Skip to content

Commit 833bfd3

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5286 from robinkb/main
✨ Support setting role path and permissions boundary on managed IAM roles
2 parents 87020b2 + 9c4d4d0 commit 833bfd3

16 files changed

+297
-33
lines changed

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/conversion.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,7 @@ import (
2525
func Convert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in *v1beta1.AWSIAMConfigurationSpec, out *AWSIAMConfigurationSpec, s conversion.Scope) error {
2626
return autoConvert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in, out, s)
2727
}
28+
29+
func Convert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in *v1beta1.AWSIAMRoleSpec, out *AWSIAMRoleSpec, s conversion.Scope) error {
30+
return autoConvert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in, out, s)
31+
}

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/zz_generated.conversion.go

Lines changed: 61 additions & 16 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/clusterawsadm/api/bootstrap/v1beta1/types.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,14 @@ type AWSIAMRoleSpec struct {
8383
// ExtraStatements are additional IAM statements to be included inline for the role.
8484
ExtraStatements []iamv1.StatementEntry `json:"extraStatements,omitempty"`
8585

86+
// Path sets the path to the role.
87+
// +optional
88+
Path string `json:"path,omitempty"`
89+
90+
// PermissionsBoundary sets the ARN of the managed policy that is used to set the permissions boundary for the role.
91+
// +optional
92+
PermissionsBoundary string `json:"permissionsBoundary,omitempty"`
93+
8694
// TrustStatements is an IAM PolicyDocument defining what identities are allowed to assume this role.
8795
// See "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/iam/v1beta1" for more documentation.
8896
TrustStatements []iamv1.StatementEntry `json:"trustStatements,omitempty"`

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,24 +138,30 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
138138

139139
template.Resources[AWSIAMRoleControlPlane] = &cfn_iam.Role{
140140
RoleName: t.NewManagedName("control-plane"),
141+
Path: t.Spec.ControlPlane.Path,
141142
AssumeRolePolicyDocument: t.controlPlaneTrustPolicy(),
142143
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
143144
Policies: t.controlPlanePolicies(),
145+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
144146
Tags: converters.MapToCloudFormationTags(t.Spec.ControlPlane.Tags),
145147
}
146148

147149
template.Resources[AWSIAMRoleControllers] = &cfn_iam.Role{
148150
RoleName: t.NewManagedName("controllers"),
151+
Path: t.Spec.ControlPlane.Path,
149152
AssumeRolePolicyDocument: t.controllersTrustPolicy(),
150153
Policies: t.controllersRolePolicy(),
154+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
151155
Tags: converters.MapToCloudFormationTags(t.Spec.ClusterAPIControllers.Tags),
152156
}
153157

154158
template.Resources[AWSIAMRoleNodes] = &cfn_iam.Role{
155159
RoleName: t.NewManagedName("nodes"),
160+
Path: t.Spec.ControlPlane.Path,
156161
AssumeRolePolicyDocument: t.nodeTrustPolicy(),
157162
ManagedPolicyArns: t.nodeManagedPolicies(),
158163
Policies: t.nodePolicies(),
164+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
159165
Tags: converters.MapToCloudFormationTags(t.Spec.Nodes.Tags),
160166
}
161167

