Skip to content

Commit bb32f3e

Browse files
linkilinki
authored
Merge pull request #6950 from zalando-incubator/aws-cloud-controller-manager
Add aws-cloud-controller-manager [1/2]
2 parents dc1856f + db98e2d commit bb32f3e

File tree

5 files changed

+293
-0
lines changed

5 files changed

+293
-0
lines changed

‎cluster/cluster.yaml

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,89 @@ Resources:
14141414
Version: 2012-10-17
14151415
PolicyName: root
14161416
Type: 'AWS::IAM::Role'
1417+
CloudControllerManagerIAMRole:
1418+
Properties:
1419+
AssumeRolePolicyDocument:
1420+
Statement:
1421+
- Effect: Allow
1422+
Principal:
1423+
Federated: !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/{{.Cluster.LocalID}}.{{.Values.hosted_zone}}"
1424+
Action:
1425+
- "sts:AssumeRoleWithWebIdentity"
1426+
Condition:
1427+
StringEquals:
1428+
"{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:aud": "sts.amazonaws.com"
1429+
"{{ .Cluster.LocalID }}.{{ .Values.hosted_zone }}:sub": "system:serviceaccount:kube-system:cloud-controller-manager"
1430+
Version: 2012-10-17
1431+
Path: /
1432+
Policies:
1433+
# https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
1434+
- PolicyDocument:
1435+
Statement:
1436+
- Effect: Allow
1437+
Action:
1438+
- "autoscaling:DescribeAutoScalingGroups"
1439+
- "autoscaling:DescribeLaunchConfigurations"
1440+
- "autoscaling:DescribeTags"
1441+
- "ec2:DescribeInstances"
1442+
- "ec2:DescribeRegions"
1443+
- "ec2:DescribeRouteTables"
1444+
- "ec2:DescribeSecurityGroups"
1445+
- "ec2:DescribeSubnets"
1446+
- "ec2:DescribeVolumes"
1447+
- "ec2:DescribeAvailabilityZones"
1448+
- "ec2:CreateSecurityGroup"
1449+
- "ec2:CreateTags"
1450+
- "ec2:CreateVolume"
1451+
- "ec2:ModifyInstanceAttribute"
1452+
- "ec2:ModifyVolume"
1453+
- "ec2:AttachVolume"
1454+
- "ec2:AuthorizeSecurityGroupIngress"
1455+
- "ec2:CreateRoute"
1456+
- "ec2:DeleteRoute"
1457+
- "ec2:DeleteSecurityGroup"
1458+
- "ec2:DeleteVolume"
1459+
- "ec2:DetachVolume"
1460+
- "ec2:RevokeSecurityGroupIngress"
1461+
- "ec2:DescribeVpcs"
1462+
- "elasticloadbalancing:AddTags"
1463+
- "elasticloadbalancing:AttachLoadBalancerToSubnets"
1464+
- "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer"
1465+
- "elasticloadbalancing:CreateLoadBalancer"
1466+
- "elasticloadbalancing:CreateLoadBalancerPolicy"
1467+
- "elasticloadbalancing:CreateLoadBalancerListeners"
1468+
- "elasticloadbalancing:ConfigureHealthCheck"
1469+
- "elasticloadbalancing:DeleteLoadBalancer"
1470+
- "elasticloadbalancing:DeleteLoadBalancerListeners"
1471+
- "elasticloadbalancing:DescribeLoadBalancers"
1472+
- "elasticloadbalancing:DescribeLoadBalancerAttributes"
1473+
- "elasticloadbalancing:DetachLoadBalancerFromSubnets"
1474+
- "elasticloadbalancing:DeregisterInstancesFromLoadBalancer"
1475+
- "elasticloadbalancing:ModifyLoadBalancerAttributes"
1476+
- "elasticloadbalancing:RegisterInstancesWithLoadBalancer"
1477+
- "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer"
1478+
- "elasticloadbalancing:AddTags"
1479+
- "elasticloadbalancing:CreateListener"
1480+
- "elasticloadbalancing:CreateTargetGroup"
1481+
- "elasticloadbalancing:DeleteListener"
1482+
- "elasticloadbalancing:DeleteTargetGroup"
1483+
- "elasticloadbalancing:DescribeListeners"
1484+
- "elasticloadbalancing:DescribeLoadBalancerPolicies"
1485+
- "elasticloadbalancing:DescribeTargetGroups"
1486+
- "elasticloadbalancing:DescribeTargetHealth"
1487+
- "elasticloadbalancing:ModifyListener"
1488+
- "elasticloadbalancing:ModifyTargetGroup"
1489+
- "elasticloadbalancing:RegisterTargets"
1490+
- "elasticloadbalancing:DeregisterTargets"
1491+
- "elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
1492+
- "iam:CreateServiceLinkedRole"
1493+
- "kms:DescribeKey"
1494+
Resource:
1495+
- "*"
1496+
Version: 2012-10-17
1497+
PolicyName: root
1498+
RoleName: "{{.Cluster.LocalID}}-cloud-controller-manager"
1499+
Type: "AWS::IAM::Role"
14171500
ETCDS3BackupIAMRole:
14181501
Properties:
14191502
AssumeRolePolicyDocument:

