-
Notifications
You must be signed in to change notification settings - Fork 0
feat(eks-ci): add the GitHub-OIDC CI role for the ksail EKS smoke test #4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
devantler
wants to merge
4
commits into
main
Choose a base branch
from
claude/eks-ci-role
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
66a3ad9
feat(eks-ci): add the GitHub-OIDC CI role for the ksail EKS smoke test
devantler ce95668
feat(eks-ci): wire the CI role into the eks-ci kustomization
devantler 7417e48
fix(eks-ci): cover both EKS access-entry ARN spellings
devantler 8d57d5c
fix(eks-ci): bound created roles with a permissions boundary + OIDC p…
devantler File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,205 @@ | ||
| # The AWS-side identity the ksail "System Test - EKS" workflow assumes via | ||
| # GitHub Actions OIDC (step 2 of the rollout documented in kustomization.yaml; | ||
| # platform#2326 child 2). Trust is scoped to exactly one GitHub environment — | ||
| # repo:devantler-tech/ksail:environment:ci — through the account's GitHub OIDC | ||
| # provider (github-oidc-provider.yaml), so no long-lived key exists anywhere. | ||
| # maxSessionDuration is 7200s because the smoke job may run up to 120 min | ||
| # including cluster cleanup. | ||
| # | ||
| # Permissions are an INLINE policy (platform#2564: Policy/RolePolicyAttachment | ||
| # MRDs are deliberately not activated) modeled on eksctl's documented minimum | ||
| # policies, name-scoped to the workflow's st-eks-*/eksctl-st-eks-* naming | ||
| # wherever IAM supports resource-level scoping (CloudFormation stacks, IAM | ||
| # roles/instance profiles, EKS clusters). EC2/autoscaling/SSM-AMI actions are | ||
| # account-wide because eksctl drives them through CloudFormation with the | ||
| # caller's credentials and their create-time actions do not support name | ||
| # scoping; the blast radius remains bounded by the single-environment trust. | ||
| # iam:CreateRole is conditioned on the eks-ci-smoke-boundary permissions | ||
| # boundary (eks-ci-smoke-boundary.yaml) and no *PermissionsBoundary action is | ||
| # granted, so roles this principal creates (and can pass to EC2) are capped at | ||
| # the smoke-test compute plane even if an arbitrary policy is written to them. | ||
| apiVersion: iam.aws.m.upbound.io/v1beta1 | ||
| kind: Role | ||
| metadata: | ||
| name: eks-ci | ||
| spec: | ||
| forProvider: | ||
| description: >- | ||
| GitHub OIDC role for the ksail System Test - EKS smoke workflow | ||
| (repo:devantler-tech/ksail:environment:ci). Creates and deletes | ||
| throwaway st-eks-* EKS clusters via eksctl. | ||
| maxSessionDuration: 7200 | ||
| assumeRolePolicy: | | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "Federated": "arn:aws:iam::939001610192:oidc-provider/token.actions.githubusercontent.com" | ||
| }, | ||
| "Action": "sts:AssumeRoleWithWebIdentity", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "token.actions.githubusercontent.com:aud": "sts.amazonaws.com", | ||
| "token.actions.githubusercontent.com:sub": "repo:devantler-tech/ksail:environment:ci" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| inlinePolicy: | ||
| - name: eks-ci-smoke | ||
| policy: | | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Sid": "CloudFormationScoped", | ||
| "Effect": "Allow", | ||
| "Action": "cloudformation:*", | ||
| "Resource": "arn:aws:cloudformation:*:939001610192:stack/eksctl-st-eks-*/*" | ||
| }, | ||
| { | ||
| "Sid": "CloudFormationRead", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "cloudformation:ListStacks", | ||
| "cloudformation:GetTemplateSummary" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Sid": "EksScoped", | ||
| "Effect": "Allow", | ||
| "Action": "eks:*", | ||
| "Resource": [ | ||
| "arn:aws:eks:*:939001610192:cluster/st-eks-*", | ||
| "arn:aws:eks:*:939001610192:nodegroup/st-eks-*/*/*", | ||
| "arn:aws:eks:*:939001610192:addon/st-eks-*/*/*", | ||
| "arn:aws:eks:*:939001610192:access-entry/st-eks-*/*/*/*/*", | ||
| "arn:aws:eks:*:939001610192:accessEntry/st-eks-*/*/*/*/*" | ||
| ] | ||
| }, | ||
| { | ||
| "Sid": "EksRead", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "eks:DescribeAddonVersions", | ||
| "eks:DescribeAddonConfiguration", | ||
| "eks:ListClusters" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Sid": "Ec2AndAutoscaling", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:*", | ||
| "autoscaling:*", | ||
| "elasticloadbalancing:*" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Sid": "SsmAmiLookup", | ||
| "Effect": "Allow", | ||
| "Action": "ssm:GetParameter", | ||
| "Resource": [ | ||
| "arn:aws:ssm:*::parameter/aws/service/eks/optimized-ami/*", | ||
| "arn:aws:ssm:*::parameter/aws/service/bottlerocket/*" | ||
| ] | ||
| }, | ||
| { | ||
| "Sid": "IamCreateRoleBounded", | ||
| "Effect": "Allow", | ||
| "Action": "iam:CreateRole", | ||