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2937,6 +2937,30 @@ spec:
29372937
and no name is supplied then a role is created.
29382938
minLength: 2
29392939
type: string
2940+
rolePath:
2941+
description: |-
2942+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
2943+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
2944+
in the IAM User Guide.
2945+
2946+
This parameter is optional. If it is not included, it defaults to a slash
2947+
(/).
2948+
type: string
2949+
rolePermissionsBoundary:
2950+
description: |-
2951+
RolePermissionsBoundary sets the ARN of the managed policy that is used
2952+
to set the permissions boundary for the role.
2953+
2954+
A permissions boundary policy defines the maximum permissions that identity-based
2955+
policies can grant to an entity, but does not grant permissions. Permissions
2956+
boundaries do not define the maximum permissions that a resource-based policy
2957+
can grant to an entity. To learn more, see Permissions boundaries for IAM
2958+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
2959+
in the IAM User Guide.
2960+
2961+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
2962+
in the IAM User Guide.
2963+
type: string
29402964
secondaryCidrBlock:
29412965
description: |-
29422966
SecondaryCidrBlock is the additional CIDR range to use for pod IPs.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsfargateprofiles.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,30 @@ spec:
264264
and not delete it on deletion. If the EKSEnableIAM feature
265265
flag is true and no name is supplied then a role is created.
266266
type: string
267+
rolePath:
268+
description: |-
269+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
270+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
271+
in the IAM User Guide.
272+
273+
This parameter is optional. If it is not included, it defaults to a slash
274+
(/).
275+
type: string
276+
rolePermissionsBoundary:
277+
description: |-
278+
RolePermissionsBoundary sets the ARN of the managed policy that is used
279+
to set the permissions boundary for the role.
280+
281+
A permissions boundary policy defines the maximum permissions that identity-based
282+
policies can grant to an entity, but does not grant permissions. Permissions
283+
boundaries do not define the maximum permissions that a resource-based policy
284+
can grant to an entity. To learn more, see Permissions boundaries for IAM
285+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
286+
in the IAM User Guide.
287+
288+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
289+
in the IAM User Guide.
290+
type: string
267291
selectors:
268292
description: Selectors specify fargate pod selectors.
269293
items:

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -938,6 +938,30 @@ spec:
938938
and not delete it on deletion. If the EKSEnableIAM feature
939939
flag is true and no name is supplied then a role is created.
940940
type: string
941+
rolePath:
942+
description: |-
943+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
944+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
945+
in the IAM User Guide.
946+
947+
This parameter is optional. If it is not included, it defaults to a slash
948+
(/).
949+
type: string
950+
rolePermissionsBoundary:
951+
description: |-
952+
RolePermissionsBoundary sets the ARN of the managed policy that is used
953+
to set the permissions boundary for the role.
954+
955+
A permissions boundary policy defines the maximum permissions that identity-based
956+
policies can grant to an entity, but does not grant permissions. Permissions
957+
boundaries do not define the maximum permissions that a resource-based policy
958+
can grant to an entity. To learn more, see Permissions boundaries for IAM
959+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
960+
in the IAM User Guide.
961+
962+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
963+
in the IAM User Guide.
964+
type: string
941965
scaling:
942966
description: Scaling specifies scaling for the ASG behind this pool
943967
properties:

‎controlplane/eks/api/v1beta1/conversion.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ func (r *AWSManagedControlPlane) ConvertTo(dstRaw conversion.Hub) error {
4242
dst.Spec.VpcCni.Disable = r.Spec.DisableVPCCNI
4343
dst.Spec.Partition = restored.Spec.Partition
4444
dst.Spec.RestrictPrivateSubnets = restored.Spec.RestrictPrivateSubnets
45+
dst.Spec.RolePath = restored.Spec.RolePath
46+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
4547
dst.Status.Version = restored.Status.Version
4648
dst.Spec.BootstrapSelfManagedAddons = restored.Spec.BootstrapSelfManagedAddons
4749
return nil

‎controlplane/eks/api/v1beta1/zz_generated.conversion.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,30 @@ type AWSManagedControlPlaneSpec struct { //nolint: maligned
8888
// +optional
8989
RoleAdditionalPolicies *[]string `json:"roleAdditionalPolicies,omitempty"`
9090

