Skip to content

Commit 833bfd3

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5286 from robinkb/main
✨ Support setting role path and permissions boundary on managed IAM roles
2 parents 87020b2 + 9c4d4d0 commit 833bfd3

File tree

16 files changed

+297
-33
lines changed

16 files changed

+297
-33
lines changed

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/conversion.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,7 @@ import (
2525
func Convert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in *v1beta1.AWSIAMConfigurationSpec, out *AWSIAMConfigurationSpec, s conversion.Scope) error {
2626
return autoConvert_v1beta1_AWSIAMConfigurationSpec_To_v1alpha1_AWSIAMConfigurationSpec(in, out, s)
2727
}
28+
29+
func Convert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in *v1beta1.AWSIAMRoleSpec, out *AWSIAMRoleSpec, s conversion.Scope) error {
30+
return autoConvert_v1beta1_AWSIAMRoleSpec_To_v1alpha1_AWSIAMRoleSpec(in, out, s)
31+
}

‎cmd/clusterawsadm/api/bootstrap/v1alpha1/zz_generated.conversion.go‎

Lines changed: 61 additions & 16 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/clusterawsadm/api/bootstrap/v1beta1/types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,14 @@ type AWSIAMRoleSpec struct {
8383
// ExtraStatements are additional IAM statements to be included inline for the role.
8484
ExtraStatements []iamv1.StatementEntry `json:"extraStatements,omitempty"`
8585

86+
// Path sets the path to the role.
87+
// +optional
88+
Path string `json:"path,omitempty"`
89+
90+
// PermissionsBoundary sets the ARN of the managed policy that is used to set the permissions boundary for the role.
91+
// +optional
92+
PermissionsBoundary string `json:"permissionsBoundary,omitempty"`
93+
8694
// TrustStatements is an IAM PolicyDocument defining what identities are allowed to assume this role.
8795
// See "sigs.k8s.io/cluster-api-provider-aws/v2/cmd/clusterawsadm/api/iam/v1beta1" for more documentation.
8896
TrustStatements []iamv1.StatementEntry `json:"trustStatements,omitempty"`

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,24 +138,30 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
138138

139139
template.Resources[AWSIAMRoleControlPlane] = &cfn_iam.Role{
140140
RoleName: t.NewManagedName("control-plane"),
141+
Path: t.Spec.ControlPlane.Path,
141142
AssumeRolePolicyDocument: t.controlPlaneTrustPolicy(),
142143
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
143144
Policies: t.controlPlanePolicies(),
145+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
144146
Tags: converters.MapToCloudFormationTags(t.Spec.ControlPlane.Tags),
145147
}
146148

147149
template.Resources[AWSIAMRoleControllers] = &cfn_iam.Role{
148150
RoleName: t.NewManagedName("controllers"),
151+
Path: t.Spec.ControlPlane.Path,
149152
AssumeRolePolicyDocument: t.controllersTrustPolicy(),
150153
Policies: t.controllersRolePolicy(),
154+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
151155
Tags: converters.MapToCloudFormationTags(t.Spec.ClusterAPIControllers.Tags),
152156
}
153157

154158
template.Resources[AWSIAMRoleNodes] = &cfn_iam.Role{
155159
RoleName: t.NewManagedName("nodes"),
160+
Path: t.Spec.ControlPlane.Path,
156161
AssumeRolePolicyDocument: t.nodeTrustPolicy(),
157162
ManagedPolicyArns: t.nodeManagedPolicies(),
158163
Policies: t.nodePolicies(),
164+
PermissionsBoundary: t.Spec.ControlPlane.PermissionsBoundary,
159165
Tags: converters.MapToCloudFormationTags(t.Spec.Nodes.Tags),
160166
}
161167

