Skip to content

Commit 21e6453

Browse files
author
root
committed
Merge remote-tracking branch 'origin/main' into addons-preserve
2 parents bede485 + e9f2823 commit 21e6453

25 files changed

+5346
-2940
lines changed

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/conversion.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,7 @@ import (
2525
func Convert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in *v1beta1.AWSIAMConfigurationSpec, out *AWSIAMConfigurationSpec, s conversion.Scope) error {
2626
return autoConvert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in, out, s)
2727
}
28+
29+
func Convert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in *v1beta1.AWSIAMRoleSpec, out *AWSIAMRoleSpec, s conversion.Scope) error {
30+
return autoConvert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in, out, s)
31+
}

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/zz_generated.conversion.go

Lines changed: 61 additions & 16 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/clusterawsadm/api/bootstrap/v1beta1/types.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,14 @@ type AWSIAMRoleSpec struct {
8383
// ExtraStatements are additional IAM statements to be included inline for the role.
8484
ExtraStatements []iamv1.StatementEntry `json:"extraStatements,omitempty"`
8585

86+
// Path sets the path to the role.
87+
// +optional
88+
Path string `json:"path,omitempty"`
89+
90+
// PermissionsBoundary sets the ARN of the managed policy that is used to set the permissions boundary for the role.
91+
// +optional
92+
PermissionsBoundary string `json:"permissionsBoundary,omitempty"`
93+
8694
// TrustStatements is an IAM PolicyDocument defining what identities are allowed to assume this role.
8795
// See "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/iam/v1beta1" for more documentation.
8896
TrustStatements []iamv1.StatementEntry `json:"trustStatements,omitempty"`

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,24 +138,30 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
138138

139139
template.Resources[AWSIAMRoleControlPlane] = &cfn_iam.Role{
140140
RoleName: t.NewManagedName("control-plane"),
141+
Path: t.Spec.ControlPlane.Path,
141142
AssumeRolePolicyDocument: t.controlPlaneTrustPolicy(),
142143
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
143144
Policies: t.controlPlanePolicies(),
145+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
144146
Tags: converters.MapToCloudFormationTags(t.Spec.ControlPlane.Tags),
145147
}
146148

147149
template.Resources[AWSIAMRoleControllers] = &cfn_iam.Role{
148150
RoleName: t.NewManagedName("controllers"),
151+
Path: t.Spec.ControlPlane.Path,
149152
AssumeRolePolicyDocument: t.controllersTrustPolicy(),
150153
Policies: t.controllersRolePolicy(),
154+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
151155
Tags: converters.MapToCloudFormationTags(t.Spec.ClusterAPIControllers.Tags),
152156
}
153157

154158
template.Resources[AWSIAMRoleNodes] = &cfn_iam.Role{
155159
RoleName: t.NewManagedName("nodes"),
160+
Path: t.Spec.ControlPlane.Path,
156161
AssumeRolePolicyDocument: t.nodeTrustPolicy(),
157162
ManagedPolicyArns: t.nodeManagedPolicies(),
158163
Policies: t.nodePolicies(),
164+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
159165
Tags: converters.MapToCloudFormationTags(t.Spec.Nodes.Tags),
160166
}
161167

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2938,6 +2938,30 @@ spec:
29382938
and no name is supplied then a role is created.
29392939
minLength: 2
29402940
type: string
2941+
rolePath:
2942+
description: |-
2943+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
2944+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
2945+
in the IAM User Guide.
2946+
2947+
This parameter is optional. If it is not included, it defaults to a slash
2948+
(/).
2949+
type: string
2950+
rolePermissionsBoundary:
2951+
description: |-
2952+
RolePermissionsBoundary sets the ARN of the managed policy that is used
2953+
to set the permissions boundary for the role.
2954+
2955+
A permissions boundary policy defines the maximum permissions that identity-based
2956+
policies can grant to an entity, but does not grant permissions. Permissions
2957+
boundaries do not define the maximum permissions that a resource-based policy
2958+
can grant to an entity. To learn more, see Permissions boundaries for IAM
2959+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
2960+
in the IAM User Guide.
2961+
2962+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
2963+
in the IAM User Guide.
2964+
type: string
29412965
secondaryCidrBlock:
29422966
description: |-
29432967
SecondaryCidrBlock is the additional CIDR range to use for pod IPs.