91+
// RolePath sets the path to the role. For more information about paths, see IAM Identifiers
92+
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
93+
// in the IAM User Guide.
94+
//
95+
// This parameter is optional. If it is not included, it defaults to a slash
96+
// (/).
97+
// +optional
98+
RolePath string `json:"rolePath,omitempty"`
99+
100+
// RolePermissionsBoundary sets the ARN of the managed policy that is used
101+
// to set the permissions boundary for the role.
102+
//
103+
// A permissions boundary policy defines the maximum permissions that identity-based
104+
// policies can grant to an entity, but does not grant permissions. Permissions
105+
// boundaries do not define the maximum permissions that a resource-based policy
106+
// can grant to an entity. To learn more, see Permissions boundaries for IAM
107+
// entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
108+
// in the IAM User Guide.
109+
//
110+
// For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
111+
// in the IAM User Guide.
112+
// +optional
113+
RolePermissionsBoundary string `json:"rolePermissionsBoundary,omitempty"`
114+
91115
// Logging specifies which EKS Cluster logs should be enabled. Entries for
92116
// each of the enabled logs will be sent to CloudWatch
93117
// +optional

‎exp/api/v1beta1/conversion.go

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,9 @@ func (src *AWSManagedMachinePool) ConvertTo(dstRaw conversion.Hub) error {
130130
dst.Spec.AvailabilityZoneSubnetType = restored.Spec.AvailabilityZoneSubnetType
131131
}
132132

133+
dst.Spec.RolePath = restored.Spec.RolePath
134+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
135+
133136
return nil
134137
}
135138

@@ -169,14 +172,33 @@ func (r *AWSManagedMachinePoolList) ConvertFrom(srcRaw conversion.Hub) error {
169172
// ConvertTo converts the v1beta1 AWSFargateProfile receiver to a v1beta2 AWSFargateProfile.
170173
func (src *AWSFargateProfile) ConvertTo(dstRaw conversion.Hub) error {
171174
dst := dstRaw.(*infrav1exp.AWSFargateProfile)
172-
return Convert_v1beta1_AWSFargateProfile_To_v1beta2_AWSFargateProfile(src, dst, nil)
175+
176+
if err := Convert_v1beta1_AWSFargateProfile_To_v1beta2_AWSFargateProfile(src, dst, nil); err != nil {
177+
return err
178+
}
179+
180+
// Manually restore data.
181+
restored := &infrav1exp.AWSFargateProfile{}
182+
if ok, err := utilconversion.UnmarshalData(src, restored); err != nil || !ok {
183+
return err
184+
}
185+
186+
dst.Spec.RolePath = restored.Spec.RolePath
187+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
188+
189+
return nil
173190
}
174191

175192
// ConvertFrom converts the v1beta2 AWSFargateProfile receiver to v1beta1 AWSFargateProfile.
176193
func (r *AWSFargateProfile) ConvertFrom(srcRaw conversion.Hub) error {
177194
src := srcRaw.(*infrav1exp.AWSFargateProfile)
178195

179-
return Convert_v1beta2_AWSFargateProfile_To_v1beta1_AWSFargateProfile(src, r, nil)
196+
if err := Convert_v1beta2_AWSFargateProfile_To_v1beta1_AWSFargateProfile(src, r, nil); err != nil {
197+
return err
198+
}
199+
200+
// Preserve Hub data on down-conversion.
201+
return utilconversion.MarshalData(src, r)
180202
}
181203

182204
// ConvertTo converts the v1beta1 AWSFargateProfileList receiver to a v1beta2 AWSFargateProfileList.
@@ -239,3 +261,7 @@ func Convert_v1beta2_RefreshPreferences_To_v1beta1_RefreshPreferences(in *infrav
239261
// spec.refreshPreferences.disable has been added to v1beta2.
240262
return autoConvert_v1beta2_RefreshPreferences_To_v1beta1_RefreshPreferences(in, out, s)
241263
}
264+
265+
func Convert_v1beta2_FargateProfileSpec_To_v1beta1_FargateProfileSpec(in *infrav1exp.FargateProfileSpec, out *FargateProfileSpec, s apiconversion.Scope) error {
266+
return autoConvert_v1beta2_FargateProfileSpec_To_v1beta1_FargateProfileSpec(in, out, s)
267+
}

0 commit comments

Comments
 (0)