Skip to content

Commit 378727f

Browse files
AmitSahastraAmitSahastra
committed
capa fix hardcoded role arn for aws iam authenticator
capa fix hardcoded role arn for aws iam authenticator Added mock for partition
1 parent 9488cb5 commit 378727f

26 files changed

+421
-46
lines changed

‎api/v1beta1/awscluster_conversion.go

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,40 +17,41 @@ limitations under the License.
1717
package v1beta1
1818

1919
import (
20-
infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
20+
infrav2 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
2121
utilconversion "sigs.k8s.io/cluster-api/util/conversion"
2222
"sigs.k8s.io/controller-runtime/pkg/conversion"
2323
)
2424

25-
// ConvertTo converts the v1beta1 AWSCluster receiver to a v1beta1 AWSCluster.
25+
// ConvertTo converts the v1beta1 AWSCluster receiver to a v1beta2 AWSCluster.
2626
func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
27-
dst := dstRaw.(*infrav1.AWSCluster)
27+
dst := dstRaw.(*infrav2.AWSCluster)
2828

2929
if err := Convert_v1beta1_AWSCluster_To_v1beta2_AWSCluster(src, dst, nil); err != nil {
3030
return err
3131
}
3232
// Manually restore data.
33-
restored := &infrav1.AWSCluster{}
33+
restored := &infrav2.AWSCluster{}
3434
if ok, err := utilconversion.UnmarshalData(src, restored); err != nil || !ok {
3535
return err
3636
}
3737

3838
if restored.Spec.ControlPlaneLoadBalancer != nil {
3939
if dst.Spec.ControlPlaneLoadBalancer == nil {
40-
dst.Spec.ControlPlaneLoadBalancer = &infrav1.AWSLoadBalancerSpec{}
40+
dst.Spec.ControlPlaneLoadBalancer = &infrav2.AWSLoadBalancerSpec{}
4141
}
4242
restoreControlPlaneLoadBalancer(restored.Spec.ControlPlaneLoadBalancer, dst.Spec.ControlPlaneLoadBalancer)
4343
}
4444
restoreControlPlaneLoadBalancerStatus(&restored.Status.Network.APIServerELB, &dst.Status.Network.APIServerELB)
4545

4646
dst.Spec.S3Bucket = restored.Spec.S3Bucket
47+
dst.Spec.Partition = restored.Spec.Partition
4748

4849
return nil
4950
}
5051

5152
// restoreControlPlaneLoadBalancerStatus manually restores the control plane loadbalancer status data.
5253
// Assumes restored and dst are non-nil.
53-
func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav1.LoadBalancer) {
54+
func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav2.LoadBalancer) {
5455
dst.ARN = restored.ARN
5556
dst.LoadBalancerType = restored.LoadBalancerType
5657
dst.ELBAttributes = restored.ELBAttributes
@@ -59,7 +60,7 @@ func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav1.LoadBalancer)
5960

6061
// restoreControlPlaneLoadBalancer manually restores the control plane loadbalancer data.
6162
// Assumes restored and dst are non-nil.
62-
func restoreControlPlaneLoadBalancer(restored, dst *infrav1.AWSLoadBalancerSpec) {
63+
func restoreControlPlaneLoadBalancer(restored, dst *infrav2.AWSLoadBalancerSpec) {
6364
dst.Name = restored.Name
6465
dst.HealthCheckProtocol = restored.HealthCheckProtocol
6566
dst.LoadBalancerType = restored.LoadBalancerType
@@ -69,7 +70,7 @@ func restoreControlPlaneLoadBalancer(restored, dst *infrav1.AWSLoadBalancerSpec)
6970

7071
// ConvertFrom converts the v1beta1 AWSCluster receiver to a v1beta1 AWSCluster.
7172
func (r *AWSCluster) ConvertFrom(srcRaw conversion.Hub) error {
72-
src := srcRaw.(*infrav1.AWSCluster)
73+
src := srcRaw.(*infrav2.AWSCluster)
7374

7475
if err := Convert_v1beta2_AWSCluster_To_v1beta1_AWSCluster(src, r, nil); err != nil {
7576
return err
@@ -85,14 +86,14 @@ func (r *AWSCluster) ConvertFrom(srcRaw conversion.Hub) error {
8586

8687
// ConvertTo converts the v1beta1 AWSClusterList receiver to a v1beta2 AWSClusterList.
8788
func (src *AWSClusterList) ConvertTo(dstRaw conversion.Hub) error {
88-
dst := dstRaw.(*infrav1.AWSClusterList)
89+
dst := dstRaw.(*infrav2.AWSClusterList)
8990

9091
return Convert_v1beta1_AWSClusterList_To_v1beta2_AWSClusterList(src, dst, nil)
9192
}
9293

