Skip to content

Commit 017e380

Browse files
mikkeloscarMustafaSaber
mikkeloscar
authored and
MustafaSaber
committed
Add aws-cloud-controller-manager
Signed-off-by: Mikkel Oscar Lyderik Larsen <[email protected]>
1 parent 28a8ebb commit 017e380

File tree

5 files changed

+293
-0
lines changed

5 files changed

+293
-0
lines changed

‎cluster/cluster.yaml

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1420,6 +1420,89 @@ Resources:
14201420
Version: 2012-10-17
14211421
PolicyName: root
14221422
Type: 'AWS::IAM::Role'
1423+
CloudControllerManagerIAMRole:
1424+
Properties:
1425+
AssumeRolePolicyDocument:
1426+
Statement:
1427+
- Effect: Allow
1428+
Principal:
1429+
Federated: !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/{{.Cluster.LocalID}}.{{.Values.hosted_zone}}"
1430+
Action:
1431+
- "sts:AssumeRoleWithWebIdentity"
1432+
Condition:
1433+
StringEquals:
1434+
"{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:aud": "sts.amazonaws.com"
1435+
"{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:sub": "system:serviceaccount:kube-system:cloud-controller-manager"
1436+
Version: 2012-10-17
1437+
Path: /
1438+
Policies:
1439+
# https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
1440+
- PolicyDocument:
1441+
Statement:
1442+
- Effect: Allow
1443+
Action:
1444+
- "autoscaling:DescribeAutoScalingGroups"
1445+
- "autoscaling:DescribeLaunchConfigurations"
1446+
- "autoscaling:DescribeTags"
1447+
- "ec2:DescribeInstances"
1448+
- "ec2:DescribeRegions"
1449+
- "ec2:DescribeRouteTables"
1450+
- "ec2:DescribeSecurityGroups"
1451+
- "ec2:DescribeSubnets"
1452+
- "ec2:DescribeVolumes"
1453+
- "ec2:DescribeAvailabilityZones"
1454+
- "ec2:CreateSecurityGroup"
1455+
- "ec2:CreateTags"
1456+
- "ec2:CreateVolume"
1457+
- "ec2:ModifyInstanceAttribute"
1458+
- "ec2:ModifyVolume"
1459+
- "ec2:AttachVolume"
1460+
- "ec2:AuthorizeSecurityGroupIngress"
1461+
- "ec2:CreateRoute"
1462+
- "ec2:DeleteRoute"
1463+
- "ec2:DeleteSecurityGroup"
1464+
- "ec2:DeleteVolume"
1465+
- "ec2:DetachVolume"
1466+
- "ec2:RevokeSecurityGroupIngress"
1467+
- "ec2:DescribeVpcs"
1468+
- "elasticloadbalancing:AddTags"
1469+
- "elasticloadbalancing:AttachLoadBalancerToSubnets"
1470+
- "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer"
1471+
- "elasticloadbalancing:CreateLoadBalancer"
1472+
- "elasticloadbalancing:CreateLoadBalancerPolicy"
1473+
- "elasticloadbalancing:CreateLoadBalancerListeners"
1474+
- "elasticloadbalancing:ConfigureHealthCheck"
1475+
- "elasticloadbalancing:DeleteLoadBalancer"
1476+
- "elasticloadbalancing:DeleteLoadBalancerListeners"
1477+
- "elasticloadbalancing:DescribeLoadBalancers"
1478+
- "elasticloadbalancing:DescribeLoadBalancerAttributes"
1479+
- "elasticloadbalancing:DetachLoadBalancerFromSubnets"
1480+
- "elasticloadbalancing:DeregisterInstancesFromLoadBalancer"
1481+
- "elasticloadbalancing:ModifyLoadBalancerAttributes"
1482+
- "elasticloadbalancing:RegisterInstancesWithLoadBalancer"
1483+
- "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer"
1484+
- "elasticloadbalancing:AddTags"
1485+
- "elasticloadbalancing:CreateListener"
1486+
- "elasticloadbalancing:CreateTargetGroup"
1487+
- "elasticloadbalancing:DeleteListener"
1488+
- "elasticloadbalancing:DeleteTargetGroup"
1489+
- "elasticloadbalancing:DescribeListeners"
1490+
- "elasticloadbalancing:DescribeLoadBalancerPolicies"
1491+
- "elasticloadbalancing:DescribeTargetGroups"
1492+
- "elasticloadbalancing:DescribeTargetHealth"
1493+
- "elasticloadbalancing:ModifyListener"
1494+
- "elasticloadbalancing:ModifyTargetGroup"
1495+
- "elasticloadbalancing:RegisterTargets"
1496+
- "elasticloadbalancing:DeregisterTargets"
1497+
- "elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
1498+
- "iam:CreateServiceLinkedRole"
1499+
- "kms:DescribeKey"
1500+
Resource:
1501+
- "*"
1502+
Version: 2012-10-17
1503+
PolicyName: root
1504+
RoleName: "{{.Cluster.LocalID}}-cloud-controller-manager"
1505+
Type: "AWS::IAM::Role"
14231506
ETCDS3BackupIAMRole:
14241507
Properties:
14251508
AssumeRolePolicyDocument:

