Skip to content

Commit e75df03

Browse files
jayesh-srivastavavishu2498
jayesh-srivastava
authored and
vishu2498
committed
PEM-4967: CAPA TopSecret region support
1 parent b0e8f1c commit e75df03

File tree

19 files changed

+573
-104
lines changed

19 files changed

+573
-104
lines changed

‎cmd/clusterawsadm/cloudformation/bootstrap/fargate.go‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,7 @@ import (
2222
)
2323

2424
func (t Template) fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
25-
var policies []string
26-
if t.Spec.Partition == bootstrapv1.DefaultPartitionNameUSGov {
27-
policies = eks.FargateRolePoliciesAWSUSGov()
28-
} else {
29-
policies = eks.FargateRolePolicies()
30-
}
25+
policies := eks.GenerateFargateRolePoliciesARN(t.Spec.Partition)
3126
if roleSpec.ExtraPolicyAttachments != nil {
3227
policies = append(policies, roleSpec.ExtraPolicyAttachments...)
3328
}

‎cmd/clusterawsadm/cloudformation/bootstrap/managed_nodegroup.go‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,12 @@ limitations under the License.
1717
package bootstrap
1818

1919
import (
20-
"sigs.k8s.io/cluster-api-provider-aws/cmd/clusterawsadm/api/bootstrap/v1beta1"
2120
"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/services/eks"
2221
)
2322

2423
func (t Template) eksMachinePoolPolicies() []string {
2524

26-
var policies []string
27-
if t.Spec.Partition == v1beta1.DefaultPartitionNameUSGov {
28-
policies = eks.NodegroupRolePoliciesAWSUSGov()
29-
} else {
30-
policies = eks.NodegroupRolePolicies()
31-
}
25+
policies := eks.GenerateNodegroupRolePoliciesARN(t.Spec.Partition)
3226
if t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments != nil {
3327
policies = append(policies, t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments...)
3428
}

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go‎

Lines changed: 44 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -36,13 +36,13 @@ const (
3636
AWSIAMInstanceProfileControllers = "AWSIAMInstanceProfileControllers"
3737
AWSIAMInstanceProfileControlPlane = "AWSIAMInstanceProfileControlPlane"
3838
AWSIAMInstanceProfileNodes = "AWSIAMInstanceProfileNodes"
39+
AWSIAMUserBootstrapper = "AWSIAMUserBootstrapper"
3940
AWSIAMRoleControllers = "AWSIAMRoleControllers"
4041
AWSIAMRoleControlPlane = "AWSIAMRoleControlPlane"
4142
AWSIAMRoleNodes = "AWSIAMRoleNodes"
4243
AWSIAMRoleEKSControlPlane = "AWSIAMRoleEKSControlPlane"
4344
AWSIAMRoleEKSNodegroup = "AWSIAMRoleEKSNodegroup"
4445
AWSIAMRoleEKSFargate = "AWSIAMRoleEKSFargate"
45-
AWSIAMUserBootstrapper = "AWSIAMUserBootstrapper"
4646
ControllersPolicy PolicyName = "AWSIAMManagedPolicyControllers"
4747
ControllersPolicyEKS PolicyName = "AWSIAMManagedPolicyControllersEKS"
4848
ControlPlanePolicy PolicyName = "AWSIAMManagedPolicyCloudProviderControlPlane"
@@ -71,18 +71,26 @@ func (t Template) NewManagedName(name string) string {
7171
return fmt.Sprintf("%s%s%s", t.Spec.NamePrefix, name, *t.Spec.NameSuffix)
7272
}
7373

74+
func (t Template) NewEKSManagedName(name string) string {
75+
return fmt.Sprintf("%s%s", t.Spec.NamePrefix, name)
76+
}
77+
7478
// RenderCloudFormation will render and return a cloudformation Template.
75-
func (t Template) RenderCloudFormation() *cloudformation.Template {
79+
func (t Template) RenderCloudFormation(permissionsBoundary *string) *cloudformation.Template {
7680
template := cloudformation.NewTemplate()
7781

