Merge pull request #11843 from olemarkus/reduce-policy-size-further

Reduce policy size further
kubernetes · Jul 4, 2021 · cf834ce · cf834ce
2 parents 577c7ec + aad2912
commit cf834ce
Show file tree

Hide file tree

Showing 118 changed files with 6,679 additions and 11,424 deletions.
diff --git a/pkg/model/components/addonmanifests/awsebscsidriver/iam.go b/pkg/model/components/addonmanifests/awsebscsidriver/iam.go
@@ -31,12 +31,12 @@ var _ iam.Subject = &ServiceAccount{}
 
 // BuildAWSPolicy generates a custom policy for a ServiceAccount IAM role.
 func (r *ServiceAccount) BuildAWSPolicy(b *iam.PolicyBuilder) (*iam.Policy, error) {
-	p := &iam.Policy{
-		Version: iam.PolicyDefaultVersion,
-	}
+
+	clusterName := b.Cluster.ObjectMeta.Name
+	p := iam.NewPolicy(clusterName)
 
 	addSnapshotControllerPermissions := b.Cluster.Spec.SnapshotController != nil && fi.BoolValue(b.Cluster.Spec.SnapshotController.Enabled)
-	iam.AddAWSEBSCSIDriverPermissions(p, b.Cluster.ObjectMeta.Name, addSnapshotControllerPermissions)
+	iam.AddAWSEBSCSIDriverPermissions(p, addSnapshotControllerPermissions)
 
 	return p, nil
 }

diff --git a/pkg/model/components/addonmanifests/awsloadbalancercontroller/BUILD.bazel b/pkg/model/components/addonmanifests/awsloadbalancercontroller/BUILD.bazel
diff --git a/pkg/model/components/addonmanifests/awsloadbalancercontroller/iam.go b/pkg/model/components/addonmanifests/awsloadbalancercontroller/iam.go
@@ -19,7 +19,6 @@ package awsloadbalancercontroller
 import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/kops/pkg/model/iam"
-	"k8s.io/kops/pkg/util/stringorslice"
 )
 
 // ServiceAccount represents the service-account used by the dns-controller.
@@ -31,15 +30,12 @@ var _ iam.Subject = &ServiceAccount{}
 
 // BuildAWSPolicy generates a custom policy for a ServiceAccount IAM role.
 func (r *ServiceAccount) BuildAWSPolicy(b *iam.PolicyBuilder) (*iam.Policy, error) {
-	p := &iam.Policy{
-		Version: iam.PolicyDefaultVersion,
-	}
-
-	resource := stringorslice.Slice([]string{"*"})
 	clusterName := b.Cluster.ObjectMeta.Name
-	iam.AddAWSLoadbalancerControllerPermissions(p, resource, clusterName)
-	iam.AddMasterEC2Policies(p, resource, clusterName)
-	iam.AddMasterELBPolicies(p, resource)
+	p := iam.NewPolicy(clusterName)
+
+	iam.AddAWSLoadbalancerControllerPermissions(p)
+	iam.AddMasterEC2Policies(p)
+	iam.AddMasterELBPolicies(p)
 
 	return p, nil
 }

diff --git a/pkg/model/components/addonmanifests/clusterautoscaler/iam.go b/pkg/model/components/addonmanifests/clusterautoscaler/iam.go
@@ -30,11 +30,11 @@ var _ iam.Subject = &ServiceAccount{}
 
 // BuildAWSPolicy generates a custom policy for a ServiceAccount IAM role.
 func (r *ServiceAccount) BuildAWSPolicy(b *iam.PolicyBuilder) (*iam.Policy, error) {
-	p := &iam.Policy{
-		Version: iam.PolicyDefaultVersion,
-	}
 
-	iam.AddClusterAutoscalerPermissions(p, b.Cluster.ObjectMeta.Name)
+	clusterName := b.Cluster.ObjectMeta.Name
+	p := iam.NewPolicy(clusterName)
+
+	iam.AddClusterAutoscalerPermissions(p)
 
 	return p, nil
 }

diff --git a/pkg/model/components/addonmanifests/dnscontroller/iam.go b/pkg/model/components/addonmanifests/dnscontroller/iam.go
@@ -30,9 +30,8 @@ var _ iam.Subject = &ServiceAccount{}
 
 // BuildAWSPolicy generates a custom policy for a ServiceAccount IAM role.
 func (r *ServiceAccount) BuildAWSPolicy(b *iam.PolicyBuilder) (*iam.Policy, error) {
-	p := &iam.Policy{
-		Version: iam.PolicyDefaultVersion,
-	}
+	clusterName := b.Cluster.ObjectMeta.Name
+	p := iam.NewPolicy(clusterName)
 
 	iam.AddDNSControllerPermissions(b, p)