Skip to content

Commit ff0b8cf

Browse files
snehala27snehala27
authored
Merge pull request #939 from spectrocloud/PEM-4967-4.5
PEM-4967: CAPA TopSecret region support
2 parents 2840239 + e75df03 commit ff0b8cf

File tree

17 files changed

+558
-89
lines changed

17 files changed

+558
-89
lines changed

‎cmd/clusterawsadm/cloudformation/bootstrap/fargate.go‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,7 @@ import (
2222
)
2323

2424
func (t Template) fargateProfilePolicies(roleSpec *bootstrapv1.AWSIAMRoleSpec) []string {
25-
var policies []string
26-
if t.Spec.Partition == bootstrapv1.DefaultPartitionNameUSGov {
27-
policies = eks.FargateRolePoliciesAWSUSGov()
28-
} else {
29-
policies = eks.FargateRolePolicies()
30-
}
25+
policies := eks.GenerateFargateRolePoliciesARN(t.Spec.Partition)
3126
if roleSpec.ExtraPolicyAttachments != nil {
3227
policies = append(policies, roleSpec.ExtraPolicyAttachments...)
3328
}

‎cmd/clusterawsadm/cloudformation/bootstrap/managed_nodegroup.go‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,12 @@ limitations under the License.
1717
package bootstrap
1818

1919
import (
20-
"sigs.k8s.io/cluster-api-provider-aws/cmd/clusterawsadm/api/bootstrap/v1beta1"
2120
"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/services/eks"
2221
)
2322

2423
func (t Template) eksMachinePoolPolicies() []string {
2524

26-
var policies []string
27-
if t.Spec.Partition == v1beta1.DefaultPartitionNameUSGov {
28-
policies = eks.NodegroupRolePoliciesAWSUSGov()
29-
} else {
30-
policies = eks.NodegroupRolePolicies()
31-
}
25+
policies := eks.GenerateNodegroupRolePoliciesARN(t.Spec.Partition)
3226
if t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments != nil {
3327
policies = append(policies, t.Spec.EKS.ManagedMachinePool.ExtraPolicyAttachments...)
3428
}

‎cmd/clusterawsadm/cloudformation/bootstrap/template.go‎

Lines changed: 44 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -36,13 +36,13 @@ const (
3636
AWSIAMInstanceProfileControllers = "AWSIAMInstanceProfileControllers"
3737
AWSIAMInstanceProfileControlPlane = "AWSIAMInstanceProfileControlPlane"
3838
AWSIAMInstanceProfileNodes = "AWSIAMInstanceProfileNodes"
39+
AWSIAMUserBootstrapper = "AWSIAMUserBootstrapper"
3940
AWSIAMRoleControllers = "AWSIAMRoleControllers"
4041
AWSIAMRoleControlPlane = "AWSIAMRoleControlPlane"
4142
AWSIAMRoleNodes = "AWSIAMRoleNodes"
4243
AWSIAMRoleEKSControlPlane = "AWSIAMRoleEKSControlPlane"
4344
AWSIAMRoleEKSNodegroup = "AWSIAMRoleEKSNodegroup"
4445
AWSIAMRoleEKSFargate = "AWSIAMRoleEKSFargate"
45-
AWSIAMUserBootstrapper = "AWSIAMUserBootstrapper"
4646
ControllersPolicy PolicyName = "AWSIAMManagedPolicyControllers"
4747
ControllersPolicyEKS PolicyName = "AWSIAMManagedPolicyControllersEKS"
4848
ControlPlanePolicy PolicyName = "AWSIAMManagedPolicyCloudProviderControlPlane"
@@ -71,18 +71,26 @@ func (t Template) NewManagedName(name string) string {
7171
return fmt.Sprintf("%s%s%s", t.Spec.NamePrefix, name, *t.Spec.NameSuffix)
7272
}
7373

74+
func (t Template) NewEKSManagedName(name string) string {
75+
return fmt.Sprintf("%s%s", t.Spec.NamePrefix, name)
76+
}
77+
7478
// RenderCloudFormation will render and return a cloudformation Template.
75-
func (t Template) RenderCloudFormation() *cloudformation.Template {
79+
func (t Template) RenderCloudFormation(permissionsBoundary *string) *cloudformation.Template {
7680
template := cloudformation.NewTemplate()
7781

7882
if t.Spec.BootstrapUser.Enable {
79-
template.Resources[AWSIAMUserBootstrapper] = &cfn_iam.User{
83+
user := &cfn_iam.User{
8084
UserName: t.Spec.BootstrapUser.UserName,
8185
Groups: t.bootstrapUserGroups(),
8286
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
8387
Policies: t.bootstrapUserPolicy(),
8488
Tags: converters.MapToCloudFormationTags(t.Spec.BootstrapUser.Tags),
8589
}
90+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
91+
user.PermissionsBoundary = *permissionsBoundary
92+
}
93+
template.Resources[AWSIAMUserBootstrapper] = user
8694

