Skip to content

Commit 34da261

Browse files
richardcaserichardcase
committed
fix: add missing permissions for nlb
This adds a missing permission required when using nlbs. Signed-off-by: Richard Case <[email protected]>
1 parent edeb8dc commit 34da261

16 files changed

+38
-4
lines changed

‎cmd/clusterawsadm/cloudformation/bootstrap/cloud_provider_integration_control_plane.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ func (t Template) cloudProviderControlPlaneAwsPolicy() *iamv1.PolicyDocument {
6767
"elasticloadbalancing:AddTags",
6868
"elasticloadbalancing:AttachLoadBalancerToSubnets",
6969
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
70+
"elasticloadbalancing:SetSecurityGroups",
7071
"elasticloadbalancing:CreateLoadBalancer",
7172
"elasticloadbalancing:CreateLoadBalancerPolicy",
7273
"elasticloadbalancing:CreateLoadBalancerListeners",

‎cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,7 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
159159
"elasticloadbalancing:DescribeLoadBalancerAttributes",
160160
"elasticloadbalancing:DescribeTargetGroups",
161161
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
162+
"elasticloadbalancing:SetSecurityGroups",
162163
"elasticloadbalancing:DescribeTags",
163164
"elasticloadbalancing:ModifyLoadBalancerAttributes",
164165
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
@@ -413,15 +414,17 @@ func (t Template) ControllersPolicyEKS() *iamv1.PolicyDocument {
413414
"arn:*:iam::*:role/*",
414415
},
415416
Effect: iamv1.EffectAllow,
416-
}, {
417+
},
418+
{
417419
Action: iamv1.Actions{
418420
"iam:GetPolicy",
419421
},
420422
Resource: iamv1.Resources{
421423
t.generateAWSManagedPolicyARN(eksClusterPolicyName),
422424
},
423425
Effect: iamv1.EffectAllow,
424-
}, {
426+
},
427+
{
425428
Action: iamv1.Actions{
426429
"eks:DescribeCluster",
427430
"eks:ListClusters",
@@ -447,7 +450,8 @@ func (t Template) ControllersPolicyEKS() *iamv1.PolicyDocument {
447450
"arn:*:eks:*:*:nodegroup/*/*/*",
448451
},
449452
Effect: iamv1.EffectAllow,
450-
}, {
453+
},
454+
{
451455
Action: iamv1.Actions{
452456
"ec2:AssociateVpcCidrBlock",
453457
"ec2:DisassociateVpcCidrBlock",
@@ -466,7 +470,8 @@ func (t Template) ControllersPolicyEKS() *iamv1.PolicyDocument {
466470
"*",
467471
},
468472
Effect: iamv1.EffectAllow,
469-
}, {
473+
},
474+
{
470475
Action: iamv1.Actions{
471476
"iam:PassRole",
472477
},

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/customsuffix.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -218,6 +219,7 @@ Resources:
218219
- elasticloadbalancing:DescribeLoadBalancerAttributes
219220
- elasticloadbalancing:DescribeTargetGroups
220221
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
222+
- elasticloadbalancing:SetSecurityGroups
221223
- elasticloadbalancing:DescribeTags
222224
- elasticloadbalancing:ModifyLoadBalancerAttributes
223225
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -218,6 +219,7 @@ Resources:
218219
- elasticloadbalancing:DescribeLoadBalancerAttributes
219220
- elasticloadbalancing:DescribeTargetGroups
220221
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
222+
- elasticloadbalancing:SetSecurityGroups
221223
- elasticloadbalancing:DescribeTags
222224
- elasticloadbalancing:ModifyLoadBalancerAttributes
223225
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -224,6 +225,7 @@ Resources:
224225
- elasticloadbalancing:DescribeLoadBalancerAttributes
225226
- elasticloadbalancing:DescribeTargetGroups
226227
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
228+
- elasticloadbalancing:SetSecurityGroups
227229
- elasticloadbalancing:DescribeTags
228230
- elasticloadbalancing:ModifyLoadBalancerAttributes
229231
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_allow_assume_role.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -218,6 +219,7 @@ Resources:
218219
- elasticloadbalancing:DescribeLoadBalancerAttributes
219220
- elasticloadbalancing:DescribeTargetGroups
220221
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
222+
- elasticloadbalancing:SetSecurityGroups
221223
- elasticloadbalancing:DescribeTags
222224
- elasticloadbalancing:ModifyLoadBalancerAttributes
223225
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_bootstrap_user.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ Resources:
5757
- elasticloadbalancing:AddTags
5858
- elasticloadbalancing:AttachLoadBalancerToSubnets
5959
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
60+
- elasticloadbalancing:SetSecurityGroups
6061
- elasticloadbalancing:CreateLoadBalancer
6162
- elasticloadbalancing:CreateLoadBalancerPolicy
6263
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -224,6 +225,7 @@ Resources:
224225
- elasticloadbalancing:DescribeLoadBalancerAttributes
225226
- elasticloadbalancing:DescribeTargetGroups
226227
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
228+
- elasticloadbalancing:SetSecurityGroups
227229
- elasticloadbalancing:DescribeTags
228230
- elasticloadbalancing:ModifyLoadBalancerAttributes
229231
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_custom_bootstrap_user.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ Resources:
5757
- elasticloadbalancing:AddTags
5858
- elasticloadbalancing:AttachLoadBalancerToSubnets
5959
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
60+
- elasticloadbalancing:SetSecurityGroups
6061
- elasticloadbalancing:CreateLoadBalancer
6162
- elasticloadbalancing:CreateLoadBalancerPolicy
6263
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -224,6 +225,7 @@ Resources:
224225
- elasticloadbalancing:DescribeLoadBalancerAttributes
225226
- elasticloadbalancing:DescribeTargetGroups
226227
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
228+
- elasticloadbalancing:SetSecurityGroups
227229
- elasticloadbalancing:DescribeTags
228230
- elasticloadbalancing:ModifyLoadBalancerAttributes
229231
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_different_instance_profiles.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -218,6 +219,7 @@ Resources:
218219
- elasticloadbalancing:DescribeLoadBalancerAttributes
219220
- elasticloadbalancing:DescribeTargetGroups
220221
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
222+
- elasticloadbalancing:SetSecurityGroups
221223
- elasticloadbalancing:DescribeTags
222224
- elasticloadbalancing:ModifyLoadBalancerAttributes
223225
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_console.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -218,6 +219,7 @@ Resources:
218219
- elasticloadbalancing:DescribeLoadBalancerAttributes
219220
- elasticloadbalancing:DescribeTargetGroups
220221
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
222+
- elasticloadbalancing:SetSecurityGroups
221223
- elasticloadbalancing:DescribeTags
222224
- elasticloadbalancing:ModifyLoadBalancerAttributes
223225
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

0 commit comments

Comments
 (0)