation links Update doc links to use correct paths: - /cli/configuration/configuration → /cli/configuration - /cli/commands/commands → /cli/commands 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * address comments and feedback * address comments and feedback --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com> Co-authored-by: aknysh <andriy.knysh@gmail.com>

docs/prd/eks-kubeconfig.md

This PRD defines the design for integrating EKS kubeconfig generation into Atmos's authentication system via the integration pattern. EKS kubeconfig generation will be automatic on identity login and available via `atmos auth eks-kubeconfig` command. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Changes based on PR review: - Use `atmos aws eks update-kubeconfig` instead of `atmos auth eks-kubeconfig` - Update kubeconfig schema to use nested structure with path/mode/update fields - Simplify KUBECONFIG env var example to use `atmos auth env --format=export` - Add note clarifying exec credential plugin is standard AWS CLI format 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Align the PRD with the actual integration infrastructure after rebasing onto main. Fixes incorrect interface definition, method names, file paths, and dependency status. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace `aws eks get-token` with `atmos auth eks-token` as the kubeconfig exec credential plugin, eliminating the AWS CLI dependency. Simplify XDG path usage to call GetXDGConfigDir directly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add the kubectl-time exec flow showing atmos auth eks-token being invoked by kubectl to generate bearer tokens via STS. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Update security note #5 to reflect deterministic identity binding via --identity flag (no longer "ambient AWS credentials") - Fix diagram: "STS GetCallerID" → "GetCallerIdentity" - Clarify that auth subcommands use authCmd.AddCommand(), not CommandProvider (which is for top-level commands only) - Distinguish existing --role-arn flag (generation-time) from future exec plugin role assumption (runtime) in Future Enhancements Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…for-eks-using-aws-go-sdk

Benbentwo · 2026-02-23T17:16:57Z

@coderabbitai full review

Benbentwo · 2026-02-23T17:35:21Z

@coderabbitai full review

coderabbitai · 2026-02-23T17:35:33Z

✅ Actions performed

Full review triggered.

coderabbitai

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/prd/eks-kubeconfig.md`:
- Around line 141-187: Document that KubeconfigSettings.Update (allowed values:
"merge", "replace", "error", default "merge") is validated at config-load time
like Mode; explicitly state that invalid values (e.g., "invalid") are rejected
with a validation error referencing KubeconfigSettings.Update rather than
silently falling back, and update the EKSCluster/KubeconfigSettings schema docs
to note this behavior and the default.
- Around line 239-243: The docs update only adds the EKS SDK but misses
instructing users to promote k8s.io/client-go to a direct dependency; update the
go.mod guidance to include a direct requirement for k8s.io/client-go (so code
that imports k8s.io/client-go/tools/clientcmd resolves), e.g., mention adding
k8s.io/client-go as a direct module in the same section where
github.com/aws/aws-sdk-go-v2/service/eks is added and call out that this
promotion is required for imports of clientcmd and other client-go packages.
- Around line 704-708: Add PR `#1903` to the Dependencies section: note that PR
`#1903` (which refactors the "atmos aws eks" command into the command
registry/flag handler pattern) must be merged before implementing this PRD.
Update the Dependencies list near the "ECR integration" / "AWS SDK v2 EKS"
bullets to include a line referencing PR `#1903` and its purpose (refactor of
atmos aws eks into command registry/flag handler), so implementors know to merge
that change first.
- Around line 383-397: Update the docs example to use the correct format for
atmos auth env: replace the invalid flag value `--format=export` with
`--format=bash` or remove the flag (bash is the default) in the usage of `atmos
auth env` so the command succeeds; leave the `atmos auth shell` example as-is
since it already sets auth env vars including KUBECONFIG.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 8fdf9b6 and fdc521b.

