Sofka on Linux gets stuck when connecting to EKS with MFA enabled

[memetics19]

When MFA is enabled for an AWS EKS connection, Sofka on Linux appears to get stuck during the connection flow.

Could Sofka handle this authentication flow more reliably, for example by prompting for the MFA code and continuing after verification, or by showing a clear error if MFA authentication is not supported?

Is this a known limitation? I can share the Sofka version, Linux distribution, and relevant logs if they would help diagnose it.

[nklmilojevic]

Thanks for reporting! This is a bug, not a known limitation.

sofka runs exec auth plugins non-interactively, so stdin is closed. The AWS CLI's MFA prompt doesn't read stdin though - it opens the terminal directly, and the terminal is owned by the TUI. So the prompt ends up hidden under the UI and the read never finishes, which is why it looks stuck instead of failing. It's not Linux specific either, macOS behaves the same.

k9s has the same problem btw (derailed/k9s#2048), it was closed as not planned. I'd rather fix it here.

Workaround for now: run this once in a shell and enter the MFA code

aws eks get-token --cluster-name <cluster> --profile <profile>

The AWS CLI caches the assumed role credentials in ~/.aws/cli/cache, so sofka will connect normally until they expire. aws-vault or granted work too.

What I'll do:

• stop the hang - the auth command will fail fast and sofka will show a clear "MFA required" message with the command to run
• look into letting sofka prompt for the code itself, by running the auth command in the real terminal (before the TUI starts, or by suspending it on a context switch) like kubectl does

Your sofka version, distro and the shape of the AWS profile (mfa_serial, role_arn, source_profile, no secrets pls) would still help to confirm :)

[nklmilojevic]

this should be fixed, but feel free to reopen.

[memetics19]

Not working quite well can you recheck its getting struck again

[memetics19]

Not working quite well can you recheck its getting struck again

[nklmilojevic]

You will have to give me more details. I cannot reproduce it as I do not use AWS.

I already wrote in the previous post:

Your sofka version, distro and the shape of the AWS profile (mfa_serial, role_arn, source_profile, no secrets pls) would still help to confirm :)

Video recording would also help.