7882
if t.Spec.BootstrapUser.Enable {
79-
template.Resources[AWSIAMUserBootstrapper] = &cfn_iam.User{
83+
user := &cfn_iam.User{
8084
UserName: t.Spec.BootstrapUser.UserName,
8185
Groups: t.bootstrapUserGroups(),
8286
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
8387
Policies: t.bootstrapUserPolicy(),
8488
Tags: converters.MapToCloudFormationTags(t.Spec.BootstrapUser.Tags),
8589
}
90+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
91+
user.PermissionsBoundary = *permissionsBoundary
92+
}
93+
template.Resources[AWSIAMUserBootstrapper] = user
8694

8795
template.Resources[AWSIAMGroupBootstrapper] = &cfn_iam.Group{
8896
GroupName: t.Spec.BootstrapUser.GroupName,
@@ -134,28 +142,40 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
134142
}
135143
}
136144

137-
template.Resources[AWSIAMRoleControlPlane] = &cfn_iam.Role{
145+
cpRole := &cfn_iam.Role{
138146
RoleName: t.NewManagedName("control-plane"),
139147
AssumeRolePolicyDocument: t.controlPlaneTrustPolicy(),
140148
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
141149
Policies: t.controlPlanePolicies(),
142150
Tags: converters.MapToCloudFormationTags(t.Spec.ControlPlane.Tags),
143151
}
152+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
153+
cpRole.PermissionsBoundary = *permissionsBoundary
154+
}
155+
template.Resources[AWSIAMRoleControlPlane] = cpRole
144156

145-
template.Resources[AWSIAMRoleControllers] = &cfn_iam.Role{
157+
ctrRole := &cfn_iam.Role{
146158
RoleName: t.NewManagedName("controllers"),
147159
AssumeRolePolicyDocument: t.controllersTrustPolicy(),
148160
Policies: t.controllersRolePolicy(),
149161
Tags: converters.MapToCloudFormationTags(t.Spec.ClusterAPIControllers.Tags),
150162
}
163+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
164+
ctrRole.PermissionsBoundary = *permissionsBoundary
165+
}
166+
template.Resources[AWSIAMRoleControllers] = ctrRole
151167

152-
template.Resources[AWSIAMRoleNodes] = &cfn_iam.Role{
168+
nodeRole := &cfn_iam.Role{
153169
RoleName: t.NewManagedName("nodes"),
154170
AssumeRolePolicyDocument: t.nodeTrustPolicy(),
155171
ManagedPolicyArns: t.nodeManagedPolicies(),
156172
Policies: t.nodePolicies(),
157173
Tags: converters.MapToCloudFormationTags(t.Spec.Nodes.Tags),
158174
}
175+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
176+
nodeRole.PermissionsBoundary = *permissionsBoundary
177+
}
178+
template.Resources[AWSIAMRoleNodes] = nodeRole
159179

160180
template.Resources[AWSIAMInstanceProfileControlPlane] = &cfn_iam.InstanceProfile{
161181
InstanceProfileName: t.NewManagedName("control-plane"),
@@ -179,30 +199,42 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
179199
}
180200

181201
if !t.Spec.EKS.DefaultControlPlaneRole.Disable && !t.Spec.EKS.Disable {
182-
template.Resources[AWSIAMRoleEKSControlPlane] = &cfn_iam.Role{
183-
RoleName: ekscontrolplanev1.DefaultEKSControlPlaneRole,
202+
eksCPRole := &cfn_iam.Role{
203+
RoleName: t.NewEKSManagedName(ekscontrolplanev1.DefaultEKSControlPlaneRole),
184204
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{"eks.amazonaws.com"}),
185205
ManagedPolicyArns: t.eksControlPlanePolicies(),
186206
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.DefaultControlPlaneRole.Tags),
187207
}
208+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
209+
eksCPRole.PermissionsBoundary = *permissionsBoundary
210+
}
211+
template.Resources[AWSIAMRoleEKSControlPlane] = eksCPRole
188212
}
189213

