Skip to content

Commit 0d5ac33

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #3926 from AmitSahastra/arn-us-gov
capa fix hardcoded role arn for aws iam authenticator
2 parents e7306e0 + 378727f commit 0d5ac33

25 files changed

+421
-45
lines changed

‎api/v1beta1/awscluster_conversion.go

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,40 +17,41 @@ limitations under the License.
1717
package v1beta1
1818

1919
import (
20-
infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
20+
infrav2 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
2121
utilconversion "sigs.k8s.io/cluster-api/util/conversion"
2222
"sigs.k8s.io/controller-runtime/pkg/conversion"
2323
)
2424

25-
// ConvertTo converts the v1beta1 AWSCluster receiver to a v1beta1 AWSCluster.
25+
// ConvertTo converts the v1beta1 AWSCluster receiver to a v1beta2 AWSCluster.
2626
func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
27-
dst := dstRaw.(*infrav1.AWSCluster)
27+
dst := dstRaw.(*infrav2.AWSCluster)
2828

2929
if err := Convert_v1beta1_AWSCluster_To_v1beta2_AWSCluster(src, dst, nil); err != nil {
3030
return err
3131
}
3232
// Manually restore data.
33-
restored := &infrav1.AWSCluster{}
33+
restored := &infrav2.AWSCluster{}
3434
if ok, err := utilconversion.UnmarshalData(src, restored); err != nil || !ok {
3535
return err
3636
}
3737

3838
if restored.Spec.ControlPlaneLoadBalancer != nil {
3939
if dst.Spec.ControlPlaneLoadBalancer == nil {
40-
dst.Spec.ControlPlaneLoadBalancer = &infrav1.AWSLoadBalancerSpec{}
40+
dst.Spec.ControlPlaneLoadBalancer = &infrav2.AWSLoadBalancerSpec{}
4141
}
4242
restoreControlPlaneLoadBalancer(restored.Spec.ControlPlaneLoadBalancer, dst.Spec.ControlPlaneLoadBalancer)
4343
}
4444
restoreControlPlaneLoadBalancerStatus(&restored.Status.Network.APIServerELB, &dst.Status.Network.APIServerELB)
4545

4646
dst.Spec.S3Bucket = restored.Spec.S3Bucket
47+
dst.Spec.Partition = restored.Spec.Partition
4748

4849
return nil
4950
}
5051

5152
// restoreControlPlaneLoadBalancerStatus manually restores the control plane loadbalancer status data.
5253
// Assumes restored and dst are non-nil.
53-
func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav1.LoadBalancer) {
54+
func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav2.LoadBalancer) {
5455
dst.ARN = restored.ARN
5556
dst.LoadBalancerType = restored.LoadBalancerType
5657
dst.ELBAttributes = restored.ELBAttributes
@@ -59,7 +60,7 @@ func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav1.LoadBalancer)
5960

6061
// restoreControlPlaneLoadBalancer manually restores the control plane loadbalancer data.
6162
// Assumes restored and dst are non-nil.
62-
func restoreControlPlaneLoadBalancer(restored, dst *infrav1.AWSLoadBalancerSpec) {
63+
func restoreControlPlaneLoadBalancer(restored, dst *infrav2.AWSLoadBalancerSpec) {
6364
dst.Name = restored.Name
6465
dst.HealthCheckProtocol = restored.HealthCheckProtocol
6566
dst.LoadBalancerType = restored.LoadBalancerType
@@ -69,7 +70,7 @@ func restoreControlPlaneLoadBalancer(restored, dst *infrav1.AWSLoadBalancerSpec)
6970

7071
// ConvertFrom converts the v1beta1 AWSCluster receiver to a v1beta1 AWSCluster.
7172
func (r *AWSCluster) ConvertFrom(srcRaw conversion.Hub) error {
72-
src := srcRaw.(*infrav1.AWSCluster)
73+
src := srcRaw.(*infrav2.AWSCluster)
7374

7475
if err := Convert_v1beta2_AWSCluster_To_v1beta1_AWSCluster(src, r, nil); err != nil {
7576
return err
@@ -85,14 +86,14 @@ func (r *AWSCluster) ConvertFrom(srcRaw conversion.Hub) error {
8586

8687
// ConvertTo converts the v1beta1 AWSClusterList receiver to a v1beta2 AWSClusterList.
8788
func (src *AWSClusterList) ConvertTo(dstRaw conversion.Hub) error {
88-
dst := dstRaw.(*infrav1.AWSClusterList)
89+
dst := dstRaw.(*infrav2.AWSClusterList)
8990

9091
return Convert_v1beta1_AWSClusterList_To_v1beta2_AWSClusterList(src, dst, nil)
9192
}
9293

