Skip to content

Commit 5aa4840

Browse files
r4f4r4f4
committed
aws: move permission list generation to its own function.
This will allow for it to be reused without code duplication and for it to be unit tested.
1 parent 836858d commit 5aa4840

File tree

2 files changed

+86
-70
lines changed

2 files changed

+86
-70
lines changed

‎pkg/asset/installconfig/aws/permissions.go‎

Lines changed: 85 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77

88
"github.com/aws/aws-sdk-go/aws/session"
99
"github.com/sirupsen/logrus"
10+
"k8s.io/apimachinery/pkg/util/sets"
1011

1112
ccaws "github.com/openshift/cloud-credential-operator/pkg/aws"
1213
"github.com/openshift/installer/pkg/types"
@@ -293,14 +294,9 @@ var permissions = map[PermissionGroup][]string{
293294
// as either capable of creating new credentials for components that interact with the cloud or
294295
// being able to be passed through as-is to the components that need cloud credentials
295296
func ValidateCreds(ssn *session.Session, groups []PermissionGroup, region string) error {
296-
// Compile a list of permissions based on the permission groups provided
297-
requiredPermissions := []string{}
298-
for _, group := range groups {
299-
groupPerms, ok := permissions[group]
300-
if !ok {
301-
return fmt.Errorf("unable to access permissions group %s", group)
302-
}
303-
requiredPermissions = append(requiredPermissions, groupPerms...)
297+
requiredPermissions, err := PermissionsList(groups)
298+
if err != nil {
299+
return err
304300
}
305301

306302
client := ccaws.NewClientFromSession(ssn)
@@ -341,8 +337,85 @@ func ValidateCreds(ssn *session.Session, groups []PermissionGroup, region string
341337
return errors.New("AWS credentials cannot be used to either create new creds or use as-is")
342338
}
343339

344-
// IncludesExistingInstanceRole checks if at least one BYO instance role is included in the install-config.
345-
func IncludesExistingInstanceRole(installConfig *types.InstallConfig) bool {
340+
// RequiredPermissionGroups returns a set of required permissions for a given cluster configuration.
341+
func RequiredPermissionGroups(ic *types.InstallConfig) []PermissionGroup {
342+
permissionGroups := []PermissionGroup{PermissionCreateBase}
343+
usingExistingVPC := len(ic.AWS.Subnets) != 0
344+
usingExistingPrivateZone := len(ic.AWS.HostedZone) != 0
345+
346+
if !usingExistingVPC {
347+
permissionGroups = append(permissionGroups, PermissionCreateNetworking)
348+
}
349+
350+
if !usingExistingPrivateZone {
351+
permissionGroups = append(permissionGroups, PermissionCreateHostedZone)
352+
}
353+
354+
ec2RootVolume := aws.EC2RootVolume{}
355+
var awsMachinePoolUsingKMS, masterMachinePoolUsingKMS bool
356+
if ic.AWS.DefaultMachinePlatform != nil && ic.AWS.DefaultMachinePlatform.EC2RootVolume != ec2RootVolume {
357+
awsMachinePoolUsingKMS = len(ic.AWS.DefaultMachinePlatform.EC2RootVolume.KMSKeyARN) != 0
358+
}
359+
if ic.ControlPlane != nil &&
360+
ic.ControlPlane.Name == types.MachinePoolControlPlaneRoleName &&
361+
ic.ControlPlane.Platform.AWS != nil &&
362+
ic.ControlPlane.Platform.AWS.EC2RootVolume != ec2RootVolume {
363+
masterMachinePoolUsingKMS = len(ic.ControlPlane.Platform.AWS.EC2RootVolume.KMSKeyARN) != 0
364+
}
365+
// Add KMS encryption keys, if provided.
366+
if awsMachinePoolUsingKMS || masterMachinePoolUsingKMS {
367+
logrus.Debugf("Adding %s to the group of permissions", PermissionKMSEncryptionKeys)
368+
permissionGroups = append(permissionGroups, PermissionKMSEncryptionKeys)
369+
}
370+
371+
// Add delete permissions for non-C2S installs.
372+
if !aws.IsSecretRegion(ic.AWS.Region) {
373+
permissionGroups = append(permissionGroups, PermissionDeleteBase)
374+
if usingExistingVPC {
375+
permissionGroups = append(permissionGroups, PermissionDeleteSharedNetworking)
376+
} else {
377+
permissionGroups = append(permissionGroups, PermissionDeleteNetworking)
378+
}
379+
if !usingExistingPrivateZone {
380+
permissionGroups = append(permissionGroups, PermissionDeleteHostedZone)
381+
}
382+
}
383+
384+
if ic.AWS.PublicIpv4Pool != "" {
385+
permissionGroups = append(permissionGroups, PermissionPublicIpv4Pool)
386+
}
387+
388+
if !ic.AWS.BestEffortDeleteIgnition {
389+
permissionGroups = append(permissionGroups, PermissionDeleteIgnitionObjects)
390+
}
391+
392+
if includesCreateInstanceRole(ic) {
393+
permissionGroups = append(permissionGroups, PermissionCreateInstanceRole)
394+
}
395+
396+
if includesExistingInstanceRole(ic) {
397+
permissionGroups = append(permissionGroups, PermissionDeleteSharedInstanceRole)
398+
}
399+
400+
return permissionGroups
401+
}
402+
403+
// PermissionsList compiles a list of permissions based on the permission groups provided.
404+
func PermissionsList(required []PermissionGroup) ([]string, error) {
405+
requiredPermissions := sets.New[string]()
406+
for _, group := range required {
407+
groupPerms, ok := permissions[group]
408+
if !ok {
409+
return nil, fmt.Errorf("unable to access permissions group %s", group)
410+
}
411+
requiredPermissions.Insert(groupPerms...)
412+
}
413+
414+
return sets.List(requiredPermissions), nil
415+
}
416+
417+
// includesExistingInstanceRole checks if at least one BYO instance role is included in the install-config.
418+
func includesExistingInstanceRole(installConfig *types.InstallConfig) bool {
346419
mpool := aws.MachinePool{}
347420
mpool.Set(installConfig.AWS.DefaultMachinePlatform)
348421

