Skip to content

Commit dcaf0db

Browse files
fiunchinhofiunchinho
committed
Add crossplane IAM Roles for control plane nodes
1 parent 07973eb commit dcaf0db

File tree

2 files changed

+187
-1
lines changed

2 files changed

+187
-1
lines changed

‎helm/cluster-aws/templates/crossplane-iam-role-control-plane.yaml‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
---
2+
apiVersion: iam.aws.upbound.io/v1beta1
3+
kind: Role
4+
metadata:
5+
name: {{ include "resource.default.name" $ }}-control-plane
6+
labels:
7+
{{- include "labels.common" $ | nindent 4 }}
8+
app.kubernetes.io/version: {{ .Chart.Version | quote }}
9+
spec:
10+
forProvider:
11+
assumeRolePolicy: |
12+
{
13+
"Version": "2012-10-17",
14+
"Statement": [
15+
{
16+
"Effect": "Allow",
17+
"Principal": {
18+
"Service": "ec2.amazonaws.com{{- if hasPrefix "cn-" .Values.awsRegion }}.cn{{- end }}"
19+
},
20+
"Action": "sts:AssumeRole"
21+
}
22+
]
23+
}
24+
tags:
25+
managed-by: "cluster-aws"
26+
giantswarm.io/cluster: {{ include "resource.default.name" $ }}
27+
giantswarm.io/installation: {{ .Values.global.managementCluster }}
28+
{{- if .Values.global.providerSpecific.additionalResourceTags -}}{{- toYaml .Values.global.providerSpecific.additionalResourceTags | nindent 4 }}{{- end}}
29+
providerConfigRef:
30+
name: {{ include "resource.default.name" $ }}
31+
---
32+
apiVersion: iam.aws.upbound.io/v1beta1
33+
kind: RolePolicy
34+
metadata:
35+
name: {{ include "resource.default.name" $ }}-control-plane
36+
labels:
37+
cluster.x-k8s.io/cluster-name: {{ include "resource.default.name" $ }}
38+
spec:
39+
forProvider:
40+
roleRef:
41+
name: {{ include "resource.default.name" $ }}-control-plane
42+
policy: |
43+
{
44+
"Version": "2012-10-17",
45+
"Statement": [
46+
{
47+
"Action": "elasticloadbalancing:*",
48+
"Resource": "*",
49+
"Effect": "Allow"
50+
},
51+
{
52+
"Action": [
53+
"autoscaling:DescribeAutoScalingGroups",
54+
"autoscaling:DescribeAutoScalingInstances",
55+
"autoscaling:DescribeTags",
56+
"autoscaling:DescribeLaunchConfigurations",
57+
"ec2:DescribeLaunchTemplateVersions"
58+
],
59+
"Resource": "*",
60+
"Effect": "Allow"
61+
},
62+
{
63+
"Action": [
64+
"ecr:GetAuthorizationToken",
65+
"ecr:BatchCheckLayerAvailability",
66+
"ecr:GetDownloadUrlForLayer",
67+
"ecr:GetRepositoryPolicy",
68+
"ecr:DescribeRepositories",
69+
"ecr:ListImages",
70+
"ecr:BatchGetImage"
71+
],
72+
"Resource": "*",
73+
"Effect": "Allow"
74+
},
75+
{
76+
"Action": [
77+
"ec2:AssignPrivateIpAddresses",
78+
"ec2:AttachNetworkInterface",
79+
"ec2:CreateNetworkInterface",
80+
"ec2:DeleteNetworkInterface",
81+
"ec2:DescribeInstances",
82+
"ec2:DescribeInstanceTypes",
83+
"ec2:DescribeTags",
84+
"ec2:DescribeNetworkInterfaces",
85+
"ec2:DetachNetworkInterface",
86+
"ec2:ModifyNetworkInterfaceAttribute",
87+
"ec2:UnassignPrivateIpAddresses"
88+
],
89+
"Resource": "*",
90+
"Effect": "Allow"
91+
},
92+
{
93+
"Action": [
94+
"autoscaling:DescribeAutoScalingGroups",
95+
"autoscaling:DescribeLaunchConfigurations",
96+
"autoscaling:DescribeTags",
97+
"ec2:DescribeAvailabilityZones",
98+
"ec2:DescribeInstances",
99+
"ec2:DescribeImages",
100+
"ec2:DescribeRegions",
101+
"ec2:DescribeRouteTables",
102+
"ec2:DescribeSecurityGroups",
103+
"ec2:DescribeSubnets",
104+
"ec2:DescribeVolumes",
105+
"ec2:CreateSecurityGroup",
106+
"ec2:CreateTags",
107+
"ec2:CreateVolume",
108+
"ec2:ModifyInstanceAttribute",
109+
"ec2:ModifyVolume",
110+
"ec2:AttachVolume",
111+
