Atmos AWS EKS

Use this skill for Atmos commands that connect AWS EKS clusters to local Kubernetes tooling. It owns atmos aws eks update-kubeconfig and atmos aws eks token.

Command Model

atmos aws eks update-kubeconfig writes or prints kubeconfig entries for an EKS cluster. It can run from explicit CLI arguments, a component and stack, an auth.integrations entry, or an Atmos identity with explicit cluster details.

atmos aws eks update-kubeconfig <component> -s <stack>
atmos aws eks update-kubeconfig --profile dev --name dev-cluster
atmos aws eks update-kubeconfig --integration dev/eks/primary
atmos aws eks update-kubeconfig --name dev-cluster --region us-east-2 --identity dev-admin

atmos aws eks token generates a Kubernetes ExecCredential token for kubectl. It is normally called by kubectl from generated kubeconfig rather than run by humans.

atmos aws eks token --cluster-name dev-cluster --region us-east-2 --identity dev-admin

Configuration

For integration mode, configure an aws/eks integration in auth.integrations. Route provider, identity, AWS SSO, SAML, OIDC, assume role, and assume root details to atmos-auth.

auth:
  providers:
    company-sso:
      kind: aws/iam-identity-center
      region: us-east-1
      start_url: https://company.awsapps.com/start/

  identities:
    dev-admin:
      kind: aws/permission-set
      via:
        provider: company-sso
      principal:
        name: AdministratorAccess
        account: dev

  integrations:
    dev/eks/primary:
      kind: aws/eks
      via:
        identity: dev-admin
      spec:
        cluster:
          name: dev-cluster
          region: us-east-2
          alias: dev-eks

Agent Guidance

Prefer --integration when a named EKS integration exists; it centralizes cluster name, region, alias, and identity selection.
Use --identity with --name and --region for ad hoc kubeconfig generation through Atmos Auth.
Use --profile or --role-arn only when the workflow intentionally relies on AWS CLI-style credentials rather than Atmos Auth. In this command, --profile means the AWS CLI/kubeconfig credential profile, not an Atmos profile, --identity, or --integration.
Use --dry-run when reviewing kubeconfig output or avoiding writes to the user's kubeconfig.
Do not hard-code kubeconfig paths unless the repo already has a convention. Check components.helmfile.kubeconfig_path and Helmfile settings first when using component/stack mode.
If the AWS CLI or kubectl must be installed for a scripted job, route tool installation to atmos-toolchain.

Routing

Need	Skill
AWS identity/provider setup, SSO, SAML, OIDC, assume role/root	`atmos-auth`
Helmfile/EKS deployment behavior after kubeconfig exists	`atmos-helmfile`
Installing `aws`, `kubectl`, or other command-line tools	`atmos-toolchain`
Component/stack lookup for cluster settings	`atmos-components`, `atmos-stacks`

SKILL.md