Skip to content

Commit 520eb4c

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5154 from richardcase/fix_nlb_setsecuritygroups
🐛 fix: add missing permissions for nlb
2 parents 69aaac9 + 7832150 commit 520eb4c

16 files changed

+38
-4
lines changed

‎cmd/clusterawsadm/cloudformation/bootstrap/cloud_provider_integration_control_plane.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ func (t Template) cloudProviderControlPlaneAwsPolicy() *iamv1.PolicyDocument {
6767
"elasticloadbalancing:AddTags",
6868
"elasticloadbalancing:AttachLoadBalancerToSubnets",
6969
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
70+
"elasticloadbalancing:SetSecurityGroups",
7071
"elasticloadbalancing:CreateLoadBalancer",
7172
"elasticloadbalancing:CreateLoadBalancerPolicy",
7273
"elasticloadbalancing:CreateLoadBalancerListeners",

‎cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
161161
"elasticloadbalancing:DescribeLoadBalancerAttributes",
162162
"elasticloadbalancing:DescribeTargetGroups",
163163
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
164+
"elasticloadbalancing:SetSecurityGroups",
164165
"elasticloadbalancing:DescribeTags",
165166
"elasticloadbalancing:ModifyLoadBalancerAttributes",
166167
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
@@ -415,15 +416,17 @@ func (t Template) ControllersPolicyEKS() *iamv1.PolicyDocument {
415416
"arn:*:iam::*:role/*",
416417
},
417418
Effect: iamv1.EffectAllow,
418-
}, {
419+
},
420+
{
419421
Action: iamv1.Actions{
420422
"iam:GetPolicy",
421423
},
422424
Resource: iamv1.Resources{
423425
t.generateAWSManagedPolicyARN(eksClusterPolicyName),
424426
},
425427
Effect: iamv1.EffectAllow,
426-
}, {
428+
},
429+
{
427430
Action: iamv1.Actions{
428431
"eks:DescribeCluster",
429432
"eks:ListClusters",
@@ -449,7 +452,8 @@ func (t Template) ControllersPolicyEKS() *iamv1.PolicyDocument {
449452
"arn:*:eks:*:*:nodegroup/*/*/*",
450453
},
451454
Effect: iamv1.EffectAllow,
452-
}, {
455+
},
456+
{
453457
Action: iamv1.Actions{
454458
"ec2:AssociateVpcCidrBlock",
455459
"ec2:DisassociateVpcCidrBlock",
@@ -468,7 +472,8 @@ func (t Template) ControllersPolicyEKS() *iamv1.PolicyDocument {
468472
"*",
469473
},
470474
Effect: iamv1.EffectAllow,
471-
}, {
475+
},
476+
{
472477
Action: iamv1.Actions{
473478
"iam:PassRole",
474479
},

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/customsuffix.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -220,6 +221,7 @@ Resources:
220221
- elasticloadbalancing:DescribeLoadBalancerAttributes
221222
- elasticloadbalancing:DescribeTargetGroups
222223
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
224+
- elasticloadbalancing:SetSecurityGroups
223225
- elasticloadbalancing:DescribeTags
224226
- elasticloadbalancing:ModifyLoadBalancerAttributes
225227
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -220,6 +221,7 @@ Resources:
220221
- elasticloadbalancing:DescribeLoadBalancerAttributes
221222
- elasticloadbalancing:DescribeTargetGroups
222223
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
224+
- elasticloadbalancing:SetSecurityGroups
223225
- elasticloadbalancing:DescribeTags
224226
- elasticloadbalancing:ModifyLoadBalancerAttributes
225227
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -226,6 +227,7 @@ Resources:
226227
- elasticloadbalancing:DescribeLoadBalancerAttributes
227228
- elasticloadbalancing:DescribeTargetGroups
228229
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
230+
- elasticloadbalancing:SetSecurityGroups
229231
- elasticloadbalancing:DescribeTags
230232
- elasticloadbalancing:ModifyLoadBalancerAttributes
231233
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_allow_assume_role.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -220,6 +221,7 @@ Resources:
220221
- elasticloadbalancing:DescribeLoadBalancerAttributes
221222
- elasticloadbalancing:DescribeTargetGroups
222223
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
224+
- elasticloadbalancing:SetSecurityGroups
223225
- elasticloadbalancing:DescribeTags
224226
- elasticloadbalancing:ModifyLoadBalancerAttributes
225227
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_bootstrap_user.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ Resources:
5757
- elasticloadbalancing:AddTags
5858
- elasticloadbalancing:AttachLoadBalancerToSubnets
5959
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
60+
- elasticloadbalancing:SetSecurityGroups
6061
- elasticloadbalancing:CreateLoadBalancer
6162
- elasticloadbalancing:CreateLoadBalancerPolicy
6263
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -226,6 +227,7 @@ Resources:
226227
- elasticloadbalancing:DescribeLoadBalancerAttributes
227228
- elasticloadbalancing:DescribeTargetGroups
228229
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
230+
- elasticloadbalancing:SetSecurityGroups
229231
- elasticloadbalancing:DescribeTags
230232
- elasticloadbalancing:ModifyLoadBalancerAttributes
231233
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_custom_bootstrap_user.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ Resources:
5757
- elasticloadbalancing:AddTags
5858
- elasticloadbalancing:AttachLoadBalancerToSubnets
5959
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
60+
- elasticloadbalancing:SetSecurityGroups
6061
- elasticloadbalancing:CreateLoadBalancer
6162
- elasticloadbalancing:CreateLoadBalancerPolicy
6263
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -226,6 +227,7 @@ Resources:
226227
- elasticloadbalancing:DescribeLoadBalancerAttributes
227228
- elasticloadbalancing:DescribeTargetGroups
228229
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
230+
- elasticloadbalancing:SetSecurityGroups
229231
- elasticloadbalancing:DescribeTags
230232
- elasticloadbalancing:ModifyLoadBalancerAttributes
231233
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_different_instance_profiles.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -220,6 +221,7 @@ Resources:
220221
- elasticloadbalancing:DescribeLoadBalancerAttributes
221222
- elasticloadbalancing:DescribeTargetGroups
222223
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
224+
- elasticloadbalancing:SetSecurityGroups
223225
- elasticloadbalancing:DescribeTags
224226
- elasticloadbalancing:ModifyLoadBalancerAttributes
225227
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_console.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ Resources:
5353
- elasticloadbalancing:AddTags
5454
- elasticloadbalancing:AttachLoadBalancerToSubnets
5555
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
56+
- elasticloadbalancing:SetSecurityGroups
5657
- elasticloadbalancing:CreateLoadBalancer
5758
- elasticloadbalancing:CreateLoadBalancerPolicy
5859
- elasticloadbalancing:CreateLoadBalancerListeners
@@ -220,6 +221,7 @@ Resources:
220221
- elasticloadbalancing:DescribeLoadBalancerAttributes
221222
- elasticloadbalancing:DescribeTargetGroups
222223
- elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
224+
- elasticloadbalancing:SetSecurityGroups
223225
- elasticloadbalancing:DescribeTags
224226
- elasticloadbalancing:ModifyLoadBalancerAttributes
225227
- elasticloadbalancing:RegisterInstancesWithLoadBalancer

0 commit comments

Comments
 (0)