scripts/setup-cluster-access.sh31 of 31 statements covered (100.00%).
coveredmissednever traced by Bash (not counted)A line ending in … continues the statement above it and shares its fate.
| 1 | #!/bin/bash | |
| 2 | # Setup script for configuring kubectl access to GCO cluster | |
| 3 | ||
| 4 | 5 | set -e |
| 5 | ||
| 6 | 5 | CLUSTER_NAME="${1:-gco-us-east-1}" |
| 7 | 5 | REGION="${2:-us-east-1}" |
| 8 | ||
| 9 | 5 | echo "Setting up access to cluster: $CLUSTER_NAME in region: $REGION" |
| 10 | 5 | echo "" |
| 11 | ||
| 12 | # Update kubeconfig | |
| 13 | 5 | echo "1. Updating kubeconfig..." |
| 14 | 5 | aws eks update-kubeconfig --name "$CLUSTER_NAME" --region "$REGION" |
| 15 | ||
| 16 | # Get current IAM principal | |
| 17 | 5 | echo "" |
| 18 | 5 | echo "2. Getting your IAM principal..." |
| 19 | 10 | PRINCIPAL_ARN=$(aws sts get-caller-identity --query Arn --output text) |
| 20 | 5 | echo " Principal: $PRINCIPAL_ARN" |
| 21 | ||
| 22 | # Handle assumed roles | |
| 23 | 5 | if [[ "$PRINCIPAL_ARN" == *":assumed-role/"* ]]; then |
| 24 | 3 | ROLE_NAME=$(echo "$PRINCIPAL_ARN" | sed 's/.*:assumed-role\/\([^\/]*\)\/.*/\1/') |
| 25 | 2 | ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) |
| 26 | 1 | PRINCIPAL_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${ROLE_NAME}" |
| 27 | 1 | echo " Using role ARN: $PRINCIPAL_ARN" |
| 28 | fi | |
| 29 | ||
| 30 | # Create access entry | |
| 31 | 5 | echo "" |
| 32 | 5 | echo "3. Creating EKS access entry..." |
| 33 | 5 | aws eks create-access-entry \ |
| 34 | --cluster-name "$CLUSTER_NAME" \ | |
| 35 | --region "$REGION" \ | |
| 36 | 1 | --principal-arn "$PRINCIPAL_ARN" 2>&1 || echo " Access entry may already exist" |
| 37 | ||
| 38 | # Associate admin policy | |
| 39 | 5 | echo "" |
| 40 | 5 | echo "4. Associating cluster admin policy..." |
| 41 | 5 | aws eks associate-access-policy \ |
| 42 | --cluster-name "$CLUSTER_NAME" \ | |
| 43 | --region "$REGION" \ | |
| 44 | --principal-arn "$PRINCIPAL_ARN" \ | |
| 45 | --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy \ | |
| 46 | 1 | --access-scope type=cluster 2>&1 || echo " Policy may already be associated" |
| 47 | ||
| 48 | # Verify access | |
| 49 | 5 | echo "" |
| 50 | 5 | echo "5. Verifying access..." |
| 51 | 5 | echo " Waiting for permissions to propagate..." |
| 52 | 5 | sleep 10 |
| 53 | 5 | kubectl get nodes |
| 54 | ||
| 55 | 4 | echo "" |
| 56 | 4 | echo "✓ Setup complete! You can now use kubectl with cluster: $CLUSTER_NAME" |