Skip to content

Commit 9c4d4d0

Browse files
robinkbrobinkb
committed
Support setting role path and permissions boundary for EKS control plane, EKS fargate profile, and managed machine pools
Signed-off-by: Robin Ketelbuters <[email protected]>
1 parent 777e8de commit 9c4d4d0

16 files changed

+297
-33
lines changed

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/conversion.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,7 @@ import (
2525
func Convert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in *v1beta1.AWSIAMConfigurationSpec, out *AWSIAMConfigurationSpec, s conversion.Scope) error {
2626
return autoConvert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in, out, s)
2727
}
28+
29+
func Convert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in *v1beta1.AWSIAMRoleSpec, out *AWSIAMRoleSpec, s conversion.Scope) error {
30+
return autoConvert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in, out, s)
31+
}

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/zz_generated.conversion.go

Lines changed: 61 additions & 16 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/clusterawsadm/api/bootstrap/v1beta1/types.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,14 @@ type AWSIAMRoleSpec struct {
8383
// ExtraStatements are additional IAM statements to be included inline for the role.
8484
ExtraStatements []iamv1.StatementEntry `json:"extraStatements,omitempty"`
8585

86+
// Path sets the path to the role.
87+
// +optional
88+
Path string `json:"path,omitempty"`
89+
90+
// PermissionsBoundary sets the ARN of the managed policy that is used to set the permissions boundary for the role.
91+
// +optional
92+
PermissionsBoundary string `json:"permissionsBoundary,omitempty"`
93+
8694
// TrustStatements is an IAM PolicyDocument defining what identities are allowed to assume this role.
8795
// See "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/iam/v1beta1" for more documentation.
8896
TrustStatements []iamv1.StatementEntry `json:"trustStatements,omitempty"`

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,24 +138,30 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
138138

139139
template.Resources[AWSIAMRoleControlPlane] = &cfn_iam.Role{
140140
RoleName: t.NewManagedName("control-plane"),
141+
Path: t.Spec.ControlPlane.Path,
141142
AssumeRolePolicyDocument: t.controlPlaneTrustPolicy(),
142143
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
143144
Policies: t.controlPlanePolicies(),
145+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
144146
Tags: converters.MapToCloudFormationTags(t.Spec.ControlPlane.Tags),
145147
}
146148

147149
template.Resources[AWSIAMRoleControllers] = &cfn_iam.Role{
148150
RoleName: t.NewManagedName("controllers"),
151+
Path: t.Spec.ControlPlane.Path,
149152
AssumeRolePolicyDocument: t.controllersTrustPolicy(),
150153
Policies: t.controllersRolePolicy(),
154+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
151155
Tags: converters.MapToCloudFormationTags(t.Spec.ClusterAPIControllers.Tags),
152156
}
153157

154158
template.Resources[AWSIAMRoleNodes] = &cfn_iam.Role{
155159
RoleName: t.NewManagedName("nodes"),
160+
Path: t.Spec.ControlPlane.Path,
156161
AssumeRolePolicyDocument: t.nodeTrustPolicy(),
157162
ManagedPolicyArns: t.nodeManagedPolicies(),
158163
Policies: t.nodePolicies(),
164+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
159165
Tags: converters.MapToCloudFormationTags(t.Spec.Nodes.Tags),
160166
}
161167

