Skip to content

Commit

Permalink
./hack/update-expected.sh
Browse files Browse the repository at this point in the history
  • Loading branch information
@rifelpet
rifelpet committed Aug 20, 2021
1 parent 67007e1 commit 3db20be
Show file tree
Hide file tree
Showing 61 changed files with 1,083 additions and 2,364 deletions.
39 changes: 29 additions & 10 deletions pkg/model/iam/iam_builder.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,11 +49,12 @@ const PolicyDefaultVersion = "2012-10-17"

// Policy Struct is a collection of fields that form a valid AWS policy document
type Policy struct {
clusterName string
unconditionalAction sets.String
clusterTaggedAction sets.String
Statement []*Statement
Version string
clusterName string
unconditionalAction sets.String
clusterTaggedAction sets.String
clusterTaggedCreateAction sets.String
Statement []*Statement
Version string
}

// AsJSON converts the policy document to JSON format (parsable by AWS)
Expand All @@ -77,6 +78,18 @@ func (p *Policy) AsJSON() (string, error) {
},
})
}
if len(p.clusterTaggedCreateAction) > 0 {
p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow,
Action: stringorslice.Of(p.clusterTaggedCreateAction.List()...),
Resource: stringorslice.String("*"),
Condition: Condition{
"StringEquals": map[string]string{
"aws:RequestTag/KubernetesCluster": p.clusterName,
},
},
})
}

j, err := json.MarshalIndent(p, "", " ")
if err != nil {
Expand Down Expand Up @@ -261,10 +274,11 @@ func (b *PolicyBuilder) BuildAWSPolicy() (*Policy, error) {

func NewPolicy(clusterName string) *Policy {
p := &Policy{
Version: PolicyDefaultVersion,
clusterName: clusterName,
unconditionalAction: sets.NewString(),
clusterTaggedAction: sets.NewString(),
Version: PolicyDefaultVersion,
clusterName: clusterName,
unconditionalAction: sets.NewString(),
clusterTaggedAction: sets.NewString(),
clusterTaggedCreateAction: sets.NewString(),
}
return p
}
Expand Down Expand Up @@ -845,6 +859,9 @@ func AddCCMPermissions(p *Policy, cloudRoutes bool) {
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
)

p.clusterTaggedCreateAction.Insert(
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
Expand Down Expand Up @@ -951,10 +968,12 @@ func AddAWSEBSCSIDriverPermissions(p *Policy, appendSnapshotPermissions bool) {
"ec2:ModifyVolume", // aws.go
"ec2:ModifyInstanceAttribute", // aws.go
"ec2:AttachVolume", // aws.go
"ec2:CreateVolume", // aws.go
"ec2:DeleteVolume", // aws.go
"ec2:DetachVolume", // aws.go
)
p.clusterTaggedCreateAction.Insert(
"ec2:CreateVolume", // aws.go
)

p.Statement = append(p.Statement,
&Statement{
Expand Down
59 changes: 18 additions & 41 deletions pkg/model/iam/tests/iam_builder_master_strict.json
View file
Original file line number Diff line number Diff line change
@@ -1,14 +1,5 @@
{
"Statement": [
{
"Action": [
"ec2:DescribeVolumes"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": "ec2:AttachVolume",
"Condition": {
Expand Down Expand Up @@ -57,38 +48,6 @@
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": [
"ec2:CreateVolume"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "ec2:CreateTags",
"Condition": {
Expand Down Expand Up @@ -195,6 +154,24 @@
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerListeners",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
59 changes: 18 additions & 41 deletions pkg/model/iam/tests/iam_builder_master_strict_ecr.json
View file
Original file line number Diff line number Diff line change
@@ -1,14 +1,5 @@
{
"Statement": [
{
"Action": [
"ec2:DescribeVolumes"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": "ec2:AttachVolume",
"Condition": {
Expand Down Expand Up @@ -57,38 +48,6 @@
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": [
"ec2:CreateVolume"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "ec2:CreateTags",
"Condition": {
Expand Down Expand Up @@ -202,6 +161,24 @@
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerListeners",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
59 changes: 18 additions & 41 deletions tests/integration/update_cluster/apiservernodes/cloudformation.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1216,15 +1216,6 @@
],
"PolicyDocument": {
"Statement": [
{
"Action": [
"ec2:DescribeVolumes"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": "ec2:AttachVolume",
"Condition": {
Expand Down Expand Up @@ -1334,38 +1325,6 @@
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": [
"ec2:CreateVolume"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "ec2:CreateTags",
"Condition": {
Expand Down Expand Up @@ -1466,6 +1425,24 @@
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerListeners",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
47 changes: 18 additions & 29 deletions ...ate_cluster/aws-lb-controller/data/aws_iam_role_policy_masters.minimal.example.com_policy
View file
Original file line number Diff line number Diff line change
@@ -1,14 +1,5 @@
{
"Statement": [
{
"Action": [
"ec2:DescribeVolumes"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": "ec2:AttachVolume",
"Condition": {
Expand Down Expand Up @@ -118,26 +109,6 @@
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": [
"autoscaling:DescribeAutoScalingGroups",
Expand Down Expand Up @@ -203,6 +174,24 @@
},
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerListeners",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
Loading

0 comments on commit 3db20be

Please sign in to comment.