Skip to content

Commit 61f329f

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request openshift#7871 from r4f4/aws-altinfra-c2s
OCPBUGS-26052: aws: altinfra: fix role creation in C2S
2 parents 8710137 + ed0ef6c commit 61f329f

File tree

5 files changed

+78
-69
lines changed

5 files changed

+78
-69
lines changed

‎pkg/infrastructure/aws/aws.go‎

Lines changed: 43 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"time"
1010

1111
"github.com/aws/aws-sdk-go/aws"
12+
"github.com/aws/aws-sdk-go/aws/endpoints"
1213
"github.com/aws/aws-sdk-go/aws/request"
1314
"github.com/aws/aws-sdk-go/service/ec2"
1415
"github.com/aws/aws-sdk-go/service/ec2/ec2iface"
@@ -196,29 +197,36 @@ func (a InfraProvider) Provision(dir string, parents asset.Parents) ([]*asset.Fi
196197
return nil, fmt.Errorf("failed to create security groups: %w", err)
197198
}
198199

200+
partitionDNSSuffix := "amazonaws.com"
201+
if ps, found := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), clusterAWSConfig.Region); found {
202+
partitionDNSSuffix = ps.DNSSuffix()
203+
}
204+
logger.Debugf("Using partition DNS suffix: %s", partitionDNSSuffix)
205+
199206
logger.Infoln("Creating bootstrap resources")
200207
bootstrapSubnet := vpcOutput.privateSubnetIDs[0]
201208
if usePublicEndpoints {
202209
bootstrapSubnet = vpcOutput.publicSubnetIDs[0]
203210
}
204211
bootstrapInput := bootstrapInputOptions{
205212
instanceInputOptions: instanceInputOptions{
206-
infraID: clusterConfig.ClusterID,
207-
amiID: amiID,
208-
instanceType: clusterAWSConfig.MasterInstanceType,
209-
iamRole: clusterAWSConfig.MasterIAMRoleName,
210-
volumeType: "gp2",
211-
volumeSize: 30,
212-
volumeIOPS: 0,
213-
isEncrypted: true,
214-
metadataAuth: clusterAWSConfig.BootstrapMetadataAuthentication,
215-
kmsKeyID: clusterAWSConfig.KMSKeyID,
216-
securityGroupIds: []string{sgOutput.bootstrap, sgOutput.controlPlane},
217-
targetGroupARNs: lbOutput.targetGroupArns,
218-
subnetID: bootstrapSubnet,
219-
associatePublicIP: usePublicEndpoints,
220-
userData: clusterAWSConfig.BootstrapIgnitionStub,
221-
tags: tags,
213+
infraID: clusterConfig.ClusterID,
214+
amiID: amiID,
215+
instanceType: clusterAWSConfig.MasterInstanceType,
216+
iamRole: clusterAWSConfig.MasterIAMRoleName,
217+
volumeType: "gp2",
218+
volumeSize: 30,
219+
volumeIOPS: 0,
220+
isEncrypted: true,
221+
metadataAuth: clusterAWSConfig.BootstrapMetadataAuthentication,
222+
kmsKeyID: clusterAWSConfig.KMSKeyID,
223+
securityGroupIds: []string{sgOutput.bootstrap, sgOutput.controlPlane},
224+
targetGroupARNs: lbOutput.targetGroupArns,
225+
subnetID: bootstrapSubnet,
226+
associatePublicIP: usePublicEndpoints,
227+
userData: clusterAWSConfig.BootstrapIgnitionStub,
228+
partitionDNSSuffix: partitionDNSSuffix,
229+
tags: tags,
222230
},
223231
ignitionBucket: clusterAWSConfig.IgnitionBucket,
224232
ignitionContent: clusterConfig.IgnitionBootstrap,
@@ -233,21 +241,22 @@ func (a InfraProvider) Provision(dir string, parents asset.Parents) ([]*asset.Fi
233241
logger.Infoln("Creating control plane resources")
234242
controlPlaneInput := controlPlaneInputOptions{
235243
instanceInputOptions: instanceInputOptions{
236-
infraID: clusterConfig.ClusterID,
237-
amiID: amiID,
238-
instanceType: clusterAWSConfig.MasterInstanceType,
239-
iamRole: clusterAWSConfig.MasterIAMRoleName,
240-
volumeType: clusterAWSConfig.Type,
241-
volumeSize: clusterAWSConfig.Size,
242-
volumeIOPS: clusterAWSConfig.IOPS,
243-
isEncrypted: clusterAWSConfig.Encrypted,
244-
kmsKeyID: clusterAWSConfig.KMSKeyID,
245-
metadataAuth: clusterAWSConfig.MasterMetadataAuthentication,
246-
securityGroupIds: append(clusterAWSConfig.MasterSecurityGroups, sgOutput.controlPlane),
247-
targetGroupARNs: lbOutput.targetGroupArns,
248-
associatePublicIP: len(os.Getenv("OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY")) > 0,
249-
userData: clusterConfig.IgnitionMaster,
250-
tags: tags,
244+
infraID: clusterConfig.ClusterID,
245+
amiID: amiID,
246+
instanceType: clusterAWSConfig.MasterInstanceType,
247+
iamRole: clusterAWSConfig.MasterIAMRoleName,
248+
volumeType: clusterAWSConfig.Type,
249+
volumeSize: clusterAWSConfig.Size,
250+
volumeIOPS: clusterAWSConfig.IOPS,
251+
isEncrypted: clusterAWSConfig.Encrypted,
252+
kmsKeyID: clusterAWSConfig.KMSKeyID,
253+
metadataAuth: clusterAWSConfig.MasterMetadataAuthentication,
254+
securityGroupIds: append(clusterAWSConfig.MasterSecurityGroups, sgOutput.controlPlane),
255+
targetGroupARNs: lbOutput.targetGroupArns,
256+
associatePublicIP: len(os.Getenv("OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY")) > 0,
257+
userData: clusterConfig.IgnitionMaster,
258+
partitionDNSSuffix: partitionDNSSuffix,
259+
tags: tags,
251260
},
252261
nReplicas: clusterConfig.Masters,
253262
privateSubnetIDs: vpcOutput.privateSubnetIDs,
@@ -261,8 +270,9 @@ func (a InfraProvider) Provision(dir string, parents asset.Parents) ([]*asset.Fi
261270

