Skip to content

Commit 07973eb

Browse files
fiunchinhofiunchinho
committed
Add Crossplane IAM roles, policies, and instance profiles for worker nodes
1 parent 583f48b commit 07973eb

File tree

10 files changed

+127
-20
lines changed

10 files changed

+127
-20
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### Added
11+
12+
- Add Crossplane IAM Roles, policies and instance profiles for the worker nodes. Instead of having an IAM Role per node pool, now we'll use the same for all node pools. *This change will roll the worker nodes*.
13+
1014
### Changed
1115

1216
- Tidy up dependencies on `azs-getter`.

‎helm/cluster-aws/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ Properties within the `.global.providerSpecific` object
3232
| `global.providerSpecific.irsaCrossplane` | **Use Crossplane to provision IRSA infrastructure** - Defaults to true. Crossplane will adopt all the resources created by IRSA Operator. If set to false, the IRSA Operator will take over the infrastructure again.|**Type:** `[boolean]`<br/>**Default:** `true`|
3333
| `global.providerSpecific.nodePoolAmi` | **Amazon machine image (AMI) for node pools** - If specified, this image will be used to provision EC2 instances for node pools.|**Type:** `[string]`<br/>|
3434
| `global.providerSpecific.nodeTerminationHandlerEnabled` | **Use the AWS Node Termination Handler app** - Defaults to true. Whether or not to enable the Auto Scaling Groups lifecycle hooks and use the node-termination-handler app (NTH) to manage the termination of EC2 instances.|**Type:** `[boolean]`<br/>**Default:** `true`|
35-
| `global.providerSpecific.reducedInstanceProfileIamPermissionsForWorkers` | **Use reduced IAM permissions on worker nodes instance profile** - Defaults to true. If something breaks, this can temporarily be disabled in order to bring certain IAM permissions (e.g. EC2) back for the worker nodes' IAM instance profile. Applications must use [IRSA](https://docs.giantswarm.io/tutorials/access-management/iam-roles-for-service-accounts/) to authenticate with the AWS API instead of falling back to the instance profile.|**Type:** `[boolean]`<br/>**Default:** `true`|
3635
| `global.providerSpecific.region` | **Region**|**Type:** `[string]`<br/>|
3736

3837
### Apps

‎helm/cluster-aws/templates/_aws_cluster.tpl‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -258,8 +258,6 @@ spec:
258258
controlPlaneIAMInstanceProfile: control-plane-{{ include "resource.default.name" $ }}
259259
name: {{ include "aws-region" . }}-capa-{{ include "resource.default.name" $ }}
260260
nodesIAMInstanceProfiles:
261-
{{- range $name, $value := .Values.global.nodePools | default .Values.cluster.providerIntegration.workers.defaultNodePools }}
262-
- nodes-{{ $name }}-{{ include "resource.default.name" $ }}
263-
{{- end }}
261+
- {{ include "resource.default.name" $ }}-worker
264262
region: {{ include "aws-region" . }}
265263
{{ end }}

‎helm/cluster-aws/templates/_control_plane.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ nonRootVolumes:
3131
rootVolume:
3232
size: {{ .Values.global.controlPlane.rootVolumeSizeGB }}
3333
type: gp3
34-
iamInstanceProfile: control-plane-{{ include "resource.default.name" $ }}
34+
iamInstanceProfile: {{ include "resource.default.name" $ }}-control-plane
3535
{{- if .Values.global.controlPlane.additionalSecurityGroups }}
3636
additionalSecurityGroups:
3737
{{- toYaml .Values.global.controlPlane.additionalSecurityGroups | nindent 2 }}

‎helm/cluster-aws/templates/_karpenter_machine_pools.tpl‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,6 @@ metadata:
77
labels:
88
giantswarm.io/machine-pool: {{ include "resource.default.name" $ }}-{{ $name }}
99
{{- include "labels.common" $ | nindent 4 }}
10-
{{- if $.Values.global.providerSpecific.reducedInstanceProfileIamPermissionsForWorkers }}
11-
alpha.aws.giantswarm.io/reduced-instance-permissions-workers: "true"
12-
{{- end }}
1310
app.kubernetes.io/version: {{ $.Chart.Version | quote }}
1411
name: {{ include "resource.default.name" $ }}-{{ $name }}
1512
namespace: {{ $.Release.Namespace }}
@@ -38,6 +35,7 @@ spec:
3835
volumeType: gp3
3936
deleteOnTermination: true
4037
instanceProfile: nodes-{{ $name }}-{{ include "resource.default.name" $ }}
38+
instanceProfile: {{ include "resource.default.name" $ }}-worker
4139
metadataOptions:
4240
{{- if eq $.Values.global.connectivity.cilium.ipamMode "eni" }}
4341
httpPutResponseHopLimit: 2