‎cluster/config-defaults.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -429,6 +429,12 @@ kubernetes_lifecycle_metrics_mem_min: "120Mi"
429429
kube_node_ready_controller_cpu: "50m"
430430
kube_node_ready_controller_memory: "200Mi"
431431

432+
# Enable deployment of aws-cloud-controller-manager
433+
aws_cloud_controller_manager_enabled: "true"
434+
aws_cloud_controller_manager_cpu: "125m"
435+
aws_cloud_controller_manager_memory: "512Mi"
436+
437+
432438
# Kubernetes Downscaler (for non-production clusters)
433439
{{if eq .Cluster.Environment "test"}}
434440
downscaler_default_uptime: "Mon-Fri 07:30-20:30 Europe/Berlin"

‎cluster/manifests/aws-cloud-controller-manager/daemonset.yaml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{{- if eq .Cluster.ConfigItems.aws_cloud_controller_manager_enabled "true" }}
2+
apiVersion: apps/v1
3+
kind: DaemonSet
4+
metadata:
5+
name: aws-cloud-controller-manager
6+
namespace: kube-system
7+
labels:
8+
application: kubernetes
9+
component: aws-cloud-controller-manager
10+
spec:
11+
selector:
12+
matchLabels:
13+
daemonset: aws-cloud-controller-manager
14+
template:
15+
metadata:
16+
labels:
17+
daemonset: aws-cloud-controller-manager
18+
application: kubernetes
19+
component: aws-cloud-controller-manager
20+
spec:
21+
containers:
22+
- args:
23+
- --v=2
24+
- --cloud-provider=aws
25+
- --use-service-account-credentials=true
26+
- --configure-cloud-routes=false
27+
image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.26.1-master-108
28+
name: aws-cloud-controller-manager
29+
resources:
30+
requests:
31+
cpu: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_cpu }}"
32+
memory: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_memory }}"
33+
limits:
34+
cpu: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_cpu }}"
35+
memory: "{{ .Cluster.ConfigItems.aws_cloud_controller_manager_memory }}"
36+
nodeSelector:
37+
# node-role.kubernetes.io/control-plane: ""
38+
node.kubernetes.io/role: master
39+
serviceAccountName: cloud-controller-manager
40+
tolerations:
41+
- effect: NoSchedule
42+
key: node.cloudprovider.kubernetes.io/uninitialized
43+
value: "true"
44+
# - effect: NoSchedule
45+
# key: node-role.kubernetes.io/control-plane
46+
- key: node.kubernetes.io/role
47+
value: master
48+
effect: NoSchedule
49+
updateStrategy:
50+
type: RollingUpdate
51+
{{- end }}

