-
Notifications
You must be signed in to change notification settings - Fork 40
/
irsa.go
58 lines (52 loc) · 1.63 KB
/
irsa.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
package crossplane
import (
"fmt"
"github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
"github.com/awslabs/eksdemo/pkg/application"
"github.com/awslabs/eksdemo/pkg/cloudformation"
"github.com/awslabs/eksdemo/pkg/resource"
"github.com/awslabs/eksdemo/pkg/resource/irsa"
"github.com/awslabs/eksdemo/pkg/template"
)
func crossplaneIrsa(options application.Options) *resource.Resource {
o := options.Common()
return &resource.Resource{
Options: &irsa.IrsaOptions{
CommonOptions: resource.CommonOptions{
ClusterName: o.ClusterName,
Name: fmt.Sprintf("crossplane-%s-irsa", o.Namespace),
Namespace: o.Namespace,
ServiceAccount: o.ServiceAccount,
},
},
Manager: &cloudformation.ResourceManager{
Capabilities: []types.Capability{types.CapabilityCapabilityNamedIam},
Template: &template.TextTemplate{
Template: cloudFormationTemplate,
},
},
}
}
const cloudFormationTemplate = `
AWSTemplateFormatVersion: "2010-09-09"
Resources:
CrossplaneIRSA:
Type: "AWS::IAM::Role"
Properties:
RoleName: {{ .RoleName }}
Path: /
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Federated:
!Sub "arn:${AWS::Partition}:iam::{{ .Account }}:oidc-provider/{{ .ClusterOIDCProvider }}"
Action:
- sts:AssumeRoleWithWebIdentity
Condition:
StringLike:
"{{ .ClusterOIDCProvider }}:sub": "system:serviceaccount:{{ .Namespace }}:provider-aws-*"
ManagedPolicyArns:
- !Sub "arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess"
`