‎config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -911,6 +911,9 @@ spec:
911911
description: Ready denotes that the ROSAControlPlane API Server is
912912
ready to receive requests.
913913
type: boolean
914+
version:
915+
description: OpenShift semantic version, for example "4.14.5".
916+
type: string
914917
required:
915918
- ready
916919
type: object

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsfargateprofiles.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,30 @@ spec:
264264
and not delete it on deletion. If the EKSEnableIAM feature
265265
flag is true and no name is supplied then a role is created.
266266
type: string
267+
rolePath:
268+
description: |-
269+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
270+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
271+
in the IAM User Guide.
272+
273+
This parameter is optional. If it is not included, it defaults to a slash
274+
(/).
275+
type: string
276+
rolePermissionsBoundary:
277+
description: |-
278+
RolePermissionsBoundary sets the ARN of the managed policy that is used
279+
to set the permissions boundary for the role.
280+
281+
A permissions boundary policy defines the maximum permissions that identity-based
282+
policies can grant to an entity, but does not grant permissions. Permissions
283+
boundaries do not define the maximum permissions that a resource-based policy
284+
can grant to an entity. To learn more, see Permissions boundaries for IAM
285+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
286+
in the IAM User Guide.
287+
288+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
289+
in the IAM User Guide.
290+
type: string
267291
selectors:
268292
description: Selectors specify fargate pod selectors.
269293
items:

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -938,6 +938,30 @@ spec:
938938
and not delete it on deletion. If the EKSEnableIAM feature
939939
flag is true and no name is supplied then a role is created.
940940
type: string
941+
rolePath:
942+
description: |-
943+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
944+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
945+
in the IAM User Guide.
946+
947+
This parameter is optional. If it is not included, it defaults to a slash
948+
(/).
949+
type: string
950+
rolePermissionsBoundary:
951+
description: |-
952+
RolePermissionsBoundary sets the ARN of the managed policy that is used
953+
to set the permissions boundary for the role.
954+
955+
A permissions boundary policy defines the maximum permissions that identity-based
956+
policies can grant to an entity, but does not grant permissions. Permissions
957+
boundaries do not define the maximum permissions that a resource-based policy
958+
can grant to an entity. To learn more, see Permissions boundaries for IAM
959+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
960+
in the IAM User Guide.
961+
962+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
963+
in the IAM User Guide.
964+
type: string
941965
scaling:
942966
description: Scaling specifies scaling for the ASG behind this pool
943967
properties:

‎controllers/awsmachine_controller.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,7 @@ func (r *AWSMachineReconciler) Reconcile(ctx context.Context, req ctrl.Request)
204204
machineScope, err := scope.NewMachineScope(scope.MachineScopeParams{
205205
Client: r.Client,
206206
Cluster: cluster,
207+
Logger: log,
207208
Machine: machine,
208209
InfraCluster: infraCluster,
209210
AWSMachine: awsMachine,

‎controlplane/eks/api/v1beta1/conversion.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ func (r *AWSManagedControlPlane) ConvertTo(dstRaw conversion.Hub) error {
4242
dst.Spec.VpcCni.Disable = r.Spec.DisableVPCCNI
4343
dst.Spec.Partition = restored.Spec.Partition
4444
dst.Spec.RestrictPrivateSubnets = restored.Spec.RestrictPrivateSubnets
45+
dst.Spec.RolePath = restored.Spec.RolePath
46+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
4547
dst.Status.Version = restored.Status.Version
4648
dst.Spec.BootstrapSelfManagedAddons = restored.Spec.BootstrapSelfManagedAddons
4749
return nil

‎controlplane/eks/api/v1beta1/zz_generated.conversion.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,30 @@ type AWSManagedControlPlaneSpec struct { //nolint: maligned
8888
// +optional
8989
RoleAdditionalPolicies *[]string `json:"roleAdditionalPolicies,omitempty"`
9090