9394
// ConvertFrom converts the v1beta2 AWSClusterList receiver to a v1beta1 AWSClusterList.
9495
func (r *AWSClusterList) ConvertFrom(srcRaw conversion.Hub) error {
95-
src := srcRaw.(*infrav1.AWSClusterList)
96+
src := srcRaw.(*infrav2.AWSClusterList)
9697

9798
return Convert_v1beta2_AWSClusterList_To_v1beta1_AWSClusterList(src, r, nil)
9899
}

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ type AWSClusterSpec struct {
3939
// The AWS Region the cluster lives in.
4040
Region string `json:"region,omitempty"`
4141

42+
// Partition is the AWS security partition being used. Defaults to "aws"
43+
// +optional
44+
Partition string `json:"partition,omitempty"`
45+
4246
// SSHKeyName is the name of the ssh key to attach to the bastion host. Valid values are empty string (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)
4347
// +optional
4448
SSHKeyName *string `json:"sshKeyName,omitempty"`

‎cmd/clusterawsadm/api/bootstrap/v1beta1/defaults.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ const (
3131
DefaultStackName = "cluster-api-provider-aws-sigs-k8s-io"
3232
// DefaultPartitionName is the default security partition for AWS ARNs.
3333
DefaultPartitionName = "aws"
34+
// PartitionNameUSGov is the default security partition for AWS ARNs.
35+
PartitionNameUSGov = "aws-us-gov"
3436
// DefaultKMSAliasPattern is the default KMS alias.
3537
DefaultKMSAliasPattern = "cluster-api-provider-aws-*"
3638
// DefaultS3BucketPrefix is the default S3 bucket prefix.

‎cmd/clusterawsadm/cloudformation/bootstrap/fargate.go

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,18 @@ limitations under the License.
1717
package bootstrap
1818

1919
import (
20+
"strings"
21+
2022
bootstrapv1 "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/bootstrap/v1beta1"
2123
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
2224
)
2325

24-
func fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
25-
policies := eks.FargateRolePolicies()
26+
func (t Template) fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
27+
var policies []string
28+
policies = eks.FargateRolePolicies()
29+
if strings.Contains(t.Spec.Partition, bootstrapv1.PartitionNameUSGov) {
30+
policies = eks.FargateRolePoliciesUSGov()
31+
}
2632
if roleSpec.ExtraPolicyAttachments != nil {
2733
policies = append(policies, roleSpec.ExtraPolicyAttachments...)
2834
}

‎cmd/clusterawsadm/cloudformation/bootstrap/managed_nodegroup.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,20 @@ limitations under the License.
1616

1717
package bootstrap
1818

19-
import "sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
19+
import (
20+
"strings"
21+
22+
bootstrapv1 "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/bootstrap/v1beta1"
23+
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
24+
)
2025

2126
func (t Template) eksMachinePoolPolicies() []string {
22-
policies := eks.NodegroupRolePolicies()
27+
var policies []string
28+
29+
policies = eks.NodegroupRolePolicies()
30+
if strings.Contains(t.Spec.Partition, bootstrapv1.PartitionNameUSGov) {
31+
policies = eks.NodegroupRolePoliciesUSGov()
32+
}
2333
if t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments != nil {
2434
policies = append(policies, t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments...)
2535
}

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
200200
template.Resources[AWSIAMRoleEKSFargate] = &cfn_iam.Role{
201201
RoleName: expinfrav1.DefaultEKSFargateRole,
202202
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{eksiam.EKSFargateService}),
203-
ManagedPolicyArns: fargateProfilePolicies(t.Spec.EKS.Fargate),
203+
ManagedPolicyArns: t.fargateProfilePolicies(t.Spec.EKS.Fargate),
204204
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.Fargate.Tags),
205205
}
206206
}

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1936,6 +1936,10 @@ spec:
19361936
prefixing.
19371937
type: string
19381938
type: object
1939+
partition:
1940+
description: Partition is the AWS security partition being used. Defaults
1941+
to "aws"
1942+
type: string
19391943
region:
19401944
description: The AWS Region the cluster lives in.
19411945
type: string

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1241,6 +1241,10 @@ spec:
12411241
type: object
12421242
type: object
12431243
type: object
1244+
partition:
1245+
description: Partition is the AWS security partition being used. Defaults
1246+
to "aws"
1247+
type: string
12441248
region:
12451249
description: The AWS Region the cluster lives in.
12461250
type: string

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -848,6 +848,10 @@ spec:
848848
type: object
849849
type: object
850850
type: object
851+
partition:
852+
description: Partition is the AWS security partition being
853+
used. Defaults to "aws"
854+
type: string
851855
region:
852856
description: The AWS Region the cluster lives in.
853857
type: string

0 commit comments

Comments
 (0)