Update iamserviceaccount role policies

integration/tests/crud/creategetdelete_test.go

@@ -324,7 +324,7 @@ var _ = Describe("(Integration) Create, Get, Scale & Delete", func() {
 				})
 			})
 
-			Context("create and delete iamserviceaccounts", func() {
+			Context("create, update and delete iamserviceaccounts", func() {
 				var (
 					cfg  *api.ClusterConfig
 					ctl  *eks.ClusterProvider
@@ -346,7 +346,7 @@ var _ = Describe("(Integration) Create, Get, Scale & Delete", func() {
 					Expect(err).ShouldNot(HaveOccurred())
 				})
 
-				It("should enable OIDC and create two iamserviceaccounts", func() {
+				It("should enable OIDC, create two iamserviceaccounts and update the policies", func() {
 					{
 						exists, err := oidc.CheckProviderExists()
 						Expect(err).ShouldNot(HaveOccurred())
@@ -414,6 +414,19 @@ var _ = Describe("(Integration) Create, Get, Scale & Delete", func() {
 						Expect(sa.Annotations).To(HaveKey(api.AnnotationEKSRoleARN))
 						Expect(sa.Annotations[api.AnnotationEKSRoleARN]).To(MatchRegexp("^arn:aws:iam::.*:role/eksctl-" + truncate(params.ClusterName) + ".*$"))
 					}
+
+					cmds = []Cmd{
+						params.EksctlUpdateCmd.WithArgs(
+							"iamserviceaccount",
+							"--cluster", params.ClusterName,
+							"--name", "app-cache-access",
+							"--namespace", "app1",
+							"--attach-policy-arn", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
+							"--approve",
+						),
+					}
+
+					Expect(cmds).To(RunSuccessfully())
 				})
 
 				It("should list both iamserviceaccounts", func() {

pkg/actions/iam/create.go

@@ -0,0 +1,18 @@
+package iam
+
+import (
+	api "github.com/weaveworks/eksctl/pkg/apis/eksctl.io/v1alpha5"
+	"github.com/weaveworks/eksctl/pkg/ctl/cmdutils"
+	"github.com/weaveworks/eksctl/pkg/kubernetes"
+)
+
+func (a *Manager) CreateIAMServiceAccount(iamServiceAccounts []*api.ClusterIAMServiceAccount, plan bool) error {
+	taskTree := a.stackManager.NewTasksToCreateIAMServiceAccounts(iamServiceAccounts, a.oidcManager, kubernetes.NewCachedClientSet(a.clientSet))
+	taskTree.PlanMode = plan
+
+	err := doTasks(taskTree)
+
+	cmdutils.LogPlanModeWarning(plan && len(iamServiceAccounts) > 0)
+
+	return err
+}

pkg/actions/iam/iam.go

@@ -0,0 +1,51 @@
+package iam
+
+import (
+	"fmt"
+
+	"github.com/kris-nova/logger"
+	api "github.com/weaveworks/eksctl/pkg/apis/eksctl.io/v1alpha5"
+	"github.com/weaveworks/eksctl/pkg/cfn/manager"
+	"github.com/weaveworks/eksctl/pkg/eks"
+	iamoidc "github.com/weaveworks/eksctl/pkg/iam/oidc"
+	"github.com/weaveworks/eksctl/pkg/kubernetes"
+	"github.com/weaveworks/eksctl/pkg/utils/tasks"
+	kubeclient "k8s.io/client-go/kubernetes"
+)
+
+type Manager struct {
+	clusterName     string
+	clusterProvider *eks.ClusterProvider
+	oidcManager     *iamoidc.OpenIDConnectManager
+	stackManager    StackManager
+	clientSet       kubeclient.Interface
+}
+
+//go:generate counterfeiter -o fakes/fake_stack_manager.go . StackManager
+type StackManager interface {
+	ListStacksMatching(nameRegex string, statusFilters ...string) ([]*manager.Stack, error)
+	UpdateStack(stackName, changeSetName, description string, templateData manager.TemplateData, parameters map[string]string) error
+	NewTasksToCreateIAMServiceAccounts(serviceAccounts []*api.ClusterIAMServiceAccount, oidc *iamoidc.OpenIDConnectManager, clientSetGetter kubernetes.ClientSetGetter) *tasks.TaskTree
+}
+
+func New(clusterName string, clusterProvider *eks.ClusterProvider, stackManager StackManager, oidcManager *iamoidc.OpenIDConnectManager, clientSet kubeclient.Interface) *Manager {
+	return &Manager{
+		clusterName:     clusterName,
+		clusterProvider: clusterProvider,
+		oidcManager:     oidcManager,
+		stackManager:    stackManager,
+		clientSet:       clientSet,
+	}
+}
+
+func doTasks(taskTree *tasks.TaskTree) error {
+	logger.Info(taskTree.Describe())
+	if errs := taskTree.DoAllSync(); len(errs) > 0 {
+		logger.Info("%d error(s) occurred and IAM Role stacks haven't been updated properly, you may wish to check CloudFormation console", len(errs))
+		for _, err := range errs {
+			logger.Critical("%s\n", err.Error())
+		}
+		return fmt.Errorf("failed to create iamserviceaccount(s)")
+	}
+	return nil
+}