‎cluster/config-defaults.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -444,6 +444,12 @@ kubernetes_lifecycle_metrics_mem_min: "120Mi"
444444
kube_node_ready_controller_cpu: "50m"
445445
kube_node_ready_controller_memory: "200Mi"
446446

447+
# Enable deployment of aws-cloud-controller-manager
448+
aws_cloud_controller_manager_enabled: "true"
449+
aws_cloud_controller_manager_cpu: "125m"
450+
aws_cloud_controller_manager_memory: "512Mi"
451+
452+
447453
# Kubernetes Downscaler (for non-production clusters)
448454
{{if eq .Cluster.Environment "test"}}
449455
downscaler_default_uptime: "Mon-Fri 07:30-20:30 Europe/Berlin"

‎cluster/manifests/aws-cloud-controller-manager/daemonset.yaml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{{- if eq .Cluster.ConfigItems.aws_cloud_controller_manager_enabled "true" }}
2+
apiVersion: apps/v1
3+
kind: DaemonSet
4+
metadata:
5+
name: aws-cloud-controller-manager
6+
namespace: kube-system
7+
labels:
8+
application: kubernetes
9+
component: aws-cloud-controller-manager
10+
spec:
11+
selector:
12+
matchLabels:
13+
daemonset: aws-cloud-controller-manager
14+
template:
15+
metadata:
16+
labels:
17+
daemonset: aws-cloud-controller-manager
18+
application: kubernetes
19+
component: aws-cloud-controller-manager
20+
spec:
21+
containers:
22+
- args:
23+
- --v=2
24+
- --cloud-provider=aws
25+
- --use-service-account-credentials=true
26+
- --configure-cloud-routes=false
27+
image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.26.1-master-108
28+
name: aws-cloud-controller-manager
29+
resources:
30+
requests:
31+
cpu: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_cpu }}"
32+
memory: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_memory }}"
33+
limits:
34+
cpu: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_cpu }}"
35+
memory: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_memory }}"
36+
nodeSelector:
37+
# node-role.kubernetes.io/control-plane: ""
38+
node.kubernetes.io/role: master
39+
serviceAccountName: cloud-controller-manager
40+
tolerations:
41+
- effect: NoSchedule
42+
key: node.cloudprovider.kubernetes.io/uninitialized
43+
value: "true"
44+
# - effect: NoSchedule
45+
# key: node-role.kubernetes.io/control-plane
46+
- key: node.kubernetes.io/role
47+
value: master
48+
effect: NoSchedule
49+
updateStrategy:
50+
type: RollingUpdate
51+
{{- end }}

