Merge branch 'main' into fix/addpoliciesoncreate

rushmash91 · michaelhtm · commit 589da29e8d54 · 2025-05-14T14:06:33.000-07:00
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
@@ -5,10 +5,10 @@ aliases:
     - a-hilaly
     - jlbutler
     - michaelhtm
-    - TiberiuGC
     - rushmash91
     - knottnt
   # emeritus-core-ack-team:
+  #   - TiberiuGC
   #   - jaypipes
   #   - jljaco
   #   - mhausenblas
diff --git a/apis/v1alpha1/ack-generate-metadata.yaml b/apis/v1alpha1/ack-generate-metadata.yaml
@@ -1,8 +1,8 @@
 ack_generate_info:
-  build_date: "2025-05-08T19:50:19Z"
-  build_hash: a82538df1333319f8ec1d603f6cf293aefc46e1b
-  go_version: go1.24.1
-  version: v0.45.0-3-ga82538d
+  build_date: "2025-05-14T20:54:45Z"
+  build_hash: 016d4c53082b4b78942ec154e4bf4bf36c4db11d
+  go_version: go1.24.3
+  version: v0.46.2-2-g016d4c5
 api_directory_checksum: 7e1c19231d3275a1147157f6943a7391953f7001
 api_version: v1alpha1
 aws_sdk_go_version: v1.32.6
diff --git a/config/controller/kustomization.yaml b/config/controller/kustomization.yaml
@@ -6,4 +6,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: public.ecr.aws/aws-controllers-k8s/iam-controller
-  newTag: 1.3.20
+  newTag: 1.3.21
diff --git a/go.mod b/go.mod
@@ -5,7 +5,7 @@ go 1.24.0
 toolchain go1.24.1
 
 require (
-	github.com/aws-controllers-k8s/runtime v0.45.0
+	github.com/aws-controllers-k8s/runtime v0.46.1
 	github.com/aws/aws-sdk-go v1.49.0
 	github.com/aws/aws-sdk-go-v2 v1.34.0
 	github.com/aws/aws-sdk-go-v2/service/iam v1.38.8
diff --git a/go.sum b/go.sum
@@ -1,7 +1,7 @@
 github.com/a-hilaly/aws-iam-policy v0.0.0-20231121054900-2c56e839ca53 h1:2uNM0nR2WUDN88EYFxjEaroH+PZJ6k/h9kl+KO0dWVc=
 github.com/a-hilaly/aws-iam-policy v0.0.0-20231121054900-2c56e839ca53/go.mod h1:Ojgst9ZFn+VEEJpqtuw/LxVGqEf2+hwWBlkYWvF/XWM=
-github.com/aws-controllers-k8s/runtime v0.45.0 h1:b0xCqIE1SNve/jcJPW/QkCGkDmjxWtWTDFHKZpHJcFQ=
-github.com/aws-controllers-k8s/runtime v0.45.0/go.mod h1:G2UMBKA7qgXG4JV16NTIUp715uqvUEvWaa7TG1I527U=
+github.com/aws-controllers-k8s/runtime v0.46.1 h1:61RU6uYiFSp0cDhv52vAmaPzrebzoudtsp1fGkk6iLk=
+github.com/aws-controllers-k8s/runtime v0.46.1/go.mod h1:G2UMBKA7qgXG4JV16NTIUp715uqvUEvWaa7TG1I527U=
 github.com/aws/aws-sdk-go v1.49.0 h1:g9BkW1fo9GqKfwg2+zCD+TW/D36Ux+vtfJ8guF4AYmY=
 github.com/aws/aws-sdk-go v1.49.0/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
 github.com/aws/aws-sdk-go-v2 v1.34.0 h1:9iyL+cjifckRGEVpRKZP3eIxVlL06Qk1Tk13vreaVQU=
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v1
 name: iam-chart
 description: A Helm chart for the ACK service controller for AWS Identity & Access Management (IAM)
-version: 1.3.20
-appVersion: 1.3.20
+version: 1.3.21
+appVersion: 1.3.21
 home: https://github.com/aws-controllers-k8s/iam-controller
 icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png
 sources:
diff --git a/helm/templates/NOTES.txt b/helm/templates/NOTES.txt
@@ -1,5 +1,5 @@
 {{ .Chart.Name }} has been installed.
-This chart deploys "public.ecr.aws/aws-controllers-k8s/iam-controller:1.3.20".
+This chart deploys "public.ecr.aws/aws-controllers-k8s/iam-controller:1.3.21".
 
 Check its status by running:
   kubectl --namespace {{ .Release.Namespace }} get pods -l "app.kubernetes.io/instance={{ .Release.Name }}"
diff --git a/helm/values.yaml b/helm/values.yaml
@@ -4,7 +4,7 @@
 
 image:
   repository: public.ecr.aws/aws-controllers-k8s/iam-controller
-  tag: 1.3.20
+  tag: 1.3.21
   pullPolicy: IfNotPresent
   pullSecrets: []
 
@@ -142,12 +142,12 @@ reconcile:
   # If empty, all resources will be reconciled.
   # If specified, only the listed resource kinds will be reconciled.
   resources:
-    - Groups
-    - Instanceprofiles
-    - Openidconnectproviders
-    - Policies
-    - Roles
-    - Users
+    - Group
+    - InstanceProfile
+    - OpenIDConnectProvider
+    - Policy
+    - Role
+    - User
 
 serviceAccount:
   # Specifies whether a service account should be created
diff --git a/pkg/resource/role/hooks.go b/pkg/resource/role/hooks.go
@@ -31,6 +31,25 @@ import (
 	commonutil "github.com/aws-controllers-k8s/iam-controller/pkg/util"
 )
 
+func (rm *resourceManager) attachPolicies(ctx context.Context, r *resource) (err error) {
+	rlog := ackrtlog.FromContext(ctx)
+	exit := rlog.Trace("rm.attachPolicies")
+	defer func() { exit(err) }()
+	for _, p := range r.ko.Spec.Policies {
+		err := rm.addManagedPolicy(ctx, r, p)
+		if err != nil {
+			return err
+		}
+	}
+	for n, p := range r.ko.Spec.InlinePolicies {
+		err := rm.addInlinePolicy(ctx, r, n, p)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // putRolePermissionsBoundary calls the IAM API to set a given role
 // permission boundary.
 func (rm *resourceManager) putRolePermissionsBoundary(
diff --git a/pkg/resource/role/sdk.go b/pkg/resource/role/sdk.go
diff --git a/templates/hooks/role/sdk_create_post_set_output.go.tpl b/templates/hooks/role/sdk_create_post_set_output.go.tpl
@@ -5,16 +5,8 @@
             ko.Spec.AssumeRolePolicyDocument = &doc
         }
     }
-	for _, p := range desired.ko.Spec.Policies {
-		err := rm.addManagedPolicy(ctx, &resource{ko}, p)
-		if err != nil {
-			return &resource{ko}, err
-		}
-	}
-	for n, p := range desired.ko.Spec.InlinePolicies {
-		err := rm.addInlinePolicy(ctx, &resource{ko}, n, p)
-		if err != nil {
-			return &resource{ko}, err
-		}
+	err = rm.attachPolicies(ctx, &resource{ko})
+	if err != nil {
+		return &resource{ko}, err
 	}
     ackcondition.SetSynced(&resource{ko}, corev1.ConditionFalse, nil, nil)
