EKS Cluster credentials expiration about provider-aws

[haarchri]

@lukeweber we renew the secret in every reconcile loop - close the issue - feel free to reopen if we have problems with this implementation

[nakulpathak3]

Hi, we're working on programmatically creating and interacting with EKS clusters as well but using Python. Have you run into any 403 forbidden errors using the tokens? How are you handling the 15 minutes max life right now?

[lukeweber]

We aren't handling it right now explicitly. Certainly you can regenerate a token in the same way we generate tokens, and just make sure to get a new one before the old one expires.

https://github.com/crossplaneio/crossplane/blob/ecca498e3b2989ba201ad60770fce54eee571b79/pkg/clients/aws/eks/eks.go#L218-L229

This is what's done internally when you use the iam authenticator binary
https://github.com/kubernetes-sigs/aws-iam-authenticator/

[ichekrygin]

I think we are relying on Sync interval to "re-generate" EKS credentials, which should "renew" the auth token.

[hasheddan]

@negz can we close this with continuous secret propagation?