‎helm/cluster-aws/templates/_machine_pools.tpl‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,6 @@ metadata:
77
labels:
88
giantswarm.io/machine-pool: {{ include "resource.default.name" $ }}-{{ $name }}
99
{{- include "labels.common" $ | nindent 4 }}
10-
{{- if $.Values.global.providerSpecific.reducedInstanceProfileIamPermissionsForWorkers }}
11-
alpha.aws.giantswarm.io/reduced-instance-permissions-workers: "true"
12-
{{- end }}
1310
{{- if eq $.Values.global.connectivity.cilium.ipamMode "eni" }}
1411
alpha.aws.giantswarm.io/ipam-mode: "eni"
1512
{{- end }}
@@ -50,7 +47,7 @@ spec:
5047
{{- else }}
5148
{{- include "imageLookupParameters" $ | nindent 4 }}
5249
{{- end }}
53-
iamInstanceProfile: nodes-{{ $name }}-{{ include "resource.default.name" $ }}
50+
iamInstanceProfile: {{ include "resource.default.name" $ }}-worker
5451
instanceType: {{ $value.instanceType | default "r6i.xlarge" }}
5552
rootVolume:
5653
size: {{ $value.rootVolumeSizeGB | default 8 }}

‎helm/cluster-aws/templates/required.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,3 @@
33
{{- $_ := required "global.connectivity.cilium.ipamMode is required" .Values.global.connectivity.cilium.ipamMode }}
44
{{- $_ := required "global.connectivity.network.pods.cidrBlocks is required" .Values.global.connectivity.network.pods.cidrBlocks }}
55
{{- $_ := required "You must provide an existing organization name in .global.metadata.organization" .Values.global.metadata.organization }}
6-
{{- $_ := required "global.providerSpecific.reducedInstanceProfileIamPermissionsForWorkers is required" $.Values.global.providerSpecific.reducedInstanceProfileIamPermissionsForWorkers }}

