kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

use IAMPrefix() for hostedzone

This commit is contained in:
Lee Azzarello 2020-01-17 14:10:33 -08:00
parent 85a667ad05
commit 23cf0dd59e
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/model/iam/iam_builder.go
View File

@ -169,7 +169,7 @@ func (b *PolicyBuilder) BuildAWSPolicyMaster() (*Policy, error) {
}
if b.HostedZoneID != "" {
addRoute53Permissions(p, b.HostedZoneID)
b.addRoute53Permissions(p, b.HostedZoneID)
}
if b.Cluster.Spec.IAM.Legacy {
@ -212,7 +212,7 @@ func (b *PolicyBuilder) BuildAWSPolicyNode() (*Policy, error) {
if b.Cluster.Spec.IAM.Legacy {
if b.HostedZoneID != "" {
addRoute53Permissions(p, b.HostedZoneID)
b.addRoute53Permissions(p, b.HostedZoneID)
}
addRoute53ListHostedZonesPermission(p)
}
@ -536,10 +536,12 @@ func addECRPermissions(p *Policy) {
})
}
func addRoute53Permissions(p *Policy, hostedZoneID string) {
func (b *PolicyBuilder) addRoute53Permissions(p *Policy, hostedZoneID string) {
// TODO: Route53 currently not supported in China, need to check and fail/return
//if b.IAMPrefix() == "arn:aws-cn" {
//
//}
// Remove /hostedzone/ prefix (if present)
hostedZoneID = strings.TrimPrefix(hostedZoneID, "/")
hostedZoneID = strings.TrimPrefix(hostedZoneID, "hostedzone/")
@ -549,13 +551,13 @@ func addRoute53Permissions(p *Policy, hostedZoneID string) {
Action: stringorslice.Of("route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets",
"route53:GetHostedZone"),
Resource: stringorslice.Slice([]string{"arn:aws:route53:::hostedzone/" + hostedZoneID}),
Resource: stringorslice.Slice([]string{b.IAMPrefix() + ":route53:::hostedzone/" + hostedZoneID}),
})
p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{"route53:GetChange"}),
Resource: stringorslice.Slice([]string{"arn:aws:route53:::change/*"}),
Resource: stringorslice.Slice([]string{b.IAMPrefix() + ":route53:::change/*"}),
})
wildcard := stringorslice.Slice([]string{"*"})