Skip to content

Commit 562020d

Browse files
authored
Merge pull request #4347 from muraee/fix-pick-arch-perms
Use default arch x86_64 for AMI lookup if `ec2:DescribeInstanceTypes` permission is missing
2 parents eaa3eca + 2b09ce9 commit 562020d

File tree

2 files changed

+21
-1
lines changed

2 files changed

+21
-1
lines changed

pkg/cloud/awserrors/errors.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ const (
5050
RouteTableNotFound = "InvalidRouteTableID.NotFound"
5151
SubnetNotFound = "InvalidSubnetID.NotFound"
5252
UnrecognizedClientException = "UnrecognizedClientException"
53+
UnauthorizedOperation = "UnauthorizedOperation"
5354
VPCNotFound = "InvalidVpcID.NotFound"
5455
VPCMissingParameter = "MissingParameter"
5556
ErrCodeRepositoryAlreadyExistsException = "RepositoryAlreadyExistsException"
@@ -174,6 +175,15 @@ func IsInvalidNotFoundError(err error) bool {
174175
return false
175176
}
176177

178+
// IsPermissionsError tests for common aws permission errors.
179+
func IsPermissionsError(err error) bool {
180+
if code, ok := Code(err); ok {
181+
return code == AuthFailure || code == UnauthorizedOperation
182+
}
183+
184+
return false
185+
}
186+
177187
// ReasonForError returns the HTTP status for a particular error.
178188
func ReasonForError(err error) int {
179189
if t, ok := err.(*EC2Error); ok {

pkg/cloud/services/ec2/ami.go

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,15 @@ import (
3333

3434
infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
3535
"sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/bootstrap/v1beta1"
36+
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/awserrors"
3637
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/record"
3738
"sigs.k8s.io/cluster-api-provider-aws/v2/util/system"
3839
)
3940

4041
const (
42+
// DefaultArchitectureTag is the default architecture used when the architcture can't be determined from instance type.
43+
DefaultArchitectureTag = Amd64ArchitectureTag
44+
4145
// Amd64ArchitectureTag is the reference AWS uses for amd64 architecture images.
4246
Amd64ArchitectureTag = "x86_64"
4347

@@ -114,7 +118,13 @@ func (s *Service) pickArchitectureForInstanceType(instanceType string) (string,
114118
}
115119
describeInstanceTypeResult, err := s.EC2Client.DescribeInstanceTypes(descInstanceTypeInput)
116120
if err != nil {
117-
return "", err
121+
// if call to DescribeInstanceTypes fails due to permissions error, log a warning and return the default architecture.
122+
if awserrors.IsPermissionsError(err) {
123+
record.Warnf(s.scope.InfraCluster(), "FailedDescribeInstanceTypes", "insufficient permissions to describe instance types for instance type %q, falling back to the default architecture of %q: %v", instanceType, DefaultArchitectureTag, err)
124+
125+
return DefaultArchitectureTag, nil
126+
}
127+
return "", errors.Wrapf(err, "failed to describe instance types for instance type %q", instanceType)
118128
}
119129

120130
if len(describeInstanceTypeResult.InstanceTypes) == 0 {

0 commit comments

Comments
 (0)