‎helm/cluster-aws/templates/workers-crossplane-iam-role.yaml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
---
2+
apiVersion: iam.aws.upbound.io/v1beta1
3+
kind: Role
4+
metadata:
5+
name: {{ include "resource.default.name" $ }}-worker
6+
labels:
7+
{{- include "labels.common" $ | nindent 4 }}
8+
app.kubernetes.io/version: {{ .Chart.Version | quote }}
9+
spec:
10+
forProvider:
11+
assumeRolePolicy: |
12+
{
13+
"Version": "2012-10-17",
14+
"Statement": [
15+
{
16+
"Effect": "Allow",
17+
"Principal": {
18+
"Service": "ec2.amazonaws.com"
19+
},
20+
"Action": "sts:AssumeRole"
21+
}
22+
]
23+
}
24+
tags:
25+
managed-by: "cluster-aws"
26+
giantswarm.io/cluster: {{ include "resource.default.name" $ }}
27+
giantswarm.io/installation: {{ .Values.global.managementCluster }}
28+
{{- if .Values.global.providerSpecific.additionalResourceTags -}}{{- toYaml .Values.global.providerSpecific.additionalResourceTags | nindent 4 }}{{- end}}
29+
providerConfigRef:
30+
name: {{ include "resource.default.name" $ }}
31+
---
32+
apiVersion: iam.aws.upbound.io/v1beta1
33+
kind: RolePolicy
34+
metadata:
35+
name: {{ include "resource.default.name" $ }}-worker
36+
labels:
37+
{{- include "labels.common" $ | nindent 4 }}
38+
app.kubernetes.io/version: {{ .Chart.Version | quote }}
39+
spec:
40+
forProvider:
41+
roleRef:
42+
name: {{ include "resource.default.name" $ }}-worker
43+
policy: |
44+
{
45+
"Version": "2012-10-17",
46+
"Statement": [
47+
{{- if eq .Values.global.connectivity.cilium.ipamMode "eni" }}
48+
{
49+
"Action": [
50+
"ec2:AssignPrivateIpAddresses",
51+
"ec2:AttachNetworkInterface",
52+
"ec2:CreateNetworkInterface",
53+
"ec2:CreateTags",
54+
"ec2:DeleteNetworkInterface",
55+
"ec2:DescribeInstances",
56+
"ec2:DescribeInstanceTypes",
57+
"ec2:DescribeNetworkInterfaces",
58+
"ec2:DescribeRouteTables",
59+
"ec2:DescribeSecurityGroups",
60+
"ec2:DescribeSubnets",
61+
"ec2:DescribeTags",
62+
"ec2:DescribeVpcs",
63+
"ec2:ModifyNetworkInterfaceAttribute",
64+
"ec2:UnassignPrivateIpAddresses"
65+
],
66+
"Resource": "*",
67+
"Effect": "Allow"
68+
},
69+
{{- end }}
70+
{
71+
"Action": [
72+
"ecr:BatchCheckLayerAvailability",
73+
"ecr:BatchGetImage",
74+
"ecr:DescribeRepositories",
75+
"ecr:GetAuthorizationToken",
76+
"ecr:GetDownloadUrlForLayer",
77+
"ecr:GetRepositoryPolicy",
78+
"ecr:ListImages"
79+
],
80+
"Resource": "*",
81+
"Effect": "Allow"
82+
}
83+
]
84+
}
85+
providerConfigRef:
86+
name: {{ include "resource.default.name" $ }}
87+
---
88+
apiVersion: iam.aws.upbound.io/v1beta1
89+
kind: InstanceProfile
90+
metadata:
91+
name: {{ include "resource.default.name" $ }}-worker
92+
labels:
93+
{{- include "labels.common" $ | nindent 4 }}
94+
app.kubernetes.io/version: {{ .Chart.Version | quote }}
95+
spec:
96+
forProvider:
97+
tags:
98+
managed-by: "cluster-aws"
99+
giantswarm.io/cluster: {{ include "resource.default.name" $ }}
100+
giantswarm.io/installation: {{ .Values.global.managementCluster }}
101+
{{- if .Values.global.providerSpecific.additionalResourceTags -}}{{- toYaml .Values.global.providerSpecific.additionalResourceTags | nindent 4 }}{{- end}}
102+
providerConfigRef:
103+
name: {{ include "resource.default.name" $ }}
104+
---
105+
apiVersion: iam.aws.upbound.io/v1beta1
106+
kind: RolePolicyAttachment
107+
metadata:
108+
name: {{ include "resource.default.name" $ }}-worker
109+
labels:
110+
{{- include "labels.common" $ | nindent 4 }}
111+
app.kubernetes.io/version: {{ .Chart.Version | quote }}
112+
spec:
113+
forProvider:
114+
roleRef:
115+
name: {{ include "resource.default.name" $ }}-worker
116+
instanceProfileRef:
117+
name: {{ include "resource.default.name" $ }}-worker
118+
providerConfigRef:
119+
name: {{ include "resource.default.name" $ }}

‎helm/cluster-aws/values.schema.json‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2433,12 +2433,6 @@
24332433
"description": "Defaults to true. Whether or not to enable the Auto Scaling Groups lifecycle hooks and use the node-termination-handler app (NTH) to manage the termination of EC2 instances.",
24342434
"default": true
24352435
},
2436-
"reducedInstanceProfileIamPermissionsForWorkers": {
2437-
"type": "boolean",
2438-
"title": "Use reduced IAM permissions on worker nodes instance profile",
2439-
"description": "Defaults to true. If something breaks, this can temporarily be disabled in order to bring certain IAM permissions (e.g. EC2) back for the worker nodes' IAM instance profile. Applications must use [IRSA](https://docs.giantswarm.io/tutorials/access-management/iam-roles-for-service-accounts/) to authenticate with the AWS API instead of falling back to the instance profile.",
2440-
"default": true
2441-
},
24422436
"region": {
24432437
"type": "string",
24442438
"title": "Region"

‎helm/cluster-aws/values.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,5 @@ global:
401401
httpTokens: required
402402
irsaCrossplane: true
403403
nodeTerminationHandlerEnabled: true
404-
reducedInstanceProfileIamPermissionsForWorkers: true
405404
release: {}
406405
internal: {}

0 commit comments

Comments
 (0)