8795
template.Resources[AWSIAMGroupBootstrapper] = &cfn_iam.Group{
8896
GroupName: t.Spec.BootstrapUser.GroupName,
@@ -134,28 +142,40 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
134142
}
135143
}
136144

137-
template.Resources[AWSIAMRoleControlPlane] = &cfn_iam.Role{
145+
cpRole := &cfn_iam.Role{
138146
RoleName: t.NewManagedName("control-plane"),
139147
AssumeRolePolicyDocument: t.controlPlaneTrustPolicy(),
140148
ManagedPolicyArns: t.Spec.ControlPlane.ExtraPolicyAttachments,
141149
Policies: t.controlPlanePolicies(),
142150
Tags: converters.MapToCloudFormationTags(t.Spec.ControlPlane.Tags),
143151
}
152+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
153+
cpRole.PermissionsBoundary = *permissionsBoundary
154+
}
155+
template.Resources[AWSIAMRoleControlPlane] = cpRole
144156

145-
template.Resources[AWSIAMRoleControllers] = &cfn_iam.Role{
157+
ctrRole := &cfn_iam.Role{
146158
RoleName: t.NewManagedName("controllers"),
147159
AssumeRolePolicyDocument: t.controllersTrustPolicy(),
148160
Policies: t.controllersRolePolicy(),
149161
Tags: converters.MapToCloudFormationTags(t.Spec.ClusterAPIControllers.Tags),
150162
}
163+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
164+
ctrRole.PermissionsBoundary = *permissionsBoundary
165+
}
166+
template.Resources[AWSIAMRoleControllers] = ctrRole
151167

152-
template.Resources[AWSIAMRoleNodes] = &cfn_iam.Role{
168+
nodeRole := &cfn_iam.Role{
153169
RoleName: t.NewManagedName("nodes"),
154170
AssumeRolePolicyDocument: t.nodeTrustPolicy(),
155171
ManagedPolicyArns: t.nodeManagedPolicies(),
156172
Policies: t.nodePolicies(),
157173
Tags: converters.MapToCloudFormationTags(t.Spec.Nodes.Tags),
158174
}
175+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
176+
nodeRole.PermissionsBoundary = *permissionsBoundary
177+
}
178+
template.Resources[AWSIAMRoleNodes] = nodeRole
159179

160180
template.Resources[AWSIAMInstanceProfileControlPlane] = &cfn_iam.InstanceProfile{
161181
InstanceProfileName: t.NewManagedName("control-plane"),
@@ -179,30 +199,42 @@ func (t Template) RenderCloudFormation() *cloudformation.Template {
179199
}
180200

181201
if !t.Spec.EKS.DefaultControlPlaneRole.Disable && !t.Spec.EKS.Disable {
182-
template.Resources[AWSIAMRoleEKSControlPlane] = &cfn_iam.Role{
183-
RoleName: ekscontrolplanev1.DefaultEKSControlPlaneRole,
202+
eksCPRole := &cfn_iam.Role{
203+
RoleName: t.NewEKSManagedName(ekscontrolplanev1.DefaultEKSControlPlaneRole),
184204
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{"eks.amazonaws.com"}),
185205
ManagedPolicyArns: t.eksControlPlanePolicies(),
186206
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.DefaultControlPlaneRole.Tags),
187207
}
208+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
209+
eksCPRole.PermissionsBoundary = *permissionsBoundary
210+
}
211+
template.Resources[AWSIAMRoleEKSControlPlane] = eksCPRole
188212
}
189213

190214
if !t.Spec.EKS.ManagedMachinePool.Disable && !t.Spec.EKS.Disable {
191-
template.Resources[AWSIAMRoleEKSNodegroup] = &cfn_iam.Role{
192-
RoleName: expinfrav1.DefaultEKSNodegroupRole,
215+
eksNGRole := &cfn_iam.Role{
216+
RoleName: t.NewEKSManagedName(expinfrav1.DefaultEKSNodegroupRole),
193217
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{"ec2.amazonaws.com", "eks.amazonaws.com"}),
194218
ManagedPolicyArns: t.eksMachinePoolPolicies(),
195219
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.ManagedMachinePool.Tags),
196220
}
221+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
222+
eksNGRole.PermissionsBoundary = *permissionsBoundary
223+
}
224+
template.Resources[AWSIAMRoleEKSNodegroup] = eksNGRole
197225
}
198226