262271
logger.Infoln("Creating compute resources")
263272
computeInput := computeInputOptions{
264-
infraID: clusterConfig.ClusterID,
265-
tags: tags,
273+
infraID: clusterConfig.ClusterID,
274+
partitionDNSSuffix: partitionDNSSuffix,
275+
tags: tags,
266276
}
267277
err = createComputeResources(ctx, logger, iamClient, &computeInput)
268278
if err != nil {

‎pkg/infrastructure/aws/bootstrap.go‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func createBootstrapResources(ctx context.Context, logger logrus.FieldLogger, ec
3737
}
3838

3939
profileName := fmt.Sprintf("%s-bootstrap", input.infraID)
40-
instanceProfile, err := createBootstrapInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.tags)
40+
instanceProfile, err := createBootstrapInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.partitionDNSSuffix, input.tags)
4141
if err != nil {
4242
return nil, fmt.Errorf("failed to create bootstrap instance profile: %w", err)
4343
}
@@ -167,22 +167,8 @@ func limitTags(tags map[string]string, size int) map[string]string {
167167
return resized
168168
}
169169

170-
func createBootstrapInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, tags map[string]string) (*iam.InstanceProfile, error) {
171-
const (
172-
assumeRolePolicy = `{
173-
"Version": "2012-10-17",
174-
"Statement": [
175-
{
176-
"Action": "sts:AssumeRole",
177-
"Principal": {
178-
"Service": "ec2.amazonaws.com"
179-
},
180-
"Effect": "Allow",
181-
"Sid": ""
182-
}
183-
]
184-
}`
185-
bootstrapPolicy = `{
170+
func createBootstrapInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, partitionDNSSuffix string, tags map[string]string) (*iam.InstanceProfile, error) {
171+
const bootstrapPolicy = `{
186172
"Version": "2012-10-17",
187173
"Statement": [
188174
{
@@ -202,7 +188,20 @@ func createBootstrapInstanceProfile(ctx context.Context, logger logrus.FieldLogg
202188
}
203189
]
204190
}`
205-
)
191+
192+
assumeRolePolicy := fmt.Sprintf(`{
193+
"Version": "2012-10-17",
194+
"Statement": [
195+
{
196+
"Action": "sts:AssumeRole",
197+
"Principal": {
198+
"Service": "ec2.%s"
199+
},
200+
"Effect": "Allow",
201+
"Sid": ""
202+
}
203+
]
204+
}`, partitionDNSSuffix)
206205

207206
profileInput := &instanceProfileOptions{
208207
namePrefix: name,

‎pkg/infrastructure/aws/compute.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,36 +10,37 @@ import (
1010
)
1111

