Add crossplane IAM Roles for control plane nodes

Author: fiunchinho

helm/cluster-aws/templates/_aws_cluster.tpl

@@ -255,7 +255,7 @@ spec:
     {{- end }}
   sshKeyName: ssh-key
   s3Bucket:
-    controlPlaneIAMInstanceProfile: control-plane-{{ include "resource.default.name" $ }}
+    controlPlaneIAMInstanceProfile: {{ include "resource.default.name" $ }}-control-plane
     name: {{ include "aws-region" . }}-capa-{{ include "resource.default.name" $ }}
     nodesIAMInstanceProfiles:
     - {{ include "resource.default.name" $ }}-worker

helm/cluster-aws/templates/crossplane-iam-role-control-plane.yaml

@@ -15,7 +15,7 @@ spec:
           {
             "Effect": "Allow",
             "Principal": {
-              "Service": "ec2.amazonaws.com{{- if hasPrefix "cn-" .Values.awsRegion }}.cn{{- end }}"
+              "Service": "ec2.amazonaws.com{{- if hasPrefix "cn-" (include "aws-region" .) }}.cn{{- end }}"
             },
             "Action": "sts:AssumeRole"
           }
@@ -168,6 +168,23 @@ spec:
     name: {{ include "resource.default.name" $ }}
 ---
 apiVersion: iam.aws.upbound.io/v1beta1
+kind: RolePolicyAttachment
+metadata:
+  name: {{ include "resource.default.name" $ }}-control-plane
+  labels:
+    {{- include "labels.common" $ | nindent 4 }}
+    app.kubernetes.io/version: {{ .Chart.Version | quote }}
+spec:
+  forProvider:
+    roleRef:
+      name: {{ include "resource.default.name" $ }}-control-plane
+    policyArnRef:
+      name: {{ include "resource.default.name" $ }}-control-plane
+  providerConfigRef:
+    name: {{ include "resource.default.name" $ }}
+
+---
+apiVersion: iam.aws.upbound.io/v1beta1
 kind: InstanceProfile
 metadata:
   name: {{ include "resource.default.name" $ }}-control-plane

helm/cluster-aws/templates/crossplane-iam-role-worker.yaml

@@ -15,7 +15,7 @@ spec:
           {
             "Effect": "Allow",
             "Principal": {
-              "Service": "ec2.amazonaws.com{{- if hasPrefix "cn-" .Values.awsRegion }}.cn{{- end }}"
+              "Service": "ec2.amazonaws.com{{- if hasPrefix "cn-" (include "aws-region" .) }}.cn{{- end }}"
             },
             "Action": "sts:AssumeRole"
           }
@@ -86,34 +86,35 @@ spec:
     name: {{ include "resource.default.name" $ }}
 ---
 apiVersion: iam.aws.upbound.io/v1beta1
-kind: InstanceProfile
+kind: RolePolicyAttachment
 metadata:
   name: {{ include "resource.default.name" $ }}-worker
   labels:
     {{- include "labels.common" $ | nindent 4 }}
     app.kubernetes.io/version: {{ .Chart.Version | quote }}
 spec:
   forProvider:
-    tags:
-      managed-by: "cluster-aws"
-      giantswarm.io/cluster: {{ include "resource.default.name" $ }}
-      giantswarm.io/installation: {{ .Values.global.managementCluster }}
-      {{- if .Values.global.providerSpecific.additionalResourceTags -}}{{- toYaml .Values.global.providerSpecific.additionalResourceTags | nindent 4 }}{{- end}}
+    roleRef:
+      name: {{ include "resource.default.name" $ }}-worker
+    policyArnRef:
+      name: {{ include "resource.default.name" $ }}-worker
   providerConfigRef:
     name: {{ include "resource.default.name" $ }}
 ---
 apiVersion: iam.aws.upbound.io/v1beta1
-kind: RolePolicyAttachment
+kind: InstanceProfile
 metadata:
   name: {{ include "resource.default.name" $ }}-worker
   labels:
     {{- include "labels.common" $ | nindent 4 }}
     app.kubernetes.io/version: {{ .Chart.Version | quote }}
 spec:
   forProvider:
-    roleRef:
-      name: {{ include "resource.default.name" $ }}-worker
-    instanceProfileRef:
-      name: {{ include "resource.default.name" $ }}-worker
+    role: {{ include "resource.default.name" $ }}-worker
+    tags:
+      managed-by: "cluster-aws"
+      giantswarm.io/cluster: {{ include "resource.default.name" $ }}
+      giantswarm.io/installation: {{ .Values.global.managementCluster }}
+      {{- if .Values.global.providerSpecific.additionalResourceTags -}}{{- toYaml .Values.global.providerSpecific.additionalResourceTags | nindent 4 }}{{- end}}
   providerConfigRef:
     name: {{ include "resource.default.name" $ }}