Merge pull request #9633 from zalando-incubator/deployment-service-role-names

Make deployment-service roles configurable

Author: mikkeloscar

cluster/cluster.yaml

@@ -1589,7 +1589,7 @@ Resources:
   DeploymentControllerRole:
     Type: AWS::IAM::Role
     Properties:
-      RoleName: "{{.Cluster.LocalID}}-deployment-service-controller"
+      RoleName: "{{.Cluster.ConfigItems.deployment_service_controller_role_name}}"
       AssumeRolePolicyDocument: !Sub
         - |
           {
@@ -1654,11 +1654,11 @@ Resources:
                   - 'sts:AssumeRole'
                 Effect: Allow
                 Resource:
-                  - !Sub "arn:aws:iam::${AWS::AccountId}:role/{{.Cluster.LocalID}}-deployment-service-deployment"
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:role/{{.Cluster.ConfigItems.deployment_service_deployment_role_name}}"
   DeploymentControllerDeploymentRole:
     Type: AWS::IAM::Role
     Properties:
-      RoleName: "{{.Cluster.LocalID}}-deployment-service-deployment"
+      RoleName: "{{.Cluster.ConfigItems.deployment_service_deployment_role_name}}"
       AssumeRolePolicyDocument:
         Version: "2012-10-17"
         Statement:
@@ -1692,7 +1692,7 @@ Resources:
   DeploymentStatusServiceRole:
     Type: AWS::IAM::Role
     Properties:
-      RoleName: "{{.Cluster.LocalID}}-deployment-service-status-service"
+      RoleName: "{{.Cluster.ConfigItems.deployment_service_status_service_role_name}}"
       AssumeRolePolicyDocument: !Sub
         - |
           {

cluster/config-defaults.yaml

@@ -1040,6 +1040,9 @@ deployment_service_tokeninfo_url: ""
 deployment_service_lightstep_token: ""
 deployment_service_ml_experiments_enabled: "true"
 deployment_service_ml_experiments_role_name: "{{ .Cluster.LocalID }}-deployment-service-ml-experiment-deployment"
+deployment_service_controller_role_name: "{{ .Cluster.LocalID }}-deployment-service-controller"
+deployment_service_deployment_role_name: "{{ .Cluster.LocalID }}-deployment-service-deployment"
+deployment_service_status_service_role_name: "{{ .Cluster.LocalID }}-deployment-service-status-service"
 deployment_service_cf_auto_expand_enabled: "false"
 deployment_service_cf_update_source_branch_changes: "true"
 deployment_service_executor_cdp_permissions: "false"

cluster/manifests/deployment-service/01-config.yaml

@@ -19,7 +19,7 @@ data:
   s3-bucket-name: "{{ .Cluster.ConfigItems.deployment_service_bucket_name }}"
   status-service-url: "https://depl-status-{{.Cluster.Alias}}.{{.Values.hosted_zone}}"
   status-service-url-local: "http://deployment-status-service.ingress.cluster.local."
-  deployment-role-arn: "arn:aws:iam::{{accountID .Cluster.InfrastructureAccount}}:role/{{.Cluster.LocalID}}-deployment-service-deployment"
+  deployment-role-arn: "arn:aws:iam::{{accountID .Cluster.InfrastructureAccount}}:role/{{.Cluster.ConfigItems.deployment_service_deployment_role_name}}"
 {{- if eq .Cluster.ConfigItems.deployment_service_ml_experiments_enabled "true"}}
   ml-experiment-deployment-role-arn: "arn:aws:iam::{{accountID .Cluster.InfrastructureAccount}}:role/{{ .Cluster.ConfigItems.deployment_service_ml_experiments_role_name }}"
 {{- end }}

cluster/manifests/deployment-service/controller-rbac.yaml

@@ -8,9 +8,9 @@ metadata:
     component: "controller"
   annotations:
     {{- if eq .Cluster.Provider "zalando-eks" }}
-    eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccount | getAWSAccountID}}:role/{{.Cluster.LocalID}}-deployment-service-controller"
+    eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccount | getAWSAccountID}}:role/{{.Cluster.ConfigItems.deployment_service_controller_role_name}}"
     {{- else }}
-    iam.amazonaws.com/role: "{{.Cluster.LocalID}}-deployment-service-controller"
+    iam.amazonaws.com/role: "{{.Cluster.ConfigItems.deployment_service_controller_role_name}}"
     {{- end }}
 ---
 kind: ClusterRole

cluster/manifests/deployment-service/status-service-rbac.yaml

@@ -8,9 +8,9 @@ metadata:
     component: "status-service"
   annotations:
     {{- if eq .Cluster.Provider "zalando-eks" }}
-    eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccount | getAWSAccountID}}:role/{{.Cluster.LocalID}}-deployment-service-status-service"
+    eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccount | getAWSAccountID}}:role/{{.Cluster.ConfigItems.deployment_service_status_service_role_name}}"
     {{- else }}
-    iam.amazonaws.com/role: "{{.Cluster.LocalID}}-deployment-service-status-service"
+    iam.amazonaws.com/role: "{{.Cluster.ConfigItems.deployment_service_status_service_role_name}}"
     {{- end }}
 ---
 kind: ClusterRole