199227
if !t.Spec.EKS.Fargate.Disable && !t.Spec.EKS.Disable {
200-
template.Resources[AWSIAMRoleEKSFargate] = &cfn_iam.Role{
201-
RoleName: expinfrav1.DefaultEKSFargateRole,
228+
eksFGRole := &cfn_iam.Role{
229+
RoleName: t.NewEKSManagedName(expinfrav1.DefaultEKSFargateRole),
202230
AssumeRolePolicyDocument: AssumeRolePolicy(iamv1.PrincipalService, []string{eksiam.EKSFargateService}),
203231
ManagedPolicyArns: t.fargateProfilePolicies(t.Spec.EKS.Fargate),
204232
Tags: converters.MapToCloudFormationTags(t.Spec.EKS.Fargate.Tags),
205233
}
234+
if permissionsBoundary != nil && len(*permissionsBoundary) > 0 {
235+
eksFGRole.PermissionsBoundary = *permissionsBoundary
236+
}
237+
template.Resources[AWSIAMRoleEKSFargate] = eksFGRole
206238
}
207239

208240
if t.Spec.EKS.EnableUserEKSConsolePolicy && !t.Spec.EKS.Disable {

‎cmd/clusterawsadm/cloudformation/bootstrap/template_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ func Test_RenderCloudformation(t *testing.T) {
188188
t.Fatal(err)
189189
}
190190

191-
tData, err := c.template().RenderCloudFormation().YAML()
191+
tData, err := c.template().RenderCloudFormation(nil).YAML()
192192
if err != nil {
193193
t.Fatal(err)
194194
}

‎cmd/clusterawsadm/cmd/bootstrap/iam/cloudformation.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ func printCloudFormationTemplateCmd() *cobra.Command {
5454
return err
5555
}
5656

57-
cfnTemplate := t.RenderCloudFormation()
57+
cfnTemplate := t.RenderCloudFormation(nil)
5858
yml, err := cfnTemplate.YAML()
5959
if err != nil {
6060
return err
@@ -109,7 +109,7 @@ func createCloudFormationStackCmd() *cobra.Command {
109109

110110
cfnSvc := cloudformation.NewService(cfn.New(sess))
111111

112-
err = cfnSvc.ReconcileBootstrapStack(t.Spec.StackName, *t.RenderCloudFormation(), t.Spec.StackTags)
112+
err = cfnSvc.ReconcileBootstrapStack(t.Spec.StackName, *t.RenderCloudFormation(nil), t.Spec.StackTags)
113113
if err != nil {
114114
fmt.Printf("Error: %v\n", err)
115115
return err

‎config/default/credentials.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,12 @@ metadata:
66
type: Opaque
77
data:
88
credentials: ${AWS_B64ENCODED_CREDENTIALS}
9+
---
10+
apiVersion: v1
11+
kind: Secret
12+
metadata:
13+
name: manager-bootstrap-ca-bundle
14+
namespace: system
15+
type: Opaque
16+
data:
17+
credentials: ${AWS_B64ENCODED_CABUNDLE}

‎config/default/manager_credentials_patch.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,19 @@ spec:
1111
env:
1212
- name: AWS_SHARED_CREDENTIALS_FILE
1313
value: /home/.aws/credentials
14+
- name: AWS_CONFIG_FILE # required for AWS SDK to load config and for aws secret regions
15+
value: /home/.aws/config
16+
- name: AWS_SDK_LOAD_CONFIG
17+
value: "true"
1418
volumeMounts:
1519
- name: credentials
1620
mountPath: /home/.aws
21+
- name: ca-bundle
22+
mountPath: /home/.aws/ca-bundle
1723
volumes:
1824
- name: credentials
1925
secret:
2026
secretName: manager-bootstrap-credentials
27+
- name: ca-bundle
28+
secret:
29+
secretName: manager-bootstrap-ca-bundle

‎pkg/cloud/services/eks/iam/iam.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,7 @@ func (s *IAMService) CreateRole(
183183
key string,
184184
trustRelationship *iamv1.PolicyDocument,
185185
additionalTags infrav1.Tags,
186+
permissionsBoundary string,
186187
) (*iam.Role, error) {
187188
tags := RoleTags(key, additionalTags)
188189

@@ -197,6 +198,10 @@ func (s *IAMService) CreateRole(
197198
AssumeRolePolicyDocument: aws.String(trustRelationshipJSON),
198199
}
199200

201+
if len(permissionsBoundary) > 0 {
202+
input.PermissionsBoundary = aws.String(permissionsBoundary)
203+
}
204+
200205
out, err := s.IAMClient.CreateRole(input)
201206
if err != nil {
202207
return nil, errors.Wrap(err, "failed to call CreateRole")

0 commit comments

Comments
 (0)