@@ -357,8 +430,8 @@ func IncludesExistingInstanceRole(installConfig *types.InstallConfig) bool {
357430
return len(mpool.IAMRole) > 0
358431
}
359432

360-
// IncludesCreateInstanceRole checks if at least one instance role will be created by the installer.
361-
func IncludesCreateInstanceRole(installConfig *types.InstallConfig) bool {
433+
// includesCreateInstanceRole checks if at least one instance role will be created by the installer.
434+
func includesCreateInstanceRole(installConfig *types.InstallConfig) bool {
362435
{
363436
mpool := aws.MachinePool{}
364437
mpool.Set(installConfig.AWS.DefaultMachinePlatform)

‎pkg/asset/installconfig/platformpermscheck.go‎

Lines changed: 1 addition & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import (
1010
"github.com/openshift/installer/pkg/asset"
1111
awsconfig "github.com/openshift/installer/pkg/asset/installconfig/aws"
1212
gcpconfig "github.com/openshift/installer/pkg/asset/installconfig/gcp"
13-
"github.com/openshift/installer/pkg/types"
1413
"github.com/openshift/installer/pkg/types/aws"
1514
"github.com/openshift/installer/pkg/types/azure"
1615
"github.com/openshift/installer/pkg/types/baremetal"
@@ -54,63 +53,7 @@ func (a *PlatformPermsCheck) Generate(ctx context.Context, dependencies asset.Pa
5453
platform := ic.Config.Platform.Name()
5554
switch platform {
5655
case aws.Name:
57-
permissionGroups := []awsconfig.PermissionGroup{awsconfig.PermissionCreateBase}
58-
usingExistingVPC := len(ic.Config.AWS.Subnets) != 0
59-
usingExistingPrivateZone := len(ic.Config.AWS.HostedZone) != 0
60-
61-
if !usingExistingVPC {
62-
permissionGroups = append(permissionGroups, awsconfig.PermissionCreateNetworking)
63-
}
64-
65-
if !usingExistingPrivateZone {
66-
permissionGroups = append(permissionGroups, awsconfig.PermissionCreateHostedZone)
67-
}
68-
69-
var ec2RootVolume = aws.EC2RootVolume{}
70-
var awsMachinePoolUsingKMS, masterMachinePoolUsingKMS bool
71-
if ic.Config.AWS.DefaultMachinePlatform != nil && ic.Config.AWS.DefaultMachinePlatform.EC2RootVolume != ec2RootVolume {
72-
awsMachinePoolUsingKMS = len(ic.Config.AWS.DefaultMachinePlatform.EC2RootVolume.KMSKeyARN) != 0
73-
}
74-
if ic.Config.ControlPlane != nil &&
75-
ic.Config.ControlPlane.Name == types.MachinePoolControlPlaneRoleName &&
76-
ic.Config.ControlPlane.Platform.AWS != nil &&
77-
ic.Config.ControlPlane.Platform.AWS.EC2RootVolume != ec2RootVolume {
78-
masterMachinePoolUsingKMS = len(ic.Config.ControlPlane.Platform.AWS.EC2RootVolume.KMSKeyARN) != 0
79-
}
80-
// Add KMS encryption keys, if provided.
81-
if awsMachinePoolUsingKMS || masterMachinePoolUsingKMS {
82-
logrus.Debugf("Adding %s to the group of permissions to validate", awsconfig.PermissionKMSEncryptionKeys)
83-
permissionGroups = append(permissionGroups, awsconfig.PermissionKMSEncryptionKeys)
84-
}
85-
86-
// Add delete permissions for non-C2S installs.
87-
if !aws.IsSecretRegion(ic.Config.AWS.Region) {
88-
permissionGroups = append(permissionGroups, awsconfig.PermissionDeleteBase)
89-
if usingExistingVPC {
90-
permissionGroups = append(permissionGroups, awsconfig.PermissionDeleteSharedNetworking)
91-
} else {
92-
permissionGroups = append(permissionGroups, awsconfig.PermissionDeleteNetworking)
93-
}
94-
if !usingExistingPrivateZone {
95-
permissionGroups = append(permissionGroups, awsconfig.PermissionDeleteHostedZone)
96-
}
97-
}
98-
99-
if ic.Config.AWS.PublicIpv4Pool != "" {
100-
permissionGroups = append(permissionGroups, awsconfig.PermissionPublicIpv4Pool)
101-
}
102-
103-
if !ic.Config.AWS.BestEffortDeleteIgnition {
104-
permissionGroups = append(permissionGroups, awsconfig.PermissionDeleteIgnitionObjects)
105-
}
106-
107-
if awsconfig.IncludesCreateInstanceRole(ic.Config) {
108-
permissionGroups = append(permissionGroups, awsconfig.PermissionCreateInstanceRole)
109-
}
110-
111-
if awsconfig.IncludesExistingInstanceRole(ic.Config) {
112-
permissionGroups = append(permissionGroups, awsconfig.PermissionDeleteSharedInstanceRole)
113-
}
56+
permissionGroups := awsconfig.RequiredPermissionGroups(ic.Config)
11457

11558
ssn, err := ic.AWS.Session(ctx)
11659
if err != nil {

0 commit comments

Comments
 (0)