| "Resource": "arn:aws:iam::939001610192:role/eksctl-st-eks-*", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "iam:PermissionsBoundary": "arn:aws:iam::939001610192:policy/eks-ci-smoke-boundary" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Sid": "IamScopedRoleLifecycle", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "iam:DeleteRole", | ||
| "iam:GetRole", | ||
| "iam:TagRole", | ||
| "iam:UntagRole", | ||
| "iam:AttachRolePolicy", | ||
| "iam:DetachRolePolicy", | ||
| "iam:PutRolePolicy", | ||
| "iam:GetRolePolicy", | ||
| "iam:DeleteRolePolicy", | ||
| "iam:ListRolePolicies", | ||
| "iam:ListAttachedRolePolicies", | ||
| "iam:ListInstanceProfilesForRole", | ||
| "iam:PassRole" | ||
| ], | ||
| "Resource": "arn:aws:iam::939001610192:role/eksctl-st-eks-*" | ||
| }, | ||
| { | ||
| "Sid": "IamScopedInstanceProfiles", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "iam:CreateInstanceProfile", | ||
| "iam:DeleteInstanceProfile", | ||
| "iam:GetInstanceProfile", | ||
| "iam:TagInstanceProfile", | ||
| "iam:AddRoleToInstanceProfile", | ||
| "iam:RemoveRoleFromInstanceProfile" | ||
| ], | ||
| "Resource": "arn:aws:iam::939001610192:instance-profile/eksctl-st-eks-*" | ||
| }, | ||
| { | ||
| "Sid": "IamServiceLinkedRoles", | ||
| "Effect": "Allow", | ||
| "Action": "iam:CreateServiceLinkedRole", | ||
| "Resource": "*", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "iam:AWSServiceName": [ | ||
| "eks.amazonaws.com", | ||
| "eks-nodegroup.amazonaws.com", | ||
| "autoscaling.amazonaws.com", | ||
| "elasticloadbalancing.amazonaws.com" | ||
| ] | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Sid": "IamOidcProviderLifecycle", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "iam:CreateOpenIDConnectProvider", | ||
| "iam:DeleteOpenIDConnectProvider", | ||
| "iam:TagOpenIDConnectProvider", | ||
| "iam:UntagOpenIDConnectProvider" | ||
| ], | ||
| "Resource": "arn:aws:iam::939001610192:oidc-provider/oidc.eks.*" | ||
| }, | ||
| { | ||
| "Sid": "IamReadForEksctl", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "iam:GetOpenIDConnectProvider", | ||
|
devantler marked this conversation as resolved.
|
||
| "iam:ListPolicies", | ||
| "iam:GetPolicy", | ||
| "iam:GetPolicyVersion" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Sid": "StsIdentity", | ||
| "Effect": "Allow", | ||
| "Action": "sts:GetCallerIdentity", | ||
| "Resource": "*" | ||
| } | ||
| ] | ||
| } | ||
| providerConfigRef: | ||
| kind: ProviderConfig | ||
| name: default | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| # Permissions boundary for every IAM role the eks-ci principal creates | ||
| # (eksctl-st-eks-* cluster/nodegroup/IRSA roles). eks-ci-role.yaml conditions | ||
| # iam:CreateRole on this boundary (iam:PermissionsBoundary), and the principal | ||
| # holds no iam:*PermissionsBoundary or role-update actions, so a workflow that | ||
| # assumes eks-ci cannot mint a role more privileged than this cap and pass it | ||
| # to EC2 to escape the smoke-test scope. The allowlist is the union of what | ||
| # eksctl-created cluster/node/IRSA roles exercise in the smoke path (EKS | ||
| # control plane, node compute/networking, ECR pulls, CNI, logs/metrics, SSM | ||
| # agent channels); deliberately NO iam:* or sts:AssumeRole* — a bounded role | ||
| # stays inside the compute plane even if an arbitrary inline policy is put on | ||
| # it. If a future smoke needs an action outside the cap, the failure names it | ||
| # and this file is the tuning point. | ||
| # | ||
| # Requires the policies.iam.aws.m.upbound.io MRD activated platform-side (the | ||
| # aws ManagedResourceActivationPolicy); merge that platform change first or | ||
| # this manifest sits Pending without error. | ||
| apiVersion: iam.aws.m.upbound.io/v1beta1 | ||
| kind: Policy | ||
| metadata: | ||
| name: eks-ci-smoke-boundary | ||
| spec: | ||
| forProvider: | ||
| description: >- | ||
| Permissions boundary capping IAM roles created by the eks-ci GitHub | ||
| OIDC role for throwaway st-eks-* smoke clusters. | ||
| policy: | | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Sid": "SmokeComputePlaneCap", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "autoscaling:*", | ||
| "cloudwatch:*", | ||
| "ec2:*", | ||
| "ec2messages:*", | ||
| "ecr:BatchCheckLayerAvailability", | ||
| "ecr:BatchGetImage", | ||
| "ecr:GetAuthorizationToken", | ||
| "ecr:GetDownloadUrlForLayer", | ||
| "eks:*", | ||
| "eks-auth:AssumeRoleForPodIdentity", | ||
| "elasticloadbalancing:*", | ||
| "kms:CreateGrant", | ||
| "kms:DescribeKey", | ||
| "logs:*", | ||
| "ssm:GetParameter", | ||
| "ssm:GetParameters", | ||
| "ssmmessages:*", | ||
| "sts:GetCallerIdentity", | ||
| "sts:TagSession" | ||
| ], | ||
| "Resource": "*" | ||
| } | ||
| ] | ||
| } | ||
| providerConfigRef: | ||
| kind: ProviderConfig | ||
| name: default |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.