# atmos aws eks update-kubeconfig

Use this command to download `kubeconfig` from an EKS cluster and save it to a file.

```shell
atmos aws eks update-kubeconfig [options]
```

This command downloads kubeconfig from an EKS cluster and saves it to a file. It supports multiple execution modes:

1. **CLI parameters only**: If all the required parameters (cluster name and AWS profile/role) are provided on the command-line, then Atmos executes the command without
   requiring the `atmos.yaml` CLI config and context.

   ```shell
   atmos aws eks update-kubeconfig --profile=<profile> --name=<cluster_name>
   ```

2. **Component and stack**: If `component` and `stack` are provided on the command-line, then Atmos executes the command using the `atmos.yaml` CLI config and stack's context
   by searching for the following settings:

   - `components.helmfile.cluster_name_pattern` in the `atmos.yaml` CLI config (and calculates the `--name` parameter using the pattern)
   - `components.helmfile.helm_aws_profile_pattern` in the `atmos.yaml` CLI config (and calculates the `--profile` parameter using the pattern)
   - `components.helmfile.kubeconfig_path` in the `atmos.yaml` CLI config the variables for the component in the provided stack
   - `region` from the variables for the component in the stack

   ```shell
   atmos aws eks update-kubeconfig <component> -s <stack>
   ```

3. **Combination**: Provide a component and a stack, and override other parameters on the command line.

   ```shell
   atmos aws eks update-kubeconfig <component> -s <stack> --kubeconfig=<path_to_kubeconfig> --region=us-east-1
   ```

4. **Integration mode**: Use a named integration from `auth.integrations` to authenticate via the Atmos auth system and generate kubeconfig using the Go SDK (no AWS CLI required).

   ```shell
   atmos aws eks update-kubeconfig --integration=dev/eks/primary
   ```

5. **Identity mode**: Use an Atmos identity directly with explicit cluster parameters. This authenticates via the auth system and uses the Go SDK.

   ```shell
   atmos aws eks update-kubeconfig --name=<cluster_name> --region=<region> --identity=<identity_name>
   ```

:::info
Refer to [Update kubeconfig](https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html) for more information
:::

:::tip
Run `atmos aws eks update-kubeconfig --help` to see all the available options
:::

## Examples

```shell
# Using component and stack
atmos aws eks update-kubeconfig <component> -s <stack>

# Using explicit CLI parameters (requires AWS CLI)
atmos aws eks update-kubeconfig --profile=<profile> --name=<cluster_name>

# Using a named integration (no AWS CLI required)
atmos aws eks update-kubeconfig --integration=dev/eks/primary

# Using an identity with explicit parameters (no AWS CLI required)
atmos aws eks update-kubeconfig --name=dev-cluster --region=us-east-2 --identity=dev-admin

# Override parameters with component and stack
atmos aws eks update-kubeconfig <component> -s <stack> --kubeconfig=<path_to_kubeconfig> --region=<region>

# Additional options
atmos aws eks update-kubeconfig --role-arn <ARN>
atmos aws eks update-kubeconfig --alias <cluster context name alias>
atmos aws eks update-kubeconfig --dry-run=true
atmos aws eks update-kubeconfig --verbose=true
```

## Arguments

- **`component` (optional)**
  Atmos component.

## Flags

- **`--stack` / `-s` (optional)**
  Atmos stack.
- **`--profile` (optional)**
  AWS profile to use to authenticate to the EKS cluster.
- **`--role-arn` (optional)**
  AWS IAM role ARN to use to authenticate to the EKS cluster.
- **`--name` (optional)**
  EKS cluster name.
- **`--region` (optional)**
  AWS region.
- **`--kubeconfig` (optional)**
  `kubeconfig`
   filename to append with the configuration.
- **`--alias` (optional)**
  Alias for the cluster context name. Defaults to match cluster ARN.
- **`--dry-run` (optional)**
  Print the merged kubeconfig to stdout instead of writing it to the specified file.
- **`--verbose` (optional)**
  Print more detailed output when writing the kubeconfig file, including the appended entries.
- **`--integration` (optional)**

  Name of a configured integration from `auth.integrations` (must be `kind: aws/eks`). When specified, Atmos authenticates the integration's linked identity and uses the Go SDK to describe the cluster and generate kubeconfig. This does not require the AWS CLI.
- **`--identity` (optional)**

  Atmos identity to authenticate with. When used with `--name` (and without `--profile` or `--role-arn`), Atmos authenticates via the auth system and uses the Go SDK directly. This does not require the AWS CLI.

## Configuration

### Integration Mode

EKS integrations are configured in `atmos.yaml` under `auth.integrations`:

```yaml
auth:
  providers:
    company-sso:
      kind: aws/iam-identity-center
      region: us-east-1
      start_url: https://company.awsapps.com/start/

  identities:
    dev-admin:
      kind: aws/permission-set
      via:
        provider: company-sso
      principal:
        name: AdministratorAccess
        account: dev

  integrations:
    dev/eks/primary:
      kind: aws/eks
      via:
        identity: dev-admin
      spec:
        cluster:
          name: dev-cluster
          region: us-east-2
          alias: dev-eks
```

```shell
atmos aws eks update-kubeconfig --integration=dev/eks/primary
```

See the [EKS Kubeconfig Authentication Tutorial](/tutorials/eks-kubeconfig-authentication) for detailed configuration examples.

## See Also

- [AWS EKS Token Command](/cli/commands/aws/eks-token) — Generate EKS bearer tokens for kubectl
- [EKS Kubeconfig Authentication Tutorial](/tutorials/eks-kubeconfig-authentication) — Step-by-step EKS setup guide
- [Auth Login Command](/cli/commands/auth/login) — Authenticate with identities (triggers auto-provisioned integrations)