Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough.

My guess is that the *usual* `aws configure` configuration with a MFA ARN + the AWS SDK used to develop *kubectl* are not entirely compatible: I have two profiles set for this, one that has its *mfa_serial_arn* and *role_arn* that works as follows:

* First **aws** command I type, I get prompted for MFA token 
* From there onwards, while session is active, I can work without typing in more tokens.
* *kubectl* asks for a token EVERY SINGLE TIME.

This is bad.

Now, I set a different profile, without any of the above, and I do the following:

```

    keys=($(aws sts assume-role --role-arn <ARN_OF_DELEGATED_ROLE> \
       --role-session-name  <RANDOM_UNIQUE_NAME> \
       --serial-number <ARN_OF_MFA_DEVICE>\
       --token-code  \
        --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))
    
    # profile used here will be configured in ~/.aws/credentials
    export AWS_PROFILE=<PROFILE YOU WANT>
    
    aws configure set aws_access_key_id ${temp_keys[0]}
    aws configure set aws_secret_access_key ${temp_keys[1]}
    aws configure set aws_session_token ${temp_keys[2]}

```


This creates a **temporary valid** aws profile, that can be used **BOTH** with the aws cli, and kubectl.