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2930,6 +2930,30 @@ spec:
29302930
and no name is supplied then a role is created.
29312931
minLength: 2
29322932
type: string
2933+
rolePath:
2934+
description: |-
2935+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
2936+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
2937+
in the IAM User Guide.
2938+
2939+
This parameter is optional. If it is not included, it defaults to a slash
2940+
(/).
2941+
type: string
2942+
rolePermissionsBoundary:
2943+
description: |-
2944+
RolePermissionsBoundary sets the ARN of the managed policy that is used
2945+
to set the permissions boundary for the role.
2946+
2947+
A permissions boundary policy defines the maximum permissions that identity-based
2948+
policies can grant to an entity, but does not grant permissions. Permissions
2949+
boundaries do not define the maximum permissions that a resource-based policy
2950+
can grant to an entity. To learn more, see Permissions boundaries for IAM
2951+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
2952+
in the IAM User Guide.
2953+
2954+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
2955+
in the IAM User Guide.
2956+
type: string
29332957
secondaryCidrBlock:
29342958
description: |-
29352959
SecondaryCidrBlock is the additional CIDR range to use for pod IPs.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsfargateprofiles.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,30 @@ spec:
264264
and not delete it on deletion. If the EKSEnableIAM feature
265265
flag is true and no name is supplied then a role is created.
266266
type: string
267+
rolePath:
268+
description: |-
269+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
270+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
271+
in the IAM User Guide.
272+
273+
This parameter is optional. If it is not included, it defaults to a slash
274+
(/).
275+
type: string
276+
rolePermissionsBoundary:
277+
description: |-
278+
RolePermissionsBoundary sets the ARN of the managed policy that is used
279+
to set the permissions boundary for the role.
280+
281+
A permissions boundary policy defines the maximum permissions that identity-based
282+
policies can grant to an entity, but does not grant permissions. Permissions
283+
boundaries do not define the maximum permissions that a resource-based policy
284+
can grant to an entity. To learn more, see Permissions boundaries for IAM
285+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
286+
in the IAM User Guide.
287+
288+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
289+
in the IAM User Guide.
290+
type: string
267291
selectors:
268292
description: Selectors specify fargate pod selectors.
269293
items:

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -938,6 +938,30 @@ spec:
938938
and not delete it on deletion. If the EKSEnableIAM feature
939939
flag is true and no name is supplied then a role is created.
940940
type: string
941+
rolePath:
942+
description: |-
943+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
944+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
945+
in the IAM User Guide.
946+
947+
This parameter is optional. If it is not included, it defaults to a slash
948+
(/).
949+
type: string
950+
rolePermissionsBoundary:
951+
description: |-
952+
RolePermissionsBoundary sets the ARN of the managed policy that is used
953+
to set the permissions boundary for the role.
954+
955+
A permissions boundary policy defines the maximum permissions that identity-based
956+
policies can grant to an entity, but does not grant permissions. Permissions
957+
boundaries do not define the maximum permissions that a resource-based policy
958+
can grant to an entity. To learn more, see Permissions boundaries for IAM
959+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
960+
in the IAM User Guide.
961+
962+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
963+
in the IAM User Guide.
964+
type: string
941965
scaling:
942966
description: Scaling specifies scaling for the ASG behind this pool
943967
properties:

‎controlplane/eks/api/v1beta1/conversion.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ func (r *AWSManagedControlPlane) ConvertTo(dstRaw conversion.Hub) error {
4242
dst.Spec.VpcCni.Disable = r.Spec.DisableVPCCNI
4343
dst.Spec.Partition = restored.Spec.Partition
4444
dst.Spec.RestrictPrivateSubnets = restored.Spec.RestrictPrivateSubnets
45+
dst.Spec.RolePath = restored.Spec.RolePath
46+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
4547
dst.Status.Version = restored.Status.Version
4648

4749
return nil

‎controlplane/eks/api/v1beta1/zz_generated.conversion.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,30 @@ type AWSManagedControlPlaneSpec struct { //nolint: maligned
8888
// +optional
8989
RoleAdditionalPolicies *[]string `json:"roleAdditionalPolicies,omitempty"`
9090