1212
type computeInputOptions struct {
13-
infraID string
14-
tags map[string]string
13+
infraID string
14+
partitionDNSSuffix string
15+
tags map[string]string
1516
}
1617

1718
func createComputeResources(ctx context.Context, logger logrus.FieldLogger, iamClient iamiface.IAMAPI, input *computeInputOptions) error {
1819
profileName := fmt.Sprintf("%s-worker", input.infraID)
19-
_, err := createComputeInstanceProfile(ctx, logger, iamClient, profileName, input.tags)
20+
_, err := createComputeInstanceProfile(ctx, logger, iamClient, profileName, input.partitionDNSSuffix, input.tags)
2021
if err != nil {
2122
return fmt.Errorf("failed to create compute instance profile: %w", err)
2223
}
2324
logger.Infoln("Created compute instance profile")
2425
return nil
2526
}
2627

27-
func createComputeInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, tags map[string]string) (*iam.InstanceProfile, error) {
28-
const (
29-
assumeRolePolicy = `{
28+
func createComputeInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, partitionDNSSuffix string, tags map[string]string) (*iam.InstanceProfile, error) {
29+
assumeRolePolicy := fmt.Sprintf(`{
3030
"Version": "2012-10-17",
3131
"Statement": [
3232
{
3333
"Action": "sts:AssumeRole",
3434
"Principal": {
35-
"Service": "ec2.amazonaws.com"
35+
"Service": "ec2.%s"
3636
},
3737
"Effect": "Allow",
3838
"Sid": ""
3939
}
4040
]
41-
}`
42-
policy = `{
41+
}`, partitionDNSSuffix)
42+
43+
const policy = `{
4344
"Version": "2012-10-17",
4445
"Statement": [
4546
{
@@ -52,7 +53,6 @@ func createComputeInstanceProfile(ctx context.Context, logger logrus.FieldLogger
5253
}
5354
]
5455
}`
55-
)
5656

5757
input := &instanceProfileOptions{
5858
namePrefix: name,

‎pkg/infrastructure/aws/controlplane.go‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ type controlPlaneOutput struct {
2626

2727
func createControlPlaneResources(ctx context.Context, logger logrus.FieldLogger, ec2Client ec2iface.EC2API, iamClient iamiface.IAMAPI, elbClient elbv2iface.ELBV2API, input *controlPlaneInputOptions) (*controlPlaneOutput, error) {
2828
profileName := fmt.Sprintf("%s-master", input.infraID)
29-
instanceProfile, err := createControlPlaneInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.tags)
29+
instanceProfile, err := createControlPlaneInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.partitionDNSSuffix, input.tags)
3030
if err != nil {
3131
return nil, fmt.Errorf("failed to create control plane instance profile: %w", err)
3232
}
@@ -51,22 +51,22 @@ func createControlPlaneResources(ctx context.Context, logger logrus.FieldLogger,
5151
return &controlPlaneOutput{controlPlaneIPs: instanceIPs}, nil
5252
}
5353

54-
func createControlPlaneInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, tags map[string]string) (*iam.InstanceProfile, error) {
55-
const (
56-
assumeRolePolicy = `{
54+
func createControlPlaneInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, partitionDNSSuffix string, tags map[string]string) (*iam.InstanceProfile, error) {
55+
assumeRolePolicy := fmt.Sprintf(`{
5756
"Version": "2012-10-17",
5857
"Statement": [
5958
{
6059
"Action": "sts:AssumeRole",
6160
"Principal": {
62-
"Service": "ec2.amazonaws.com"
61+
"Service": "ec2.%s"
6362
},
6463
"Effect": "Allow",
6564
"Sid": ""
6665
}
6766
]
68-
}`
69-
policy = `{
67+
}`, partitionDNSSuffix)
68+
69+
const policy = `{
7070
"Version": "2012-10-17",
7171
"Statement": [
7272
{
@@ -115,7 +115,6 @@ func createControlPlaneInstanceProfile(ctx context.Context, logger logrus.FieldL
115115
}
116116
]
117117
}`
118-
)
119118

120119
profileInput := &instanceProfileOptions{
121120
namePrefix: name,

‎pkg/infrastructure/aws/instance.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ type instanceInputOptions struct {
3636
instanceProfileARN string
3737
volumeType string
3838
metadataAuth string
39+
partitionDNSSuffix string
3940
volumeSize int64
4041
volumeIOPS int64
4142
isEncrypted bool

0 commit comments

Comments
 (0)