Skip to content

Commit ed0ef6c

Browse files
r4f4r4f4
committed
OCPBUGS-26052: aws: altinfra: fix role creation in C2S
When creating the instance role assume policy, we need to take into account that the ec2 service endpoint will differ according to the partition. This should fix the following error when deploying on C2S regions: ``` level=error msg=failed to fetch Cluster: failed to generate asset "Cluster": failed to create cluster: failed to create bootstrap resources: failed to create bootstrap instance profile: failed to create role (yunjiang-14c2a-t4wp7-bootstrap-role): RequestCanceled: request context canceled ``` because the installer is trying to use the regular `ec2.amazonaws.com` service suffix instead of the appropriate one.
1 parent 6f4b11e commit ed0ef6c

File tree

5 files changed

+78
-69
lines changed

5 files changed

+78
-69
lines changed

‎pkg/infrastructure/aws/aws.go‎

Lines changed: 43 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"time"
1010

1111
"github.com/aws/aws-sdk-go/aws"
12+
"github.com/aws/aws-sdk-go/aws/endpoints"
1213
"github.com/aws/aws-sdk-go/aws/request"
1314
"github.com/aws/aws-sdk-go/service/ec2"
1415
"github.com/aws/aws-sdk-go/service/ec2/ec2iface"
@@ -196,29 +197,36 @@ func (a InfraProvider) Provision(dir string, vars []*asset.File) ([]*asset.File,
196197
return nil, fmt.Errorf("failed to create security groups: %w", err)
197198
}
198199

200+
partitionDNSSuffix := "amazonaws.com"
201+
if ps, found := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), clusterAWSConfig.Region); found {
202+
partitionDNSSuffix = ps.DNSSuffix()
203+
}
204+
logger.Debugf("Using partition DNS suffix: %s", partitionDNSSuffix)
205+
199206
logger.Infoln("Creating bootstrap resources")
200207
bootstrapSubnet := vpcOutput.privateSubnetIDs[0]
201208
if usePublicEndpoints {
202209
bootstrapSubnet = vpcOutput.publicSubnetIDs[0]
203210
}
204211
bootstrapInput := bootstrapInputOptions{
205212
instanceInputOptions: instanceInputOptions{
206-
infraID: clusterConfig.ClusterID,
207-
amiID: amiID,
208-
instanceType: clusterAWSConfig.MasterInstanceType,
209-
iamRole: clusterAWSConfig.MasterIAMRoleName,
210-
volumeType: "gp2",
211-
volumeSize: 30,
212-
volumeIOPS: 0,
213-
isEncrypted: true,
214-
metadataAuth: clusterAWSConfig.BootstrapMetadataAuthentication,
215-
kmsKeyID: clusterAWSConfig.KMSKeyID,
216-
securityGroupIds: []string{sgOutput.bootstrap, sgOutput.controlPlane},
217-
targetGroupARNs: lbOutput.targetGroupArns,
218-
subnetID: bootstrapSubnet,
219-
associatePublicIP: usePublicEndpoints,
220-
userData: clusterAWSConfig.BootstrapIgnitionStub,
221-
tags: tags,
213+
infraID: clusterConfig.ClusterID,
214+
amiID: amiID,
215+
instanceType: clusterAWSConfig.MasterInstanceType,
216+
iamRole: clusterAWSConfig.MasterIAMRoleName,
217+
volumeType: "gp2",
218+
volumeSize: 30,
219+
volumeIOPS: 0,
220+
isEncrypted: true,
221+
metadataAuth: clusterAWSConfig.BootstrapMetadataAuthentication,
222+
kmsKeyID: clusterAWSConfig.KMSKeyID,
223+
securityGroupIds: []string{sgOutput.bootstrap, sgOutput.controlPlane},
224+
targetGroupARNs: lbOutput.targetGroupArns,
225+
subnetID: bootstrapSubnet,
226+
associatePublicIP: usePublicEndpoints,
227+
userData: clusterAWSConfig.BootstrapIgnitionStub,
228+
partitionDNSSuffix: partitionDNSSuffix,
229+
tags: tags,
222230
},
223231
ignitionBucket: clusterAWSConfig.IgnitionBucket,
224232
ignitionContent: clusterConfig.IgnitionBootstrap,
@@ -233,21 +241,22 @@ func (a InfraProvider) Provision(dir string, vars []*asset.File) ([]*asset.File,
233241
logger.Infoln("Creating control plane resources")
234242
controlPlaneInput := controlPlaneInputOptions{
235243
instanceInputOptions: instanceInputOptions{
236-
infraID: clusterConfig.ClusterID,
237-
amiID: amiID,
238-
instanceType: clusterAWSConfig.MasterInstanceType,
239-
iamRole: clusterAWSConfig.MasterIAMRoleName,
240-
volumeType: clusterAWSConfig.Type,
241-
volumeSize: clusterAWSConfig.Size,
242-
volumeIOPS: clusterAWSConfig.IOPS,
243-
isEncrypted: clusterAWSConfig.Encrypted,
244-
kmsKeyID: clusterAWSConfig.KMSKeyID,
245-
metadataAuth: clusterAWSConfig.MasterMetadataAuthentication,
246-
securityGroupIds: append(clusterAWSConfig.MasterSecurityGroups, sgOutput.controlPlane),
247-
targetGroupARNs: lbOutput.targetGroupArns,
248-
associatePublicIP: len(os.Getenv("OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY")) > 0,
249-
userData: clusterConfig.IgnitionMaster,
250-
tags: tags,
244+
infraID: clusterConfig.ClusterID,
245+
amiID: amiID,
246+
instanceType: clusterAWSConfig.MasterInstanceType,
247+
iamRole: clusterAWSConfig.MasterIAMRoleName,
248+
volumeType: clusterAWSConfig.Type,
249+
volumeSize: clusterAWSConfig.Size,
250+
volumeIOPS: clusterAWSConfig.IOPS,
251+
isEncrypted: clusterAWSConfig.Encrypted,
252+
kmsKeyID: clusterAWSConfig.KMSKeyID,
253+
metadataAuth: clusterAWSConfig.MasterMetadataAuthentication,
254+
securityGroupIds: append(clusterAWSConfig.MasterSecurityGroups, sgOutput.controlPlane),
255+
targetGroupARNs: lbOutput.targetGroupArns,
256+
associatePublicIP: len(os.Getenv("OPENSHIFT_INSTALL_AWS_PUBLIC_ONLY")) > 0,
257+
userData: clusterConfig.IgnitionMaster,
258+
partitionDNSSuffix: partitionDNSSuffix,
259+
tags: tags,
251260
},
252261
nReplicas: clusterConfig.Masters,
253262
privateSubnetIDs: vpcOutput.privateSubnetIDs,
@@ -261,8 +270,9 @@ func (a InfraProvider) Provision(dir string, vars []*asset.File) ([]*asset.File,
261270

