IAM ServiceAccount Roles: truncate name at 64 characters

pkg/model/iam/BUILD.bazel

@@ -16,6 +16,7 @@ go_library(
         "//pkg/wellknownusers:go_default_library",
         "//upup/pkg/fi:go_default_library",
         "//upup/pkg/fi/cloudup/awstasks:go_default_library",
+        "//upup/pkg/fi/cloudup/awsup:go_default_library",
         "//util/pkg/vfs:go_default_library",
         "//vendor/k8s.io/api/core/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",

pkg/model/iam/types.go

@@ -21,8 +21,12 @@ import (
 	"fmt"
 
 	"k8s.io/kops/pkg/apis/kops"
+	"k8s.io/kops/upup/pkg/fi/cloudup/awsup"
 )
 
+// MaxLengthIAMRoleName defines the max length of an IAMRole name
+const MaxLengthIAMRoleName = 64
+
 // ParseStatements parses JSON into a list of Statements
 func ParseStatements(policy string) ([]*Statement, error) {
 	statements := make([]*Statement, 0)
@@ -48,7 +52,10 @@ func (b *IAMModelContext) IAMNameForServiceAccountRole(role Subject) (string, er
 		return "", fmt.Errorf("role %v does not have ServiceAccount", role)
 	}
 
-	return serviceAccount.Name + "." + serviceAccount.Namespace + ".sa." + b.ClusterName(), nil
+	name := serviceAccount.Name + "." + serviceAccount.Namespace + ".sa." + b.ClusterName()
+	name = awsup.TruncateString(name, awsup.TruncateStringOptions{MaxLength: MaxLengthIAMRoleName, AlwaysAddHash: false})
+
+	return name, nil
 }
 
 // ClusterName returns the cluster name

upup/pkg/fi/cloudup/awsup/aws_utils.go

@@ -207,18 +207,55 @@ func EC2TagSpecification(resourceType string, tags map[string]string) []*ec2.Tag
 func GetResourceName32(cluster string, prefix string) string {
 	s := prefix + "-" + strings.Replace(cluster, ".", "-", -1)
 
+	// We always compute the hash and add it, lest we trick users into assuming that we never do this
+	opt := TruncateStringOptions{
+		MaxLength:     32,
+		AlwaysAddHash: true,
+		HashLength:    6,
+	}
+	return TruncateString(s, opt)
+}
+
+// TruncateStringOptions contains parameters for how we truncate strings
+type TruncateStringOptions struct {
+	// AlwaysAddHash will always cause the hash to be appended.
+	// Useful to stop users assuming that the name will never be truncated.
+	AlwaysAddHash bool
+
+	// MaxLength controls the maximum length of the string.
+	MaxLength int
+
+	// HashLength controls the length of the hash to be appended.
+	HashLength int
+}
+
+// TruncateString will attempt to truncate a string to a max, adding a prefix to avoid collisions.
+// Will never return a string longer than maxLength chars
+func TruncateString(s string, opt TruncateStringOptions) string {
+	if opt.MaxLength == 0 {
+		klog.Fatalf("MaxLength must be set")
+	}
+
+	if !opt.AlwaysAddHash && len(s) <= opt.MaxLength {
+		return s
+	}
+
+	if opt.HashLength == 0 {
+		opt.HashLength = 6
+	}
+
 	// We always compute the hash and add it, lest we trick users into assuming that we never do this
 	h := fnv.New32a()
 	if _, err := h.Write([]byte(s)); err != nil {
 		klog.Fatalf("error hashing values: %v", err)
 	}
 	hashString := base32.HexEncoding.EncodeToString(h.Sum(nil))
 	hashString = strings.ToLower(hashString)
-	if len(hashString) > 6 {
-		hashString = hashString[:6]
+	if len(hashString) > opt.HashLength {
+		hashString = hashString[:opt.HashLength]
 	}
 
-	maxBaseLength := 32 - len(hashString) - 1
+	maxBaseLength := opt.MaxLength - len(hashString) - 1
 	if len(s) > maxBaseLength {
 		s = s[:maxBaseLength]
 	}

upup/pkg/fi/cloudup/awsup/aws_utils_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package awsup
 
 import (
+	"fmt"
 	"reflect"
 	"testing"
 
@@ -140,3 +141,55 @@ func Test_GetResourceName32(t *testing.T) {
 		}
 	}
 }
+
+func TestTruncateString(t *testing.T) {
+	grid := []struct {
+		Input         string
+		Expected      string
+		MaxLength     int
+		AlwaysAddHash bool
+	}{
+		{
+			Input:     "foo",
+			Expected:  "foo",
+			MaxLength: 64,
+		},
+		{
+			Input:     "this_string_is_33_characters_long",
+			Expected:  "this_string_is_33_characters_long",
+			MaxLength: 64,
+		},
+		{
+			Input:         "this_string_is_33_characters_long",
+			Expected:      "this_string_is_33_characters_long-t4mk8d",
+			MaxLength:     64,
+			AlwaysAddHash: true,
+		},
+		{
+			Input:     "this_string_is_longer_it_is_46_characters_long",
+			Expected:  "this_string_is_longer_it_-ha2gug",
+			MaxLength: 32,
+		},
+		{
+			Input:         "this_string_is_longer_it_is_46_characters_long",
+			Expected:      "this_string_is_longer_it_-ha2gug",
+			MaxLength:     32,
+			AlwaysAddHash: true,
+		},
+		{
+			Input:     "this_string_is_even_longer_due_to_extreme_verbosity_it_is_in_fact_84_characters_long",
+			Expected:  "this_string_is_even_longer_due_to_extreme_verbosity_it_is-7mc0g6",
+			MaxLength: 64,
+		},
+	}
+
+	for _, g := range grid {
+		t.Run(fmt.Sprintf("input:%s/maxLength:%d/alwaysAddHash:%v", g.Input, g.MaxLength, g.AlwaysAddHash), func(t *testing.T) {
+			opt := TruncateStringOptions{MaxLength: g.MaxLength, AlwaysAddHash: g.AlwaysAddHash}
+			actual := TruncateString(g.Input, opt)
+			if actual != g.Expected {
+				t.Errorf("TruncateString(%q, %+v) => %q, expected %q", g.Input, opt, actual, g.Expected)
+			}
+		})
+	}
+}