190214
if !t.Spec.EKS.ManagedMachinePool.Disable && !t.Spec.EKS.Disable {
191-
template.Resources[AWSIAMRoleEKSNodegroup] = &cfn_iam.Role{
192-
RoleName: expinfrav1.DefaultEKSNodegroupRole,
215+
eksNGRole := &cfn_iam.Role{
216+
RoleName: t.NewEKSManagedName(expinfrav1.DefaultEKSNodegroupRole),
193217
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{"ec2.amazonaws.com", "eks.amazonaws.com"}),
194218
ManagedPolicyArns: t.eksMachinePoolPolicies(),
195219
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.ManagedMachinePool.Tags),
196220
}
221+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
222+
eksNGRole.PermissionsBoundary = *permissionsBoundary
223+
}
224+
template.Resources[AWSIAMRoleEKSNodegroup] = eksNGRole
197225
}
198226

199227
if !t.Spec.EKS.Fargate.Disable && !t.Spec.EKS.Disable {
200-
template.Resources[AWSIAMRoleEKSFargate] = &cfn_iam.Role{
201-
RoleName: expinfrav1.DefaultEKSFargateRole,
228+
eksFGRole := &cfn_iam.Role{
229+
RoleName: t.NewEKSManagedName(expinfrav1.DefaultEKSFargateRole),
202230
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{eksiam.EKSFargateService}),
203231
ManagedPolicyArns: t.fargateProfilePolicies(t.Spec.EKS.Fargate),
204232
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.Fargate.Tags),
205233
}
234+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
235+
eksFGRole.PermissionsBoundary = *permissionsBoundary
236+
}
237+
template.Resources[AWSIAMRoleEKSFargate] = eksFGRole
206238
}
207239

208240
if t.Spec.EKS.EnableUserEKSConsolePolicy && !t.Spec.EKS.Disable {

‎cmd/clusterawsadm/cloudformation/bootstrap/template_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ func Test_RenderCloudformation(t *testing.T) {
188188
t.Fatal(err)
189189
}
190190

191-
tData, err := c.template().RenderCloudFormation().YAML()
191+
tData, err := c.template().RenderCloudFormation(nil).YAML()
192192
if err != nil {
193193
t.Fatal(err)
194194
}

‎cmd/clusterawsadm/cmd/bootstrap/iam/cloudformation.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ func printCloudFormationTemplateCmd() *cobra.Command {
5454
return err
5555
}
5656

57-
cfnTemplate := t.RenderCloudFormation()
57+
cfnTemplate := t.RenderCloudFormation(nil)
5858
yml, err := cfnTemplate.YAML()
5959
if err != nil {
6060
return err
@@ -109,7 +109,7 @@ func createCloudFormationStackCmd() *cobra.Command {
109109

110110
cfnSvc := cloudformation.NewService(cfn.New(sess))
111111

112-
err = cfnSvc.ReconcileBootstrapStack(t.Spec.StackName, *t.RenderCloudFormation(), t.Spec.StackTags)
112+
err = cfnSvc.ReconcileBootstrapStack(t.Spec.StackName, *t.RenderCloudFormation(nil), t.Spec.StackTags)
113113
if err != nil {
114114
fmt.Printf("Error: %v\n", err)
115115
return err

‎config/default/credentials.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,12 @@ metadata:
66
type: Opaque
77
data:
88
credentials: ${AWS_B64ENCODED_CREDENTIALS}
9+
---
10+
apiVersion: v1
11+
kind: Secret
12+
metadata:
13+
name: manager-bootstrap-ca-bundle
14+
namespace: system
15+
type: Opaque
16+
data:
17+
credentials: ${AWS_B64ENCODED_CABUNDLE}