262271
logger.Infoln("Creating compute resources")
263272
computeInput := computeInputOptions{
264-
infraID: clusterConfig.ClusterID,
265-
tags: tags,
273+
infraID: clusterConfig.ClusterID,
274+
partitionDNSSuffix: partitionDNSSuffix,
275+
tags: tags,
266276
}
267277
err = createComputeResources(ctx, logger, iamClient, &computeInput)
268278
if err != nil {

‎pkg/infrastructure/aws/bootstrap.go‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func createBootstrapResources(ctx context.Context, logger logrus.FieldLogger, ec
3737
}
3838

3939
profileName := fmt.Sprintf("%s-bootstrap", input.infraID)
40-
instanceProfile, err := createBootstrapInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.tags)
40+
instanceProfile, err := createBootstrapInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.partitionDNSSuffix, input.tags)
4141
if err != nil {
4242
return nil, fmt.Errorf("failed to create bootstrap instance profile: %w", err)
4343
}
@@ -167,22 +167,8 @@ func limitTags(tags map[string]string, size int) map[string]string {
167167
return resized
168168
}
169169

170-
func createBootstrapInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, tags map[string]string) (*iam.InstanceProfile, error) {
171-
const (
172-
assumeRolePolicy = `{
173-
"Version": "2012-10-17",
174-
"Statement": [
175-
{
176-
"Action": "sts:AssumeRole",
177-
"Principal": {
178-
"Service": "ec2.amazonaws.com"
179-
},
180-
"Effect": "Allow",
181-
"Sid": ""
182-
}
183-
]
184-
}`
185-
bootstrapPolicy = `{
170+
func createBootstrapInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, partitionDNSSuffix string, tags map[string]string) (*iam.InstanceProfile, error) {
171+
const bootstrapPolicy = `{
186172
"Version": "2012-10-17",
187173
"Statement": [
188174
{
@@ -202,7 +188,20 @@ func createBootstrapInstanceProfile(ctx context.Context, logger logrus.FieldLogg
202188
}
203189
]
204190
}`
205-
)
191+
192+
assumeRolePolicy := fmt.Sprintf(`{
193+
"Version": "2012-10-17",
194+
"Statement": [
195+
{
196+
"Action": "sts:AssumeRole",
197+
"Principal": {
198+
"Service": "ec2.%s"
199+
},
200+
"Effect": "Allow",
201+
"Sid": ""
202+
}
203+
]
204+
}`, partitionDNSSuffix)
206205

207206
profileInput := &instanceProfileOptions{
208207
namePrefix: name,

‎pkg/infrastructure/aws/compute.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,36 +10,37 @@ import (
1010
)
1111

