Skip to content

Commit fa7a8f6

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4010 from AmitSahastra/arn-us-gov-v2
capa fix hardcoded role arn for aws iam authenticator
2 parents c42dc92 + 3374dbb commit fa7a8f6

24 files changed

+416
-44
lines changed

‎api/v1beta1/awscluster_conversion.go

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,27 +17,27 @@ limitations under the License.
1717
package v1beta1
1818

1919
import (
20-
infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
20+
infrav2 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
2121
utilconversion "sigs.k8s.io/cluster-api/util/conversion"
2222
"sigs.k8s.io/controller-runtime/pkg/conversion"
2323
)
2424

25-
// ConvertTo converts the v1beta1 AWSCluster receiver to a v1beta1 AWSCluster.
25+
// ConvertTo converts the v1beta1 AWSCluster receiver to a v1beta2 AWSCluster.
2626
func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
27-
dst := dstRaw.(*infrav1.AWSCluster)
27+
dst := dstRaw.(*infrav2.AWSCluster)
2828

2929
if err := Convert_v1beta1_AWSCluster_To_v1beta2_AWSCluster(src, dst, nil); err != nil {
3030
return err
3131
}
3232
// Manually restore data.
33-
restored := &infrav1.AWSCluster{}
33+
restored := &infrav2.AWSCluster{}
3434
if ok, err := utilconversion.UnmarshalData(src, restored); err != nil || !ok {
3535
return err
3636
}
3737

3838
if restored.Spec.ControlPlaneLoadBalancer != nil {
3939
if dst.Spec.ControlPlaneLoadBalancer == nil {
40-
dst.Spec.ControlPlaneLoadBalancer = &infrav1.AWSLoadBalancerSpec{}
40+
dst.Spec.ControlPlaneLoadBalancer = &infrav2.AWSLoadBalancerSpec{}
4141
}
4242
restoreControlPlaneLoadBalancer(restored.Spec.ControlPlaneLoadBalancer, dst.Spec.ControlPlaneLoadBalancer)
4343
}
@@ -47,13 +47,14 @@ func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
4747
if restored.Status.Bastion != nil {
4848
dst.Status.Bastion.InstanceMetadataOptions = restored.Status.Bastion.InstanceMetadataOptions
4949
}
50+
dst.Spec.Partition = restored.Spec.Partition
5051

5152
return nil
5253
}
5354

5455
// restoreControlPlaneLoadBalancerStatus manually restores the control plane loadbalancer status data.
5556
// Assumes restored and dst are non-nil.
56-
func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav1.LoadBalancer) {
57+
func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav2.LoadBalancer) {
5758
dst.ARN = restored.ARN
5859
dst.LoadBalancerType = restored.LoadBalancerType
5960
dst.ELBAttributes = restored.ELBAttributes
@@ -62,7 +63,7 @@ func restoreControlPlaneLoadBalancerStatus(restored, dst *infrav1.LoadBalancer)
6263

6364
// restoreControlPlaneLoadBalancer manually restores the control plane loadbalancer data.
6465
// Assumes restored and dst are non-nil.
65-
func restoreControlPlaneLoadBalancer(restored, dst *infrav1.AWSLoadBalancerSpec) {
66+
func restoreControlPlaneLoadBalancer(restored, dst *infrav2.AWSLoadBalancerSpec) {
6667
dst.Name = restored.Name
6768
dst.HealthCheckProtocol = restored.HealthCheckProtocol
6869
dst.LoadBalancerType = restored.LoadBalancerType
@@ -72,7 +73,7 @@ func restoreControlPlaneLoadBalancer(restored, dst *infrav1.AWSLoadBalancerSpec)
7273

7374
// ConvertFrom converts the v1beta1 AWSCluster receiver to a v1beta1 AWSCluster.
7475
func (r *AWSCluster) ConvertFrom(srcRaw conversion.Hub) error {
75-
src := srcRaw.(*infrav1.AWSCluster)
76+
src := srcRaw.(*infrav2.AWSCluster)
7677

7778
if err := Convert_v1beta2_AWSCluster_To_v1beta1_AWSCluster(src, r, nil); err != nil {
7879
return err
@@ -88,14 +89,14 @@ func (r *AWSCluster) ConvertFrom(srcRaw conversion.Hub) error {
8889

8990
// ConvertTo converts the v1beta1 AWSClusterList receiver to a v1beta2 AWSClusterList.
9091
func (src *AWSClusterList) ConvertTo(dstRaw conversion.Hub) error {
91-
dst := dstRaw.(*infrav1.AWSClusterList)
92+
dst := dstRaw.(*infrav2.AWSClusterList)
9293

9394
return Convert_v1beta1_AWSClusterList_To_v1beta2_AWSClusterList(src, dst, nil)
9495
}
9596