📒 Files selected for processing (1)

docs/prd/eks-kubeconfig.md

docs/prd/eks-kubeconfig.md

- Add validation spec for KubeconfigSettings.Update (reject invalid values at config-load time, default "merge") - Add k8s.io/client-go and PR #1903 to Dependencies section - Fix `atmos auth env --format=export` to `atmos auth env` (bash is the default; "export" is not a valid format) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/prd/eks-kubeconfig.md

Rewrite the executive summary and problem statement to better frame the motivation: Atmos already manages cloud auth, so extending to Kubernetes config is a natural next step. Add Terraform Kubernetes provider section showing kubeconfig-based and exec-based approaches. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Explain that the kubeconfig's exec spec contains `command: atmos` which the Terraform provider invokes on demand for token refresh. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…o EKS PRD - Show --identity and --profile flags in Desired Workflow examples - Extend Integration interface with Cleanup() and Environment() methods - Add Integration Cleanup on Logout section (logout undoes login effects) - Add Integration Environment Variables section with composition strategy for multi-integration scenarios (blue/green clusters, mixed EKS+ECR) - Update CLI command flags with env var bindings and flag disambiguation - Replace kubeconfig cleanup future enhancement with CI/CD workflow item - Add test cases for cleanup, environment composition, and logout Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…for-eks-using-aws-go-sdk

github-actions · 2026-03-05T00:47:42Z

These changes were released in v1.208.1-test.0.

Benbentwo requested a review from a team as a code owner December 17, 2025 20:32

github-actions bot added the size/l Large size PR label Dec 17, 2025

chatgpt-codex-connector bot reviewed Dec 17, 2025

View reviewed changes

coderabbitai bot previously approved these changes Dec 17, 2025

View reviewed changes

osterman reviewed Dec 18, 2025

View reviewed changes

docs/prd/eks-kubeconfig.md Outdated Show resolved Hide resolved

osterman reviewed Dec 18, 2025

View reviewed changes

docs/prd/eks-kubeconfig.md Outdated Show resolved Hide resolved

osterman reviewed Dec 18, 2025

View reviewed changes

docs/prd/eks-kubeconfig.md Outdated Show resolved Hide resolved

osterman reviewed Dec 18, 2025

View reviewed changes

docs/prd/eks-kubeconfig.md Outdated Show resolved Hide resolved

Benbentwo dismissed coderabbitai[bot]’s stale review via 2aa6745 December 18, 2025 17:20

coderabbitai bot previously approved these changes Dec 18, 2025

View reviewed changes

Benbentwo added the no-release Do not create a new release (wait for additional code changes) label Dec 18, 2025

Benbentwo force-pushed the feature/dev-3815-create-atmos-auth-identity-for-eks-using-aws-go-sdk branch from f14c852 to 0a696e9 Compare December 29, 2025 17:47

RoseSecurity mentioned this pull request Dec 30, 2025

feat(auth): add PRD for native Okta authentication identity #1924

Merged

3 tasks

Benbentwo force-pushed the feature/dev-3815-create-atmos-auth-identity-for-eks-using-aws-go-sdk branch from 0a696e9 to 3c301ac Compare January 2, 2026 16:59

osterman reviewed Jan 3, 2026

View reviewed changes

docs/prd/eks-kubeconfig.md Outdated Show resolved Hide resolved

osterman reviewed Jan 3, 2026

View reviewed changes

docs/prd/eks-kubeconfig.md Outdated Show resolved Hide resolved

osterman reviewed Jan 3, 2026

View reviewed changes

docs/prd/eks-kubeconfig.md Show resolved Hide resolved

Benbentwo and others added 4 commits February 17, 2026 11:27

docs: Sync EKS kubeconfig PRD with current codebase

17f9e73

Align the PRD with the actual integration infrastructure after rebasing onto main. Fixes incorrect interface definition, method names, file paths, and dependency status. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Benbentwo dismissed coderabbitai[bot]’s stale review via 374d232 February 18, 2026 21:11