1212
type computeInputOptions struct {
13-
infraID string
14-
tags map[string]string
13+
infraID string
14+
partitionDNSSuffix string
15+
tags map[string]string
1516
}
1617

1718
func createComputeResources(ctx context.Context, logger logrus.FieldLogger, iamClient iamiface.IAMAPI, input *computeInputOptions) error {
1819
profileName := fmt.Sprintf("%s-worker", input.infraID)
19-
_, err := createComputeInstanceProfile(ctx, logger, iamClient, profileName, input.tags)
20+
_, err := createComputeInstanceProfile(ctx, logger, iamClient, profileName, input.partitionDNSSuffix, input.tags)
2021
if err != nil {
2122
return fmt.Errorf("failed to create compute instance profile: %w", err)
2223
}
2324
logger.Infoln("Created compute instance profile")
2425
return nil
2526
}
2627

27-
func createComputeInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, tags map[string]string) (*iam.InstanceProfile, error) {
28-
const (
29-
assumeRolePolicy = `{
28+
func createComputeInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, partitionDNSSuffix string, tags map[string]string) (*iam.InstanceProfile, error) {
29+
assumeRolePolicy := fmt.Sprintf(`{
3030
"Version": "2012-10-17",
3131
"Statement": [
3232
{
3333
"Action": "sts:AssumeRole",
3434
"Principal": {
35-
"Service": "ec2.amazonaws.com"
35+
"Service": "ec2.%s"
3636
},
3737
"Effect": "Allow",
3838
"Sid": ""
3939
}
4040
]
41-
}`
42-
policy = `{
41+
}`, partitionDNSSuffix)
42+
43+
const policy = `{
4344
"Version": "2012-10-17",
4445
"Statement": [
4546
{
@@ -52,7 +53,6 @@ func createComputeInstanceProfile(ctx context.Context, logger logrus.FieldLogger
5253
}
5354
]
5455
}`
55-
)
5656

5757
input := &instanceProfileOptions{
5858
namePrefix: name,

‎pkg/infrastructure/aws/controlplane.go‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ type controlPlaneOutput struct {
2626

2727
func createControlPlaneResources(ctx context.Context, logger logrus.FieldLogger, ec2Client ec2iface.EC2API, iamClient iamiface.IAMAPI, elbClient elbv2iface.ELBV2API, input *controlPlaneInputOptions) (*controlPlaneOutput, error) {
2828
profileName := fmt.Sprintf("%s-master", input.infraID)
29-
instanceProfile, err := createControlPlaneInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.tags)
29+
instanceProfile, err := createControlPlaneInstanceProfile(ctx, logger, iamClient, profileName, input.iamRole, input.partitionDNSSuffix, input.tags)
3030
if err != nil {
3131
return nil, fmt.Errorf("failed to create control plane instance profile: %w", err)
3232
}
@@ -51,22 +51,22 @@ func createControlPlaneResources(ctx context.Context, logger logrus.FieldLogger,
5151
return &controlPlaneOutput{controlPlaneIPs: instanceIPs}, nil
5252
}
5353

54-
func createControlPlaneInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, tags map[string]string) (*iam.InstanceProfile, error) {
55-
const (
56-
assumeRolePolicy = `{
54+
func createControlPlaneInstanceProfile(ctx context.Context, logger logrus.FieldLogger, client iamiface.IAMAPI, name string, roleName string, partitionDNSSuffix string, tags map[string]string) (*iam.InstanceProfile, error) {
55+
assumeRolePolicy := fmt.Sprintf(`{
5756
"Version": "2012-10-17",
5857
"Statement": [
5958
{
6059
"Action": "sts:AssumeRole",
6160
"Principal": {
62-
"Service": "ec2.amazonaws.com"
61+
"Service": "ec2.%s"
6362
},
6463
"Effect": "Allow",
6564
"Sid": ""
6665
}
6766
]
68-
}`
69-
policy = `{
67+
}`, partitionDNSSuffix)
68+
69+
const policy = `{
7070
"Version": "2012-10-17",
7171
"Statement": [
7272
{
@@ -115,7 +115,6 @@ func createControlPlaneInstanceProfile(ctx context.Context, logger logrus.FieldL
115115
}
116116
]
117117
}`
118-
)
119118

120119
profileInput := &instanceProfileOptions{
121120
namePrefix: name,

‎pkg/infrastructure/aws/instance.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ type instanceInputOptions struct {
3636
instanceProfileARN string
3737
volumeType string
3838
metadataAuth string
39+
partitionDNSSuffix string
3940
volumeSize int64
4041
volumeIOPS int64
4142
isEncrypted bool

0 commit comments

Comments
 (0)