‎cluster/manifests/aws-cloud-controller-manager/rbac.yaml

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
{{- if eq .Cluster.ConfigItems.aws_cloud_controller_manager_enabled "true" }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: cloud-controller-manager
6+
namespace: kube-system
7+
labels:
8+
application: kubernetes
9+
component: aws-cloud-controller-manager
10+
annotations:
11+
iam.amazonaws.com/role: "{{ .Cluster.LocalID }}-cloud-controller-manager"
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
name: system:cloud-controller-manager
17+
labels:
18+
application: kubernetes
19+
component: aws-cloud-controller-manager
20+
rules:
21+
- apiGroups:
22+
- ""
23+
resources:
24+
- events
25+
verbs:
26+
- create
27+
- patch
28+
- update
29+
- apiGroups:
30+
- ""
31+
resources:
32+
- nodes
33+
verbs:
34+
- '*'
35+
- apiGroups:
36+
- ""
37+
resources:
38+
- nodes/status
39+
verbs:
40+
- patch
41+
- apiGroups:
42+
- ""
43+
resources:
44+
- services
45+
verbs:
46+
- list
47+
- patch
48+
- update
49+
- watch
50+
- apiGroups:
51+
- ""
52+
resources:
53+
- services/status
54+
verbs:
55+
- list
56+
- patch
57+
- update
58+
- watch
59+
- apiGroups:
60+
- ""
61+
resources:
62+
- serviceaccounts
63+
verbs:
64+
- create
65+
- get
66+
- list
67+
- watch
68+
- apiGroups:
69+
- ""
70+
resources:
71+
- persistentvolumes
72+
verbs:
73+
- get
74+
- list
75+
- update
76+
- watch
77+
- apiGroups:
78+
- ""
79+
resources:
80+
- endpoints
81+
verbs:
82+
- create
83+
- get
84+
- list
85+
- watch
86+
- update
87+
- apiGroups:
88+
- coordination.k8s.io
89+
resources:
90+
- leases
91+
verbs:
92+
- create
93+
- get
94+
- list
95+
- watch
96+
- update
97+
- apiGroups:
98+
- ""
99+
resources:
100+
- serviceaccounts/token
101+
verbs:
102+
- create
103+
---
104+
apiVersion: rbac.authorization.k8s.io/v1
105+
kind: RoleBinding
106+
metadata:
107+
name: cloud-controller-manager:apiserver-authentication-reader
108+
namespace: kube-system
109+
labels:
110+
application: kubernetes
111+
component: aws-cloud-controller-manager
112+
roleRef:
113+
apiGroup: rbac.authorization.k8s.io
114+
kind: Role
115+
name: extension-apiserver-authentication-reader
116+
subjects:
117+
- apiGroup: ""
118+
kind: ServiceAccount
119+
name: cloud-controller-manager
120+
namespace: kube-system
121+
---
122+
apiVersion: rbac.authorization.k8s.io/v1
123+
kind: ClusterRoleBinding
124+
metadata:
125+
name: system:cloud-controller-manager
126+
labels:
127+
application: kubernetes
128+
component: aws-cloud-controller-manager
129+
roleRef:
130+
apiGroup: rbac.authorization.k8s.io
131+
kind: ClusterRole
132+
name: system:cloud-controller-manager
133+
subjects:
134+
- apiGroup: ""
135+
kind: ServiceAccount
136+
name: cloud-controller-manager
137+
namespace: kube-system
138+
{{- end }}

‎cluster/manifests/deletions.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,3 +298,18 @@ post_apply:
298298
kind: PlatformCredentialsSet
299299
namespace: kube-system
300300
{{- end }}
301+
{{- if ne .Cluster.ConfigItems.aws_cloud_controller_manager_enabled "true" }}
302+
- name: aws-cloud-controller-manager
303+
kind: DaemonSet
304+
namespace: kube-system
305+
- name: cloud-controller-manager
306+
kind: ServiceAccount
307+
namespace: kube-system
308+
- name: system:cloud-controller-manager
309+
kind: ClusterRole
310+
- name: cloud-controller-manager:apiserver-authentication-reader
311+
namespace: kube-system
312+
kind: RoleBinding
313+
- name: system:cloud-controller-manager
314+
kind: ClusterRoleBinding
315+
{{- end }}

0 commit comments

Comments
 (0)