Poc Eks MCP Server Cross Accounts

EKS MCP服务器跨AWS帐户访问教程

此存储库演示了如何使用 EKS MCP 服务器 通过跨帐户IAM访问连接到多个AWS帐户、配置文件和区域。

此示例使用 Strands代理SDK 构建AI Agent，但可以使用任何AI Agent框架。

目录

• 先决条件
• AWS帐户设置
• AWS配置文件配置
• MCP检验员测试
• 使用方法

- 方法1：使用Stdio的多个MCP客户端 - 方法2：带有AgentGateway的单个HTTP客户端

• 输出示例

先决条件

• AWS CLI配置了适当的凭据
• Python 3.13+
• uv包管理器
• Node.js（用于MCP检查器测试）
• 访问源和目标AWS帐户
• 配置了适当的IAM角色和信任关系

快速开始

1. 克隆并设置项目：

   git clone 
   cd 
   uv venv .venv --python 3.13
   source .venv/bin/activate

1. 配置AWS配置文件 如图所示 AWS配置文件配置 章节

1. 选择您喜欢的方法：

- 对于 方法1：运行 uv run agent.py - 对于 方法2：安装AgentGateway，用配置启动它，然后运行 uv run agent-agentgateway.py

项目结构

├── README.md                    # This documentation
├── pyproject.toml              # Python project configuration
├── agent.py                    # Method 1: Multiple stdio MCP clients
├── agent-agentgateway.py       # Method 2: Single HTTP client via AgentGateway
├── agentgateway-config.yaml    # AgentGateway configuration
├── mcp-inspector.png           # MCP Inspector screenshot
└── agent-gateway-playground.png # AgentGateway UI screenshot

参考文献

• IAM跨帐户访问教程
• EKS MCP服务器文档
• Strands Agent SDK文档
• AgentGateway存储库

AWS帐户设置

帐户配置

• 发起/来源账户: 111111111111
• AWS源配置文件: carrlos+eksworkshop-Admin
• 目标帐户: 222222222222
• 目标角色: arn:aws:iam::222222222222:role/EKS-Admin

跨帐户角色信任策略

目标帐户角色必须信任源帐户：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/Admin"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

AWS配置文件配置

配置您的 ~/.aws/config 包含以下配置文件的文件：

[profile carrlos+eksworkshop-Admin]
output = yaml
region = us-west-2
cli_pager =
credential_process = isengardcli credentials --awscli carrlos+eksworkshop@amazon.com --role Admin --region us-west-2

[profile cross-account-1]
output = yaml
region = us-west-2
cli_pager =
role_arn = arn:aws:iam::222222222222:role/EKS-Admin
source_profile = carrlos+eksworkshop-Admin

[profile carrlos-Admin]
output = yaml
region = us-west-2
cli_pager =
credential_process = isengardcli credentials --awscli carrlos@amazon.com --role Admin --region us-west-2

MCP检验员测试

通过使用MCP Inspector进行测试来验证您的设置是否正常工作：

AWS_REGION=us-west-2 AWS_PROFILE=cross-account-1  npx @modelcontextprotocol/inspector uvx awslabs.eks-mcp-server@latest --allow-write --allow-sensitive-data-access

点击 Connect 按钮、列表工具和调用 list_api_versions 使用cluster_name agentic-ai-on-eks-workshop

alt text

群集配置映射

以下映射定义了集群如何与AWS配置文件和帐户相关联：

eks_mcp_servers:
cross:
  cluster_name: agentic-ai-on-eks-workshop
  profile: cross-account-1
  mcp_namespace: cross
  account: "222222222222"
  cross_account: true
  source_account: "111111111111"
carrlos:
  cluster_name: cloud-provider-1
  profile: carrlos-Admin
  mcp_namespace: carrlos
  account: "222222222222"
  cross_account: false

使用方法

方法1：使用Stdio的多个MCP客户端

此方法为每个AWS配置文件创建单独的MCP客户端，允许与多个EKS MCP服务器直接进行stdio通信。

设置

uv venv .venv  --python 3.13
source .venv/bin/activate

运行代理

uv run agent.py

方法2：带有AgentGateway的单个HTTP客户端

此方法使用AgentGateway通过单个HTTP端点代理多个MCP服务器，简化了客户端配置。

安装AgentGateway

curl https://raw.githubusercontent.com/agentgateway/agentgateway/refs/heads/main/common/scripts/get-agentgateway | bash