9394
// ConvertFrom converts the v1beta2 AWSClusterList receiver to a v1beta1 AWSClusterList.
9495
func (r *AWSClusterList) ConvertFrom(srcRaw conversion.Hub) error {
95-
src := srcRaw.(*infrav1.AWSClusterList)
96+
src := srcRaw.(*infrav2.AWSClusterList)
9697

9798
return Convert_v1beta2_AWSClusterList_To_v1beta1_AWSClusterList(src, r, nil)
9899
}

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ type AWSClusterSpec struct {
3939
// The AWS Region the cluster lives in.
4040
Region string `json:"region,omitempty"`
4141

42+
// Partition is the AWS security partition being used. Defaults to "aws"
43+
// +optional
44+
Partition string `json:"partition,omitempty"`
45+
4246
// SSHKeyName is the name of the ssh key to attach to the bastion host. Valid values are empty string (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)
4347
// +optional
4448
SSHKeyName *string `json:"sshKeyName,omitempty"`

‎cmd/clusterawsadm/api/bootstrap/v1beta1/defaults.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ const (
3131
DefaultStackName = "cluster-api-provider-aws-sigs-k8s-io"
3232
// DefaultPartitionName is the default security partition for AWS ARNs.
3333
DefaultPartitionName = "aws"
34+
// PartitionNameUSGov is the default security partition for AWS ARNs.
35+
PartitionNameUSGov = "aws-us-gov"
3436
// DefaultKMSAliasPattern is the default KMS alias.
3537
DefaultKMSAliasPattern = "cluster-api-provider-aws-*"
3638
// DefaultS3BucketPrefix is the default S3 bucket prefix.

‎cmd/clusterawsadm/cloudformation/bootstrap/fargate.go

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,18 @@ limitations under the License.
1717
package bootstrap
1818

1919
import (
20+
"strings"
21+
2022
bootstrapv1 "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/bootstrap/v1beta1"
2123
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
2224
)
2325

24-
func fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
25-
policies := eks.FargateRolePolicies()
26+
func (t Template) fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
27+
var policies []string
28+
policies = eks.FargateRolePolicies()
29+
if strings.Contains(t.Spec.Partition, bootstrapv1.PartitionNameUSGov) {
30+
policies = eks.FargateRolePoliciesUSGov()
31+
}
2632
if roleSpec.ExtraPolicyAttachments != nil {
2733
policies = append(policies, roleSpec.ExtraPolicyAttachments...)
2834
}

‎cmd/clusterawsadm/cloudformation/bootstrap/managed_nodegroup.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,20 @@ limitations under the License.
1616

1717
package bootstrap
1818

19-
import "sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
19+
import (
20+
"strings"
21+
22+
bootstrapv1 "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/bootstrap/v1beta1"
23+
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
24+
)
2025

2126
func (t Template) eksMachinePoolPolicies() []string {
22-
policies := eks.NodegroupRolePolicies()
27+
var policies []string
28+
29+
policies = eks.NodegroupRolePolicies()
30+
if strings.Contains(t.Spec.Partition, bootstrapv1.PartitionNameUSGov) {
31+
policies = eks.NodegroupRolePoliciesUSGov()
32+
}
2333
if t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments != nil {
2434
policies = append(policies, t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments...)
2535
}

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
200200
template.Resources[AWSIAMRoleEKSFargate] = &cfn_iam.Role{
201201
RoleName: expinfrav1.DefaultEKSFargateRole,
202202
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{eksiam.EKSFargateService}),
203-
ManagedPolicyArns: fargateProfilePolicies(t.Spec.EKS.Fargate),
203+
ManagedPolicyArns: t.fargateProfilePolicies(t.Spec.EKS.Fargate),
204204
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.Fargate.Tags),
205205
}
206206
}

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1936,6 +1936,10 @@ spec:
19361936
prefixing.
19371937
type: string
19381938
type: object
1939+
partition:
1940+
description: Partition is the AWS security partition being used. Defaults
1941+
to "aws"
1942+
type: string
19391943
region:
19401944
description: The AWS Region the cluster lives in.
19411945
type: string

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1241,6 +1241,10 @@ spec:
12411241
type: object
12421242
type: object
12431243
type: object
1244+
partition:
1245+
description: Partition is the AWS security partition being used. Defaults
1246+
to "aws"
1247+
type: string
12441248
region:
12451249
description: The AWS Region the cluster lives in.
12461250
type: string

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -848,6 +848,10 @@ spec:
848848
type: object
849849
type: object
850850
type: object
851+
partition:
852+
description: Partition is the AWS security partition being
853+
used. Defaults to "aws"
854+
type: string
851855
region:
852856
description: The AWS Region the cluster lives in.
853857
type: string

0 commit comments

Comments
 (0)