kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix IAM permissions for Karpenter

This commit is contained in:
Ole Markus With 2022-08-01 07:34:57 +02:00
parent dba1e5d594
commit 2a21b49eea
2 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
pkg/model/components/addonmanifests/karpenter/iam.go
View File

@ -52,17 +52,19 @@ func addKarpenterPermissions(p *iam.Policy) {
// use existing kOps instance group launch templates // use existing kOps instance group launch templates
// "ec2:CreateLaunchTemplate", // "ec2:CreateLaunchTemplate",
"ec2:CreateFleet", "ec2:CreateFleet",
"ec2:RunInstances",
"ec2:CreateTags", "ec2:CreateTags",
"iam:PassRole",
"ec2:TerminateInstances",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeInstances",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSpotPriceHistory",
"ec2:DescribeSubnets",
"iam:PassRole",
"ec2:RunInstances",
"ec2:TerminateInstances",
"pricing:GetProducts",
"ssm:GetParameter", "ssm:GetParameter",
) )
} }

2
tests/integration/update_cluster/karpenter/data/aws_iam_role_policy_karpenter.kube-system.sa.minimal.example.com_policy
View File

@ -10,10 +10,12 @@
"ec2:DescribeInstances", "ec2:DescribeInstances",
"ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplates",
"ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroups",
"ec2:DescribeSpotPriceHistory",
"ec2:DescribeSubnets", "ec2:DescribeSubnets",
"ec2:RunInstances", "ec2:RunInstances",
"ec2:TerminateInstances", "ec2:TerminateInstances",
"iam:PassRole", "iam:PassRole",
"pricing:GetProducts",
"ssm:GetParameter" "ssm:GetParameter"
], ],
"Effect": "Allow", "Effect": "Allow",