查看配置

配置文件定义了2个EKS MCP服务器：

cat agentgateway-config.yaml

这是配置 agentgateway-config.yaml:

binds:
  - port: 3000
    listeners:
      - routes:
          - policies:
              cors:
                allowOrigins:
                  - "*"
                allowHeaders:
                  - mcp-protocol-version
                  - content-type
                  - cache-control
            backends:
              - mcp:
                  targets:
                    - name: cross
                      stdio:
                        cmd: uvx
                        args:
                          [
                            "awslabs.eks-mcp-server@latest",
                            "--allow-write",
                            "--allow-sensitive-data-access",
                          ]
                        env:
                          AWS_REGION: "us-west-2"
                          AWS_PROFILE: "cross-account-1"
                    - name: carrlos
                      stdio:
                        cmd: uvx
                        args:
                          [
                            "awslabs.eks-mcp-server@latest",
                            "--allow-write",
                            "--allow-sensitive-data-access",
                          ]
                        env:
                          AWS_REGION: "us-west-2"
                          AWS_PROFILE: "carrlos-Admin"

备注：目标名称不能包含下划线(_)在他们的名字。

运行AgentGateway

agentgateway --file agentgateway-config.yaml

使用AgentGateway UI进行测试

打开UIhttp://localhost:15000/ui测试配置：

AgentGateway Playground

运行代理

uv run agent-agentgateway.py

两种方法的输出示例

['get_todays_date', 'use_aws', 'environment', 'get_profile_from_cluster', 'cross_get_cloudwatch_logs', 'cross_get_cloudwatch_metrics', 'cross_search_eks_troubleshoot_guide', 'cross_manage_eks_stacks', 'cross_list_k8s_resources', 'cross_get_pod_logs', 'cross_get_k8s_events', 'cross_list_api_versions', 'cross_manage_k8s_resource', 'cross_apply_yaml', 'cross_generate_app_manifest', 'cross_add_inline_policy', 'cross_get_policies_for_role', 'cross_get_eks_metrics_guidance', 'carrlos_get_cloudwatch_logs', 'carrlos_get_cloudwatch_metrics', 'carrlos_search_eks_troubleshoot_guide', 'carrlos_manage_eks_stacks', 'carrlos_list_k8s_resources', 'carrlos_get_pod_logs', 'carrlos_get_k8s_events', 'carrlos_list_api_versions', 'carrlos_manage_k8s_resource', 'carrlos_apply_yaml', 'carrlos_generate_app_manifest', 'carrlos_add_inline_policy', 'carrlos_get_policies_for_role', 'carrlos_get_eks_metrics_guidance']
I'll help you list the pods in the "agentic-ai-on-eks-workshop" cluster. First, I need to determine which profile to use for this cluster.
Tool #1: get_profile_from_cluster
Based on the response, I should use tools with the "cross_" prefix for this cluster. Now, I'll list the pods in the cluster. Since we want to list all pods across all namespaces, I'll not specify a namespace parameter.

First, I need to get the correct API version:
Tool #2: cross_list_api_versions
Now I'll list the pods using the core "v1" API version:
Tool #3: cross_list_k8s_resources
Here are the pods running in the "agentic-ai-on-eks-workshop" cluster across all namespaces:

**Namespace: agents**
- weather-agent-78879c999-99dq9

**Namespace: amazon-cloudwatch**
- amazon-cloudwatch-observability-controller-manager-7b49494fhl76
- cloudwatch-agent-vppzx
- fluent-bit-6m28k

**Namespace: cert-manager**
- cert-manager-6c4645d66c-ptmxc
- cert-manager-cainjector-55c5b94bfc-9qxb8
- cert-manager-webhook-549d7475d7-4fblm

**Namespace: mcp-servers**
- weather-mcp-885867d86-4lbbw

**Namespace: opentelemetry-operator-system**
- opentelemetry-operator-7b7f78688b-8mz4r

**Namespace: ui**
- agent-ui-9c66574df-vktgk

The cluster has 10 pods running across 5 different namespaces. These include workloads for observability (CloudWatch and OpenTelemetry), certificate management (cert-manager), and what appears to be a weather-related application with UI, agent, and MCP (Management Control Plane) components.I'll help you list the pods in the "cloud-provider-1" cluster. First, I need to determine which profile to use for this cluster.
Tool #4: get_profile_from_cluster
Based on the response, I should use tools with the "carrlos_" prefix for this cluster. Now, I'll list the pods in the cluster. Since we want to list all pods across all namespaces, I'll not specify a namespace parameter.

First, I need to get the correct API version:
Tool #5: carrlos_list_api_versions
Now I'll list the pods using the core "v1" API version:
Tool #6: carrlos_list_k8s_resources
Here are the pods running in the "cloud-provider-1" cluster:

**Namespace: default**
- nginx-5869d7778c-xz76m