kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #16351 from rifelpet/iam-policy-refactor 

Refactor IAM Policy Builder
This commit is contained in:
Kubernetes Prow Robot 2024-02-13 09:21:31 -08:00 committed by GitHub
parent 5a3b1e2703 4643c66f6b
commit 9f43b03546
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
96 changed files with 654 additions and 652 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/model/awsmodel/iam.go
View File

@ -28,7 +28,7 @@ import (
"k8s.io/kops/pkg/apis/kops" "k8s.io/kops/pkg/apis/kops"
"k8s.io/kops/pkg/model" "k8s.io/kops/pkg/model"
"k8s.io/kops/pkg/model/iam" "k8s.io/kops/pkg/model/iam"
"k8s.io/kops/pkg/util/stringorslice" "k8s.io/kops/pkg/util/stringorset"
"k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi"
"k8s.io/kops/upup/pkg/fi/cloudup/awstasks" "k8s.io/kops/upup/pkg/fi/cloudup/awstasks"
"k8s.io/kops/upup/pkg/fi/cloudup/awsup" "k8s.io/kops/upup/pkg/fi/cloudup/awsup"
@ -432,7 +432,7 @@ func formatAWSIAMStatement(accountId, partition, oidcProvider, namespace, name s
Principal: iam.Principal{ Principal: iam.Principal{
Federated: "arn:" + partition + ":iam::" + accountId + ":oidc-provider/" + oidcProvider, Federated: "arn:" + partition + ":iam::" + accountId + ":oidc-provider/" + oidcProvider,
}, },
Action: stringorslice.String("sts:AssumeRoleWithWebIdentity"), Action: stringorset.String("sts:AssumeRoleWithWebIdentity"),
Condition: map[string]interface{}{ Condition: map[string]interface{}{
condition: map[string]interface{}{ condition: map[string]interface{}{
oidcProvider + ":sub": "system:serviceaccount:" + namespace + ":" + name, oidcProvider + ":sub": "system:serviceaccount:" + namespace + ":" + name,

6
pkg/model/awsmodel/iam_test.go
View File

@ -21,7 +21,7 @@ import (
"testing" "testing"
"k8s.io/kops/pkg/model/iam" "k8s.io/kops/pkg/model/iam"
"k8s.io/kops/pkg/util/stringorslice" "k8s.io/kops/pkg/util/stringorset"
) )
func TestIAMServiceEC2(t *testing.T) { func TestIAMServiceEC2(t *testing.T) {
@ -70,7 +70,7 @@ func Test_formatAWSIAMStatement(t *testing.T) {
Principal: iam.Principal{ Principal: iam.Principal{
Federated: "arn:aws-test:iam::0123456789:oidc-provider/oidc-test", Federated: "arn:aws-test:iam::0123456789:oidc-provider/oidc-test",
}, },
Action: stringorslice.String("sts:AssumeRoleWithWebIdentity"), Action: stringorset.String("sts:AssumeRoleWithWebIdentity"),
Condition: map[string]interface{}{ Condition: map[string]interface{}{
"StringEquals": map[string]interface{}{ "StringEquals": map[string]interface{}{
"oidc-test:sub": "system:serviceaccount:test:test", "oidc-test:sub": "system:serviceaccount:test:test",
@ -104,7 +104,7 @@ func Test_formatAWSIAMStatement(t *testing.T) {
Principal: iam.Principal{ Principal: iam.Principal{
Federated: "arn:aws-test:iam::0123456789:oidc-provider/oidc-test", Federated: "arn:aws-test:iam::0123456789:oidc-provider/oidc-test",
}, },
Action: stringorslice.String("sts:AssumeRoleWithWebIdentity"), Action: stringorset.String("sts:AssumeRoleWithWebIdentity"),
Condition: map[string]interface{}{ Condition: map[string]interface{}{
"StringLike": map[string]interface{}{ "StringLike": map[string]interface{}{
"oidc-test:sub": "system:serviceaccount:test-*:test", "oidc-test:sub": "system:serviceaccount:test-*:test",