‎cluster/manifests/aws-cloud-controller-manager/rbac.yaml

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
{{- if eq .Cluster.ConfigItems.aws_cloud_controller_manager_enabled "true" }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: cloud-controller-manager
6+
namespace: kube-system
7+
labels:
8+
application: kubernetes
9+
component: aws-cloud-controller-manager
10+
annotations:
11+
iam.amazonaws.com/role: "{{ .Cluster.LocalID }}-cloud-controller-manager"
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
name: system:cloud-controller-manager
17+
labels:
18+
application: kubernetes
19+
component: aws-cloud-controller-manager
20+
rules:
21+
- apiGroups:
22+
- ""
23+
resources:
24+
- events
25+
verbs:
26+
- create
27+
- patch
28+
- update
29+
- apiGroups:
30+
- ""
31+
resources:
32+
- nodes
33+
verbs:
34+
- '*'
35+
- apiGroups:
36+
- ""
37+
resources:
38+
- nodes/status
39+
verbs:
40+
- patch
41+
- apiGroups:
42+
- ""
43+
resources:
44+
- services
45+
verbs:
46+
- list
47+
- patch
48+
- update
49+
- watch
50+
- apiGroups:
51+
- ""
52+
resources:
53+
- services/status
54+
verbs:
55+
- list
56+
- patch
57+
- update
58+
- watch
59+
- apiGroups:
60+
- ""
61+
resources:
62+
- serviceaccounts
63+
verbs:
64+
- create
65+
- get
66+
- list
67+
- watch
68+
- apiGroups:
69+
- ""
70+
resources:
71+
- persistentvolumes
72+
verbs:
73+
- get
74+
- list
75+
- update
76+
- watch
77+
- apiGroups:
78+
- ""
79+
resources:
80+
- endpoints
81+
verbs:
82+
- create
83+
- get
84+
- list
85+
- watch
86+
- update
87+
- apiGroups:
88+
- coordination.k8s.io
89+
resources:
90+
- leases
91+
verbs:
92+
- create
93+
- get
94+
- list
95+
- watch
96+
- update
97+
- apiGroups:
98+
- ""
99+
resources:
100+
- serviceaccounts/token
101+
verbs:
102+
- create
103+
---
104+
apiVersion: rbac.authorization.k8s.io/v1
105+
kind: RoleBinding
106+
metadata:
107+
name: cloud-controller-manager:apiserver-authentication-reader
108+
namespace: kube-system
109+
labels:
110+
application: kubernetes
111+
component: aws-cloud-controller-manager
112+
roleRef:
113+
apiGroup: rbac.authorization.k8s.io
114+
kind: Role
115+
name: extension-apiserver-authentication-reader
116+
subjects:
117+
- apiGroup: ""
118+
kind: ServiceAccount
119+
name: cloud-controller-manager
120+
namespace: kube-system
121+
---
122+
apiVersion: rbac.authorization.k8s.io/v1
123+
kind: ClusterRoleBinding
124+
metadata:
125+
name: system:cloud-controller-manager
126+
labels:
127+
application: kubernetes
128+
component: aws-cloud-controller-manager
129+
roleRef:
130+
apiGroup: rbac.authorization.k8s.io
131+
kind: ClusterRole
132+
name: system:cloud-controller-manager
133+
subjects:
134+
- apiGroup: ""
135+
kind: ServiceAccount
136+
name: cloud-controller-manager
137+
namespace: kube-system
138+
{{- end }}

‎cluster/manifests/deletions.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,3 +297,18 @@ post_apply:
297297
kind: PlatformCredentialsSet
298298
namespace: kube-system
299299
{{- end }}
300+
{{- if ne .Cluster.ConfigItems.aws_cloud_controller_manager_enabled "true" }}
301+
- name: aws-cloud-controller-manager
302+
kind: DaemonSet
303+
namespace: kube-system
304+
- name: cloud-controller-manager
305+
kind: ServiceAccount
306+
namespace: kube-system
307+
- name: system:cloud-controller-manager
308+
kind: ClusterRole
309+
- name: cloud-controller-manager:apiserver-authentication-reader
310+
namespace: kube-system
311+
kind: RoleBinding
312+
- name: system:cloud-controller-manager
313+
kind: ClusterRoleBinding
314+
{{- end }}

0 commit comments

Comments
 (0)