"ec2:DescribeVolumesModifications",
112+
"ec2:AuthorizeSecurityGroupIngress",
113+
"ec2:CreateRoute",
114+
"ec2:DeleteRoute",
115+
"ec2:DeleteSecurityGroup",
116+
"ec2:DeleteVolume",
117+
"ec2:DetachVolume",
118+
"ec2:RevokeSecurityGroupIngress",
119+
"ec2:DescribeVpcs",
120+
"elasticloadbalancing:AddTags",
121+
"elasticloadbalancing:AttachLoadBalancerToSubnets",
122+
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
123+
"elasticloadbalancing:CreateLoadBalancer",
124+
"elasticloadbalancing:CreateLoadBalancerPolicy",
125+
"elasticloadbalancing:CreateLoadBalancerListeners",
126+
"elasticloadbalancing:ConfigureHealthCheck",
127+
"elasticloadbalancing:DeleteLoadBalancer",
128+
"elasticloadbalancing:DeleteLoadBalancerListeners",
129+
"elasticloadbalancing:DescribeLoadBalancers",
130+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
131+
"elasticloadbalancing:DetachLoadBalancerFromSubnets",
132+
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
133+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
134+
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
135+
"elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
136+
"elasticloadbalancing:AddTags",
137+
"elasticloadbalancing:CreateListener",
138+
"elasticloadbalancing:CreateTargetGroup",
139+
"elasticloadbalancing:DeleteListener",
140+
"elasticloadbalancing:DeleteTargetGroup",
141+
"elasticloadbalancing:DescribeListeners",
142+
"elasticloadbalancing:DescribeLoadBalancerPolicies",
143+
"elasticloadbalancing:DescribeTargetGroups",
144+
"elasticloadbalancing:DescribeTargetHealth",
145+
"elasticloadbalancing:ModifyListener",
146+
"elasticloadbalancing:ModifyTargetGroup",
147+
"elasticloadbalancing:RegisterTargets",
148+
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
149+
"iam:CreateServiceLinkedRole",
150+
"kms:DescribeKey"
151+
],
152+
"Resource": [
153+
"*"
154+
],
155+
"Effect": "Allow"
156+
},
157+
{
158+
"Action": [
159+
"secretsmanager:GetSecretValue",
160+
"secretsmanager:DeleteSecret"
161+
],
162+
"Resource": "arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*",
163+
"Effect": "Allow"
164+
}
165+
]
166+
}
167+
providerConfigRef:
168+
name: {{ include "resource.default.name" $ }}
169+
---
170+
apiVersion: iam.aws.upbound.io/v1beta1
171+
kind: InstanceProfile
172+
metadata:
173+
name: {{ include "resource.default.name" $ }}-control-plane
174+
labels:
175+
{{- include "labels.common" $ | nindent 4 }}
176+
app.kubernetes.io/version: {{ .Chart.Version | quote }}
177+
spec:
178+
forProvider:
179+
role: {{ include "resource.default.name" $ }}-control-plane
180+
tags:
181+
managed-by: "cluster-aws"
182+
giantswarm.io/cluster: {{ include "resource.default.name" $ }}
183+
giantswarm.io/installation: {{ .Values.global.managementCluster }}
184+
{{- if .Values.global.providerSpecific.additionalResourceTags -}}{{- toYaml .Values.global.providerSpecific.additionalResourceTags | nindent 4 }}{{- end}}
185+
providerConfigRef:
186+
name: {{ include "resource.default.name" $ }}

‎helm/cluster-aws/templates/workers-crossplane-iam-role.yaml‎ renamed to ‎helm/cluster-aws/templates/crossplane-iam-role-worker.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ spec:
1515
{
1616
"Effect": "Allow",
1717
"Principal": {
18-
"Service": "ec2.amazonaws.com"
18+
"Service": "ec2.amazonaws.com{{- if hasPrefix "cn-" .Values.awsRegion }}.cn{{- end }}"
1919
},
2020
"Action": "sts:AssumeRole"
2121
}

0 commit comments

Comments
 (0)