Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough.

My guess is that the usual aws configure configuration with a MFA ARN + the AWS SDK used to develop kubectl are not entirely compatible: I have two profiles set for this, one that has its mfa_serial_arn and role_arn that works as follows:

• First aws command I type, I get prompted for MFA token
• From there onwards, while session is active, I can work without typing in more tokens.
• kubectl asks for a token EVERY SINGLE TIME.

This is bad.

Now, I set a different profile, without any of the above, and I do the following:

MFA_TOKEN_VALUE=<type here a MFA token from your device>
aws sts assume-role --role-arn <ARN_OF_DELEGATED_ROLE> \
   --role-session-name  <RANDOM_UNIQUE_NAME> \
   --serial-number <ARN_OF_MFA_DEVICE>\
   --token-code $TOKEN_VALUE

Now, I do a aws configure set xxxxx yyyyy --profile <CHOSEN_PROFILE> of the relevant values this should return: aws_secret_access_key, aws_access_key_id and the session name: This creates a temporary valid aws profile, that can be used BOTH with the aws cli, and kubectl.

Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough.

My guess is that the usual aws configure configuration with a MFA ARN + the AWS SDK used to develop kubectl are not entirely compatible: I have two profiles set for this, one that has its mfa_serial_arn and role_arn that works as follows:

• First aws command I type, I get prompted for MFA token
• From there onwards, while session is active, I can work without typing in more tokens.
• kubectl asks for a token EVERY SINGLE TIME.

This is bad.

Now, I set a different profile, without any of the above, and I do the following:

 
    keys=($(aws sts assume-role --role-arn <ARN_OF_DELEGATED_ROLE> \
       --role-session-name  <RANDOM_UNIQUE_NAME> \
       --serial-number <ARN_OF_MFA_DEVICE>\
       --token-code  \
        --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))
    
    # profile used here will be configured in ~/.aws/credentials
    export AWS_PROFILE=<PROFILE YOU WANT>
    
    aws configure set aws_access_key_id ${temp_keys[0]}
    aws configure set aws_secret_access_key ${temp_keys[1]}
    aws configure set aws_session_token ${temp_keys[2]}

This creates a temporary valid aws profile, that can be used BOTH with the aws cli, and kubectl.