Skip to content

Commit b49e353

Browse files
authored
feat(iam): add iam:ListInstanceProfiles permission for karpenter 1.7.0+ (#171)
<!-- ~ Copyright 2023 StreamNative, Inc. ~ ~ Licensed under the Apache License, Version 2.0 (the "License"); ~ you may not use this file except in compliance with the License. ~ You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, software ~ distributed under the License is distributed on an "AS IS" BASIS, ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ~ See the License for the specific language governing permissions and ~ limitations under the License. --> <!-- ### Contribution Checklist - Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review. - Each pull request should address only one issue, not mix up code from multiple issues. - Each commit in the pull request has a meaningful commit message - Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below. **(The sections below can be removed for hotfixes of typos)** --> ### Motivation Per the [upgrade guide](https://github.com/aws/karpenter-provider-aws/blob/main/website/content/en/v1.7/upgrading/upgrade-guide.md#upgrading-to-170), this new version of karpenter require following new permissions: - `iam:ListInstanceProfiles` ### Modifications - Add `iam:ListInstanceProfiles` permission for karpenter controller iam role ### Verifying this change - [x] Make sure that the change passes the CI checks. ### Documentation - [x] `no-need-doc` Signed-off-by: Max Xu <[email protected]>
1 parent 2d4e13d commit b49e353

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

modules/iam/karpenter.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ data "aws_iam_policy_document" "karpenter" {
380380
statement {
381381
sid = "AllowInstanceProfileReadActions"
382382
resources = ["arn:${local.aws_partition}:iam::${local.account_id}:instance-profile/*"]
383-
actions = ["iam:GetInstanceProfile"]
383+
actions = ["iam:GetInstanceProfile", "iam:ListInstanceProfiles"]
384384
}
385385

386386
statement {

0 commit comments

Comments
 (0)