14
pkg/model/components/addonmanifests/certmanager/iam.go
View File

@ -22,7 +22,7 @@ import (
"k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/types"
"k8s.io/kops/pkg/model/iam" "k8s.io/kops/pkg/model/iam"
"k8s.io/kops/pkg/util/stringorslice" "k8s.io/kops/pkg/util/stringorset"
) )
// ServiceAccount represents the service-account used by cert-manager. // ServiceAccount represents the service-account used by cert-manager.
@ -57,22 +57,22 @@ func addCertManagerPermissions(b *iam.PolicyBuilder, p *iam.Policy) {
p.Statement = append(p.Statement, &iam.Statement{ p.Statement = append(p.Statement, &iam.Statement{
Effect: iam.StatementEffectAllow, Effect: iam.StatementEffectAllow,
Action: stringorslice.Of("route53:ChangeResourceRecordSets", Action: stringorset.Of("route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:ListResourceRecordSets",
), ),
Resource: stringorslice.Slice(zoneResources), Resource: stringorset.Set(zoneResources),
}) })
p.Statement = append(p.Statement, &iam.Statement{ p.Statement = append(p.Statement, &iam.Statement{
Effect: iam.StatementEffectAllow, Effect: iam.StatementEffectAllow,
Action: stringorslice.Slice([]string{"route53:GetChange"}), Action: stringorset.Set([]string{"route53:GetChange"}),
Resource: stringorslice.Slice([]string{fmt.Sprintf("arn:%v:route53:::change/*", b.Partition)}), Resource: stringorset.Set([]string{fmt.Sprintf("arn:%v:route53:::change/*", b.Partition)}),
}) })
wildcard := stringorslice.Slice([]string{"*"}) wildcard := stringorset.Set([]string{"*"})
p.Statement = append(p.Statement, &iam.Statement{ p.Statement = append(p.Statement, &iam.Statement{
Effect: iam.StatementEffectAllow, Effect: iam.StatementEffectAllow,
Action: stringorslice.Slice([]string{"route53:ListHostedZonesByName"}), Action: stringorset.Set([]string{"route53:ListHostedZonesByName"}),
Resource: wildcard, Resource: wildcard,
}) })
} }