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2937,6 +2937,30 @@ spec:
29372937
and no name is supplied then a role is created.
29382938
minLength: 2
29392939
type: string
2940+
rolePath:
2941+
description: |-
2942+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
2943+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
2944+
in the IAM User Guide.
2945+
2946+
This parameter is optional. If it is not included, it defaults to a slash
2947+
(/).
2948+
type: string
2949+
rolePermissionsBoundary:
2950+
description: |-
2951+
RolePermissionsBoundary sets the ARN of the managed policy that is used
2952+
to set the permissions boundary for the role.
2953+
2954+
A permissions boundary policy defines the maximum permissions that identity-based
2955+
policies can grant to an entity, but does not grant permissions. Permissions
2956+
boundaries do not define the maximum permissions that a resource-based policy
2957+
can grant to an entity. To learn more, see Permissions boundaries for IAM
2958+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
2959+
in the IAM User Guide.
2960+
2961+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
2962+
in the IAM User Guide.
2963+
type: string
29402964
secondaryCidrBlock:
29412965
description: |-
29422966
SecondaryCidrBlock is the additional CIDR range to use for pod IPs.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsfargateprofiles.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,30 @@ spec:
264264
and not delete it on deletion. If the EKSEnableIAM feature
265265
flag is true and no name is supplied then a role is created.
266266
type: string
267+
rolePath:
268+
description: |-
269+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
270+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
271+
in the IAM User Guide.
272+
273+
This parameter is optional. If it is not included, it defaults to a slash
274+
(/).
275+
type: string
276+
rolePermissionsBoundary:
277+
description: |-
278+
RolePermissionsBoundary sets the ARN of the managed policy that is used
279+
to set the permissions boundary for the role.
280+
281+
A permissions boundary policy defines the maximum permissions that identity-based
282+
policies can grant to an entity, but does not grant permissions. Permissions
283+
boundaries do not define the maximum permissions that a resource-based policy
284+
can grant to an entity. To learn more, see Permissions boundaries for IAM
285+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
286+
in the IAM User Guide.
287+
288+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
289+
in the IAM User Guide.
290+
type: string
267291
selectors:
268292
description: Selectors specify fargate pod selectors.
269293
items:

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -938,6 +938,30 @@ spec:
938938
and not delete it on deletion. If the EKSEnableIAM feature
939939
flag is true and no name is supplied then a role is created.
940940
type: string
941+
rolePath:
942+
description: |-
943+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
944+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
945+
in the IAM User Guide.
946+
947+
This parameter is optional. If it is not included, it defaults to a slash
948+
(/).
949+
type: string
950+
rolePermissionsBoundary:
951+
description: |-
952+
RolePermissionsBoundary sets the ARN of the managed policy that is used
953+
to set the permissions boundary for the role.
954+
955+
A permissions boundary policy defines the maximum permissions that identity-based
956+
policies can grant to an entity, but does not grant permissions. Permissions
957+
boundaries do not define the maximum permissions that a resource-based policy
958+
can grant to an entity. To learn more, see Permissions boundaries for IAM
959+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
960+
in the IAM User Guide.
961+
962+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
963+
in the IAM User Guide.
964+
type: string
941965
scaling:
942966
description: Scaling specifies scaling for the ASG behind this pool
943967
properties:

‎controlplane/eks/api/v1beta1/conversion.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ func (r *AWSManagedControlPlane) ConvertTo(dstRaw conversion.Hub) error {
4242
dst.Spec.VpcCni.Disable = r.Spec.DisableVPCCNI
4343
dst.Spec.Partition = restored.Spec.Partition
4444
dst.Spec.RestrictPrivateSubnets = restored.Spec.RestrictPrivateSubnets
45+
dst.Spec.RolePath = restored.Spec.RolePath
46+
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
4547
dst.Status.Version = restored.Status.Version
4648
dst.Spec.BootstrapSelfManagedAddons = restored.Spec.BootstrapSelfManagedAddons
4749
return nil

‎controlplane/eks/api/v1beta1/zz_generated.conversion.go‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,30 @@ type AWSManagedControlPlaneSpec struct { //nolint: maligned
8888
// +optional
8989
RoleAdditionalPolicies *[]string `json:"roleAdditionalPolicies,omitempty"`
9090

91+
// RolePath sets the path to the role. For more information about paths, see IAM Identifiers
92+
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
93+
// in the IAM User Guide.
94+
//
95+
// This parameter is optional. If it is not included, it defaults to a slash
96+
// (/).
97+
// +optional
98+
RolePath string `json:"rolePath,omitempty"`
99+
100+
// RolePermissionsBoundary sets the ARN of the managed policy that is used
101+
// to set the permissions boundary for the role.
102+
//
103+
// A permissions boundary policy defines the maximum permissions that identity-based
104+
// policies can grant to an entity, but does not grant permissions. Permissions
105+
// boundaries do not define the maximum permissions that a resource-based policy
106+
// can grant to an entity. To learn more, see Permissions boundaries for IAM
107+
// entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
108+
// in the IAM User Guide.
109+
//
110+
// For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
111+
// in the IAM User Guide.
112+
// +optional
113+
RolePermissionsBoundary string `json:"rolePermissionsBoundary,omitempty"`
114+
91115
// Logging specifies which EKS Cluster logs should be enabled. Entries for
92116
// each of the enabled logs will be sent to CloudWatch
93117
// +optional

0 commit comments

Comments
 (0)