91+
// RolePath sets the path to the role. For more information about paths, see IAM Identifiers
92+
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
93+
// in the IAM User Guide.
94+
//
95+
// This parameter is optional. If it is not included, it defaults to a slash
96+
// (/).
97+
// +optional
98+
RolePath string `json:"rolePath,omitempty"`
99+
100+
// RolePermissionsBoundary sets the ARN of the managed policy that is used
101+
// to set the permissions boundary for the role.
102+
//
103+
// A permissions boundary policy defines the maximum permissions that identity-based
104+
// policies can grant to an entity, but does not grant permissions. Permissions
105+
// boundaries do not define the maximum permissions that a resource-based policy
106+
// can grant to an entity. To learn more, see Permissions boundaries for IAM
107+
// entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
108+
// in the IAM User Guide.
109+
//
110+
// For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
111+
// in the IAM User Guide.
112+
// +optional
113+
RolePermissionsBoundary string `json:"rolePermissionsBoundary,omitempty"`
114+
91115
// Logging specifies which EKS Cluster logs should be enabled. Entries for
92116
// each of the enabled logs will be sent to CloudWatch
93117
// +optional

‎controlplane/rosa/api/v1beta2/rosacontrolplane_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -749,6 +749,10 @@ type RosaControlPlaneStatus struct {
749749
// OIDCEndpointURL is the endpoint url for the managed OIDC provider.
750750
OIDCEndpointURL string `json:"oidcEndpointURL,omitempty"`
751751

752+
// OpenShift semantic version, for example "4.14.5".
753+
// +optional
754+
Version string `json:"version"`
755+
752756
// Available upgrades for the ROSA hosted control plane.
753757
AvailableUpgrades []string `json:"availableUpgrades,omitempty"`
754758
}

‎controlplane/rosa/controllers/rosacontrolplane_controller.go

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,8 @@ type ROSAControlPlaneReconciler struct {
9494
Endpoints []scope.ServiceEndpoint
9595
NewStsClient func(cloud.ScopeUsage, cloud.Session, logger.Wrapper, runtime.Object) stsiface.STSAPI
9696
NewOCMClient func(ctx context.Context, rosaScope *scope.ROSAControlPlaneScope) (rosa.OCMClient, error)
97+
// Exposing the restClientConfig for integration test. No need to initialize.
98+
restClientConfig *restclient.Config
9799
}
98100

99101
// SetupWithManager is used to setup the controller.
@@ -252,6 +254,7 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
252254
rosaScope.ControlPlane.Status.ConsoleURL = cluster.Console().URL()
253255
rosaScope.ControlPlane.Status.OIDCEndpointURL = cluster.AWS().STS().OIDCEndpointURL()
254256
rosaScope.ControlPlane.Status.Ready = false
257+
rosaScope.ControlPlane.Status.Version = rosa.RawVersionID(cluster.Version())
255258

256259
switch cluster.Status().State() {
257260
case cmv1.ClusterStateReady:
@@ -801,13 +804,16 @@ func (r *ROSAControlPlaneReconciler) reconcileKubeconfig(ctx context.Context, ro
801804
return err
802805
}
803806

804-
clientConfig := &restclient.Config{
805-
Host: apiServerURL,
806-
Username: userName,
807+
if r.restClientConfig == nil {
808+
r.restClientConfig = &restclient.Config{
809+
Host: apiServerURL,
810+
Username: userName,
811+
}
807812
}
813+
808814
// request an acccess token using the credentials of the cluster admin user created earlier.
809815
// this token is used in the kubeconfig to authenticate with the API server.
810-
token, err := rosa.RequestToken(ctx, apiServerURL, userName, password, clientConfig)
816+
token, err := rosa.RequestToken(ctx, apiServerURL, userName, password, r.restClientConfig)
811817
if err != nil {
812818
return fmt.Errorf("failed to request token: %w", err)
813819
}

0 commit comments

Comments
 (0)