Benbentwo force-pushed the feature/dev-3815-create-atmos-auth-identity-for-eks-using-aws-go-sdk branch from 7546ba5 to 374d232 Compare February 18, 2026 21:11

docs: Update architecture diagram to show kubectl exec flow

4c75c31

Add the kubectl-time exec flow showing atmos auth eks-token being invoked by kubectl to generate bearer tokens via STS. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Benbentwo force-pushed the feature/dev-3815-create-atmos-auth-identity-for-eks-using-aws-go-sdk branch from 6eeb5f0 to 4c75c31 Compare February 18, 2026 21:25

Benbentwo and others added 2 commits February 23, 2026 09:06

Merge branch 'main' into feature/dev-3815-create-atmos-auth-identity-…

fdc521b

…for-eks-using-aws-go-sdk

coderabbitai bot approved these changes Feb 23, 2026

View reviewed changes

coderabbitai bot requested changes Feb 23, 2026

View reviewed changes

docs/prd/eks-kubeconfig.md Show resolved Hide resolved

docs/prd/eks-kubeconfig.md Show resolved Hide resolved

docs/prd/eks-kubeconfig.md Outdated Show resolved Hide resolved

docs/prd/eks-kubeconfig.md Show resolved Hide resolved

coderabbitai bot previously approved these changes Feb 23, 2026

View reviewed changes

osterman reviewed Feb 23, 2026

View reviewed changes

docs/prd/eks-kubeconfig.md Show resolved Hide resolved

osterman reviewed Feb 23, 2026

View reviewed changes

docs/prd/eks-kubeconfig.md Show resolved Hide resolved

Benbentwo dismissed coderabbitai[bot]’s stale review via fcd16ec February 24, 2026 17:29

coderabbitai bot previously approved these changes Feb 24, 2026

View reviewed changes

docs: Clarify exec plugin mechanism in Terraform provider section

511aa89

Explain that the kubeconfig's exec spec contains `command: atmos` which the Terraform provider invokes on demand for token refresh. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Benbentwo dismissed coderabbitai[bot]’s stale review via 511aa89 February 24, 2026 17:35

coderabbitai bot previously approved these changes Feb 24, 2026

View reviewed changes

Benbentwo dismissed coderabbitai[bot]’s stale review via 7166e87 March 3, 2026 21:15

Merge branch 'main' into feature/dev-3815-create-atmos-auth-identity-…

2cc1e0d

…for-eks-using-aws-go-sdk

osterman approved these changes Mar 4, 2026

View reviewed changes

Benbentwo enabled auto-merge (squash) March 4, 2026 16:56

Merge branch 'main' into feature/dev-3815-create-atmos-auth-identity-…

ad74e77

…for-eks-using-aws-go-sdk

github-actions bot added size/m Medium size PR and removed size/l Large size PR labels Mar 4, 2026

Merge branch 'main' into feature/dev-3815-create-atmos-auth-identity-…

eed0739

…for-eks-using-aws-go-sdk

Benbentwo merged commit 50d5048 into main Mar 4, 2026
55 checks passed

Benbentwo deleted the feature/dev-3815-create-atmos-auth-identity-for-eks-using-aws-go-sdk branch March 4, 2026 19:37

Benbentwo mentioned this pull request Mar 6, 2026

feat: Add EKS kubeconfig authentication integration (ATMOS-157) #2149

Draft

Uh oh!

Conversation

Benbentwo commented Dec 17, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

what

why

references

Summary by CodeRabbit

Uh oh!

github-actions bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

codecov bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Suggested reviewers

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Benbentwo commented Feb 23, 2026

Uh oh!

Benbentwo commented Feb 23, 2026

Uh oh!

coderabbitai bot commented Feb 23, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Benbentwo commented Dec 17, 2025 •

edited by coderabbitai bot

Loading

github-actions bot commented Dec 17, 2025 •

edited

Loading

codecov bot commented Dec 17, 2025 •

edited

Loading

coderabbitai bot commented Dec 17, 2025 •

edited

Loading