EKS throws an authentication error after provisioning

[jaxxstorm]

Provisioning an Amazon EKS cluster with github.com/pulumi/pulumi-eks is successful, but then after exporting the kubeconfig created and attempting to authenticate, we get the following error thrown

error: configured Kubernetes cluster is unreachable: unable to load schema information from the API server: Get "https://${url}/v2?timeout=32s": getting credentials: exec plugin is configured to use API version client.authentication.k8s.io/v1alpha1, plugin returned version client.authentication.k8s.io/v1beta1

[jaxxstorm]

Summary: the AWS CLI version you're using has a bug, update it to > 2.2.25

Longer answer

This has been reported several times in pulumi/pulumi-eks#599 and pulumi/pulumi-eks#600

The reason this error is occurring is because of your AWS CLI, as mentioned in this issue: aws/aws-cli#6308

When you provision an EKS cluster, your KUBECONFIG file looks a little bit like this:

{
  "apiVersion": "v1",
  "clusters": [
    {
      "cluster": {
        "certificate-authority-data": "<base64>",
        "server": "<clusterName"
      },
      "name": "kubernetes"
    }
  ],
  "contexts": [
    {
      "context": {
        "cluster": "kubernetes",
        "user": "aws"
      },
      "name": "aws"
    }
  ],
  "current-context": "aws",
  "kind": "Config",
  "users": [
    {
      "name": "aws",
      "user": {
        "exec": {
          "apiVersion": "client.authentication.k8s.io/v1alpha1",
          "args": [
            "eks",
            "get-token",
            "--cluster-name",
            "<clusterName>"
          ],
          "command": "aws",
        }
      }
    }
  ]
}

What this does is run aws eks get-token --cluster-name <foo> every time you invoke kubectl for that cluster.

Unfortunately, aws-cli version 2.2.24 shipped a change to the apiVersion being sent to the cluster, which is technically a breaking change.

This behaviour was reverted in 2.2.25.