9697
// ConvertFrom converts the v1beta2 AWSClusterList receiver to a v1beta1 AWSClusterList.
9798
func (r *AWSClusterList) ConvertFrom(srcRaw conversion.Hub) error {
98-
src := srcRaw.(*infrav1.AWSClusterList)
99+
src := srcRaw.(*infrav2.AWSClusterList)
99100

100101
return Convert_v1beta2_AWSClusterList_To_v1beta1_AWSClusterList(src, r, nil)
101102
}

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awscluster_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ type AWSClusterSpec struct {
3939
// The AWS Region the cluster lives in.
4040
Region string `json:"region,omitempty"`
4141

42+
// Partition is the AWS security partition being used. Defaults to "aws"
43+
// +optional
44+
Partition string `json:"partition,omitempty"`
45+
4246
// SSHKeyName is the name of the ssh key to attach to the bastion host. Valid values are empty string (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)
4347
// +optional
4448
SSHKeyName *string `json:"sshKeyName,omitempty"`

‎cmd/clusterawsadm/api/bootstrap/v1beta1/defaults.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ const (
3333
DefaultStackName = "cluster-api-provider-aws-sigs-k8s-io"
3434
// DefaultPartitionName is the default security partition for AWS ARNs.
3535
DefaultPartitionName = "aws"
36+
// PartitionNameUSGov is the default security partition for AWS ARNs.
37+
PartitionNameUSGov = "aws-us-gov"
3638
// DefaultKMSAliasPattern is the default KMS alias.
3739
DefaultKMSAliasPattern = "cluster-api-provider-aws-*"
3840
// DefaultS3BucketPrefix is the default S3 bucket prefix.

‎cmd/clusterawsadm/cloudformation/bootstrap/fargate.go

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,18 @@ limitations under the License.
1717
package bootstrap
1818

1919
import (
20+
"strings"
21+
2022
bootstrapv1 "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/bootstrap/v1beta1"
2123
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
2224
)
2325

24-
func fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
25-
policies := eks.FargateRolePolicies()
26+
func (t Template) fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
27+
var policies []string
28+
policies = eks.FargateRolePolicies()
29+
if strings.Contains(t.Spec.Partition, bootstrapv1.PartitionNameUSGov) {
30+
policies = eks.FargateRolePoliciesUSGov()
31+
}
2632
if roleSpec.ExtraPolicyAttachments != nil {
2733
policies = append(policies, roleSpec.ExtraPolicyAttachments...)
2834
}

‎cmd/clusterawsadm/cloudformation/bootstrap/managed_nodegroup.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,20 @@ limitations under the License.
1616

1717
package bootstrap
1818

19-
import "sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
19+
import (
20+
"strings"
21+
22+
bootstrapv1 "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/bootstrap/v1beta1"
23+
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/services/eks"
24+
)
2025

2126
func (t Template) eksMachinePoolPolicies() []string {
22-
policies := eks.NodegroupRolePolicies()
27+
var policies []string
28+
29+
policies = eks.NodegroupRolePolicies()
30+
if strings.Contains(t.Spec.Partition, bootstrapv1.PartitionNameUSGov) {
31+
policies = eks.NodegroupRolePoliciesUSGov()
32+
}
2333
if t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments != nil {
2434
policies = append(policies, t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments...)
2535
}

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
200200
template.Resources[AWSIAMRoleEKSFargate] = &cfn_iam.Role{
201201
RoleName: expinfrav1.DefaultEKSFargateRole,
202202
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{eksiam.EKSFargateService}),
203-
ManagedPolicyArns: fargateProfilePolicies(t.Spec.EKS.Fargate),
203+
ManagedPolicyArns: t.fargateProfilePolicies(t.Spec.EKS.Fargate),
204204
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.Fargate.Tags),
205205
}
206206
}

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1989,6 +1989,10 @@ spec:
19891989
prefixing.
19901990
type: string
19911991
type: object
1992+
partition:
1993+
description: Partition is the AWS security partition being used. Defaults
1994+
to "aws"
1995+
type: string
19921996
region:
19931997
description: The AWS Region the cluster lives in.
19941998
type: string

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1249,6 +1249,10 @@ spec:
12491249
type: object
12501250
type: object
12511251
type: object
1252+
partition:
1253+
description: Partition is the AWS security partition being used. Defaults
1254+
to "aws"
1255+
type: string
12521256
region:
12531257
description: The AWS Region the cluster lives in.
12541258
type: string

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclustertemplates.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -856,6 +856,10 @@ spec:
856856
type: object
857857
type: object
858858
type: object
859+
partition:
860+
description: Partition is the AWS security partition being
861+
used. Defaults to "aws"
862+
type: string
859863
region:
860864
description: The AWS Region the cluster lives in.
861865
type: string

0 commit comments

Comments
 (0)