Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

MCP Kubernetes tools fail to authenticate in EKS environments due to missing aws CLI in distroless image

Open
  • Is something wrong?
#60 0 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 3 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
aws, docker, kubernetes
Domain
authentication, cloud, devops

Research direction

Start by reproducing the failure with the ghcr.io/kagent-dev/kagent/tools:0.1.3 image and a kubeconfig using the aws eks get-token exec command. Check the image's available binaries and the MCP server logs; done means a full or cloud tools image can execute aws and discover tools against the EKS API.

Written by the indexing model from the issue text.

Description

Description
When using the official Kagent tools image (ghcr.io/kagent-dev/kagent/tools) in an EKS environment to manage remote or cross-account clusters, authentication fails because the image lacks the necessary binary dependencies.

Most EKS kubeconfig configurations rely on the client.authentication.k8s.io/v1 exec plugin to dynamically fetch authentication tokens using the AWS CLI (e.g., command: aws). Because the current official image is distroless, it does not include the aws binary, preventing the MCP server from authenticating with the target Kubernetes API.

Steps to Reproduce
Deploy an MCPServer using the ghcr.io/kagent-dev/kagent/tools image.

Provide a kubeconfig via a Secret that uses the aws eks get-token exec command for authentication.

Observe the Kagent Dashboard or logs shows 0 tools

Expected Behavior
The MCP server should be able to execute the aws command defined in the kubeconfig to retrieve a valid token and connect to the cluster.

Actual Behavior
The MCP server fails to authenticate because the aws binary is not found in the container's $PATH. As a result, the server reports 0 tools discovered because it cannot reach the Kubernetes API.

Impact
Users are unable to use the native Kagent tools image for managing EKS clusters without building a custom image that includes the AWS CLI and its dependencies.

Suggested Fix/Workaround
Feature Request: Provide a "full" or "cloud" version of the tools image (e.g., tools:0.1.3-full) that includes common cloud CLIs like aws, gcloud, and az.

Current Workaround: Users must manually use a base image like debian or golang, install the AWS CLI at runtime, and download the tools binary.

Technical Summary for Maintainers
Image: ghcr.io/kagent-dev/kagent/tools:0.1.3

Error Context: exec: "aws": executable file not found in $PATH

Environment: EKS Cross-Account / Remote Cluster Management via IRSA.

Dominant language
Go
Stars
35
Forks
30
Avg merge
3d 23h
Merged PRs (30d)
3

Getting set up

We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from kagent-dev/tools

All issues in kagent-dev/tools

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.