91+
// RolePath sets the path to the role. For more information about paths, see IAM Identifiers
92+
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
93+
// in the IAM User Guide.
94+
//
95+
// This parameter is optional. If it is not included, it defaults to a slash
96+
// (/).
97+
// +optional
98+
RolePath string `json:"rolePath,omitempty"`
99+
100+
// RolePermissionsBoundary sets the ARN of the managed policy that is used
101+
// to set the permissions boundary for the role.
102+
//
103+
// A permissions boundary policy defines the maximum permissions that identity-based
104+
// policies can grant to an entity, but does not grant permissions. Permissions
105+
// boundaries do not define the maximum permissions that a resource-based policy
106+
// can grant to an entity. To learn more, see Permissions boundaries for IAM
107+
// entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
108+
// in the IAM User Guide.
109+
//
110+
// For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
111+
// in the IAM User Guide.
112+
// +optional
113+
RolePermissionsBoundary string `json:"rolePermissionsBoundary,omitempty"`
114+
91115
// Logging specifies which EKS Cluster logs should be enabled. Entries for
92116
// each of the enabled logs will be sent to CloudWatch
93117
// +optional

‎exp/api/v1beta1/conversion.go

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,9 @@ func (src *AWSManagedMachinePool) ConvertTo(dstRaw conversion.Hub) error {
130130
dst.Spec.AvailabilityZoneSubnetType = restored.Spec.AvailabilityZoneSubnetType
131131
}
132132

133+
dst.Spec.RolePath = restored.Spec.RolePath
134+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
135+
133136
return nil
134137
}
135138

@@ -165,14 +168,33 @@ func (r *AWSManagedMachinePoolList) ConvertFrom(srcRaw conversion.Hub) error {
165168
// ConvertTo converts the v1beta1 AWSFargateProfile receiver to a v1beta2 AWSFargateProfile.
166169
func (src *AWSFargateProfile) ConvertTo(dstRaw conversion.Hub) error {
167170
dst := dstRaw.(*infrav1exp.AWSFargateProfile)
168-
return Convert_v1beta1_AWSFargateProfile_To_v1beta2_AWSFargateProfile(src, dst, nil)
171+
172+
if err := Convert_v1beta1_AWSFargateProfile_To_v1beta2_AWSFargateProfile(src, dst, nil); err != nil {
173+
return err
174+
}
175+
176+
// Manually restore data.
177+
restored := &infrav1exp.AWSFargateProfile{}
178+
if ok, err := utilconversion.UnmarshalData(src, restored); err != nil || !ok {
179+
return err
180+
}
181+
182+
dst.Spec.RolePath = restored.Spec.RolePath
183+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
184+
185+
return nil
169186
}
170187

171188
// ConvertFrom converts the v1beta2 AWSFargateProfile receiver to v1beta1 AWSFargateProfile.
172189
func (r *AWSFargateProfile) ConvertFrom(srcRaw conversion.Hub) error {
173190
src := srcRaw.(*infrav1exp.AWSFargateProfile)
174191

175-
return Convert_v1beta2_AWSFargateProfile_To_v1beta1_AWSFargateProfile(src, r, nil)
192+
if err := Convert_v1beta2_AWSFargateProfile_To_v1beta1_AWSFargateProfile(src, r, nil); err != nil {
193+
return err
194+
}
195+
196+
// Preserve Hub data on down-conversion.
197+
return utilconversion.MarshalData(src, r)
176198
}
177199

178200
// ConvertTo converts the v1beta1 AWSFargateProfileList receiver to a v1beta2 AWSFargateProfileList.
@@ -235,3 +257,7 @@ func Convert_v1beta2_RefreshPreferences_To_v1beta1_RefreshPreferences(in *infrav
235257
// spec.refreshPreferences.disable has been added to v1beta2.
236258
return autoConvert_v1beta2_RefreshPreferences_To_v1beta1_RefreshPreferences(in, out, s)
237259
}
260+
261+
func Convert_v1beta2_FargateProfileSpec_To_v1beta1_FargateProfileSpec(in *infrav1exp.FargateProfileSpec, out *FargateProfileSpec, s apiconversion.Scope) error {
262+
return autoConvert_v1beta2_FargateProfileSpec_To_v1beta1_FargateProfileSpec(in, out, s)
263+
}

0 commit comments

Comments
 (0)