‎config/default/manager_credentials_patch.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,19 @@ spec:
1111
env:
1212
- name: AWS_SHARED_CREDENTIALS_FILE
1313
value: /home/.aws/credentials
14+
- name: AWS_CONFIG_FILE # required for AWS SDK to load config and for aws secret regions
15+
value: /home/.aws/config
16+
- name: AWS_SDK_LOAD_CONFIG
17+
value: "true"
1418
volumeMounts:
1519
- name: credentials
1620
mountPath: /home/.aws
21+
- name: ca-bundle
22+
mountPath: /home/.aws/ca-bundle
1723
volumes:
1824
- name: credentials
1925
secret:
2026
secretName: manager-bootstrap-credentials
27+
- name: ca-bundle
28+
secret:
29+
secretName: manager-bootstrap-ca-bundle

‎go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ require (
2727
github.com/sergi/go-diff v1.2.0
2828
github.com/spf13/cobra v1.5.0
2929
github.com/spf13/pflag v1.0.5
30-
golang.org/x/crypto v0.21.0
31-
golang.org/x/text v0.14.0
30+
golang.org/x/crypto v0.31.0
31+
golang.org/x/text v0.21.0
3232
gopkg.in/yaml.v2 v2.4.0
3333
k8s.io/api v0.25.0
3434
k8s.io/apiextensions-apiserver v0.25.0
@@ -138,10 +138,10 @@ require (
138138
github.com/subosito/gotenv v1.3.0 // indirect
139139
github.com/valyala/fastjson v1.6.3 // indirect
140140
github.com/vincent-petithory/dataurl v1.0.0 // indirect
141-
golang.org/x/net v0.23.0 // indirect
141+
golang.org/x/net v0.33.0 // indirect
142142
golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb // indirect
143-
golang.org/x/sys v0.18.0 // indirect
144-
golang.org/x/term v0.18.0 // indirect
143+
golang.org/x/sys v0.28.0 // indirect
144+
golang.org/x/term v0.27.0 // indirect
145145
golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect
146146
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
147147
google.golang.org/appengine v1.6.7 // indirect

‎go.sum‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -795,8 +795,8 @@ golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm
795795
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
796796
golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
797797
golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
798-
golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
799-
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
798+
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
799+
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
800800
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
801801
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
802802
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -887,8 +887,8 @@ golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qx
887887
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
888888
golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
889889
golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
890-
golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
891-
golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
890+
golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
891+
golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
892892
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
893893
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
894894
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -992,14 +992,14 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
992992
golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
993993
golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
994994
golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
995-
golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
996-
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
995+
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
996+
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
997997
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
998998
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
999999
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
10001000
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
1001-
golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
1002-
golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
1001+
golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
1002+
golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
10031003
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
10041004
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
10051005
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1010,8 +1010,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
10101010
golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
10111011
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
10121012
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
1013-
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
1014-
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
1013+
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
1014+
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
10151015
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
10161016
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
10171017
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

‎pkg/cloud/services/eks/iam/iam.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,7 @@ func (s *IAMService) CreateRole(
183183
key string,
184184
trustRelationship *iamv1.PolicyDocument,
185185
additionalTags infrav1.Tags,
186+
permissionsBoundary string,
186187
) (*iam.Role, error) {
187188
tags := RoleTags(key, additionalTags)
188189

@@ -197,6 +198,10 @@ func (s *IAMService) CreateRole(
197198
AssumeRolePolicyDocument: aws.String(trustRelationshipJSON),
198199
}
199200

201+
if len(permissionsBoundary) > 0 {
202+
input.PermissionsBoundary = aws.String(permissionsBoundary)
203+
}
204+
200205
out, err := s.IAMClient.CreateRole(input)
201206
if err != nil {
202207
return nil, errors.Wrap(err, "failed to call CreateRole")

0 commit comments

Comments
 (0)