kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8366 from lazzarello/govcloud-route53 

Use IAMPrefix() for hostedzone
This commit is contained in:
Kubernetes Prow Robot 2020-01-21 08:09:37 -08:00 committed by GitHub
parent f2f1bae132 441cd2523c
commit 1cc950773f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/model/iam/iam_builder.go
View File

@ -169,7 +169,7 @@ func (b *PolicyBuilder) BuildAWSPolicyMaster() (*Policy, error) {
}
if b.HostedZoneID != "" {
addRoute53Permissions(p, b.HostedZoneID)
b.addRoute53Permissions(p, b.HostedZoneID)
}
if b.Cluster.Spec.IAM.Legacy {
@ -212,7 +212,7 @@ func (b *PolicyBuilder) BuildAWSPolicyNode() (*Policy, error) {
if b.Cluster.Spec.IAM.Legacy {
if b.HostedZoneID != "" {
addRoute53Permissions(p, b.HostedZoneID)
b.addRoute53Permissions(p, b.HostedZoneID)
}
addRoute53ListHostedZonesPermission(p)
}
@ -536,10 +536,9 @@ func addECRPermissions(p *Policy) {
})
}
func addRoute53Permissions(p *Policy, hostedZoneID string) {
func (b *PolicyBuilder) addRoute53Permissions(p *Policy, hostedZoneID string) {
// TODO: Route53 currently not supported in China, need to check and fail/return
// Remove /hostedzone/ prefix (if present)
hostedZoneID = strings.TrimPrefix(hostedZoneID, "/")
hostedZoneID = strings.TrimPrefix(hostedZoneID, "hostedzone/")
@ -549,13 +548,13 @@ func addRoute53Permissions(p *Policy, hostedZoneID string) {
Action: stringorslice.Of("route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets",
"route53:GetHostedZone"),
Resource: stringorslice.Slice([]string{"arn:aws:route53:::hostedzone/" + hostedZoneID}),
Resource: stringorslice.Slice([]string{b.IAMPrefix() + ":route53:::hostedzone/" + hostedZoneID}),
})
p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{"route53:GetChange"}),
Resource: stringorslice.Slice([]string{"arn:aws:route53:::change/*"}),
Resource: stringorslice.Slice([]string{b.IAMPrefix() + ":route53:::change/*"}),
})
wildcard := stringorslice.Slice([]string{"*"})