74
pkg/model/iam/iam_builder.go
View File

@ -38,7 +38,7 @@ import (
"k8s.io/kops/pkg/apis/kops" "k8s.io/kops/pkg/apis/kops"
"k8s.io/kops/pkg/apis/kops/model" "k8s.io/kops/pkg/apis/kops/model"
"k8s.io/kops/pkg/util/stringorslice" "k8s.io/kops/pkg/util/stringorset"
"k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi"
"k8s.io/kops/upup/pkg/fi/cloudup/awstasks" "k8s.io/kops/upup/pkg/fi/cloudup/awstasks"
"k8s.io/kops/util/pkg/vfs" "k8s.io/kops/util/pkg/vfs"
@ -50,9 +50,9 @@ const PolicyDefaultVersion = "2012-10-17"
// Policy Struct is a collection of fields that form a valid AWS policy document // Policy Struct is a collection of fields that form a valid AWS policy document
type Policy struct { type Policy struct {
clusterName string clusterName string
unconditionalAction sets.String unconditionalAction sets.Set[string]
clusterTaggedAction sets.String clusterTaggedAction sets.Set[string]
clusterTaggedCreateAction sets.String clusterTaggedCreateAction sets.Set[string]
Statement []*Statement Statement []*Statement
partition string partition string
Version string Version string
@ -77,8 +77,8 @@ func (p *Policy) AddEC2CreateAction(actions, resources []string) {
p.Statement = append(p.Statement, p.Statement = append(p.Statement,
&Statement{ &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.String("ec2:CreateTags"), Action: stringorset.String("ec2:CreateTags"),
Resource: stringorslice.Slice(actualResources), Resource: stringorset.Set(actualResources),
Condition: Condition{ Condition: Condition{
"StringEquals": map[string]interface{}{ "StringEquals": map[string]interface{}{
"aws:RequestTag/KubernetesCluster": p.clusterName, "aws:RequestTag/KubernetesCluster": p.clusterName,
@ -89,11 +89,11 @@ func (p *Policy) AddEC2CreateAction(actions, resources []string) {
&Statement{ &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{ Action: stringorset.Set([]string{
"ec2:CreateTags", "ec2:CreateTags",
"ec2:DeleteTags", // aws.go, tag.go "ec2:DeleteTags", // aws.go, tag.go
}), }),
Resource: stringorslice.Slice(actualResources), Resource: stringorset.Set(actualResources),
Condition: Condition{ Condition: Condition{
"Null": map[string]string{ "Null": map[string]string{
"aws:RequestTag/KubernetesCluster": "true", "aws:RequestTag/KubernetesCluster": "true",
@ -111,15 +111,15 @@ func (p *Policy) AsJSON() (string, error) {
if len(p.unconditionalAction) > 0 { if len(p.unconditionalAction) > 0 {
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of(p.unconditionalAction.List()...), Action: stringorset.Of(sets.List(p.unconditionalAction)...),
Resource: stringorslice.String("*"), Resource: stringorset.String("*"),
}) })
} }
if len(p.clusterTaggedAction) > 0 { if len(p.clusterTaggedAction) > 0 {
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of(p.clusterTaggedAction.List()...), Action: stringorset.Of(sets.List(p.clusterTaggedAction)...),
Resource: stringorslice.String("*"), Resource: stringorset.String("*"),
Condition: Condition{ Condition: Condition{
"StringEquals": map[string]string{ "StringEquals": map[string]string{
"aws:ResourceTag/KubernetesCluster": p.clusterName, "aws:ResourceTag/KubernetesCluster": p.clusterName,
@ -130,8 +130,8 @@ func (p *Policy) AsJSON() (string, error) {
if len(p.clusterTaggedCreateAction) > 0 { if len(p.clusterTaggedCreateAction) > 0 {
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of(p.clusterTaggedCreateAction.List()...), Action: stringorset.Of(sets.List(p.clusterTaggedCreateAction)...),
Resource: stringorslice.String("*"), Resource: stringorset.String("*"),
Condition: Condition{ Condition: Condition{
"StringEquals": map[string]string{ "StringEquals": map[string]string{
"aws:RequestTag/KubernetesCluster": p.clusterName, "aws:RequestTag/KubernetesCluster": p.clusterName,
@ -143,8 +143,8 @@ func (p *Policy) AsJSON() (string, error) {
if p.clusterTaggedCreateAction.Has("ec2:CreateSecurityGroup") { if p.clusterTaggedCreateAction.Has("ec2:CreateSecurityGroup") {
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of("ec2:CreateSecurityGroup"), Action: stringorset.Of("ec2:CreateSecurityGroup"),
Resource: stringorslice.String(fmt.Sprintf("arn:%s:ec2:*:*:vpc/*", p.partition)), Resource: stringorset.String(fmt.Sprintf("arn:%s:ec2:*:*:vpc/*", p.partition)),
}) })
} }
} }
@ -176,8 +176,8 @@ type Condition map[string]interface{}
type Statement struct { type Statement struct {
Effect StatementEffect Effect StatementEffect
Principal Principal Principal Principal
Action stringorslice.StringOrSlice Action stringorset.StringOrSet
Resource stringorslice.StringOrSlice Resource stringorset.StringOrSet
Condition Condition Condition Condition
} }
@ -338,9 +338,9 @@ func NewPolicy(clusterName, partition string) *Policy {
p := &Policy{ p := &Policy{
Version: PolicyDefaultVersion, Version: PolicyDefaultVersion,
clusterName: clusterName, clusterName: clusterName,
unconditionalAction: sets.NewString(), unconditionalAction: sets.New[string](),
clusterTaggedAction: sets.NewString(), clusterTaggedAction: sets.New[string](),
clusterTaggedCreateAction: sets.NewString(), clusterTaggedCreateAction: sets.New[string](),
partition: partition, partition: partition,
} }
return p return p
@ -594,13 +594,13 @@ func (b *PolicyBuilder) AddS3Permissions(p *Policy) (*Policy, error) {
for _, s3Bucket := range s3Buckets.List() { for _, s3Bucket := range s3Buckets.List() {
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of( Action: stringorset.Of(
"s3:GetBucketLocation", "s3:GetBucketLocation",
"s3:GetEncryptionConfiguration", "s3:GetEncryptionConfiguration",
"s3:ListBucket", "s3:ListBucket",
"s3:ListBucketVersions", "s3:ListBucketVersions",
), ),
Resource: stringorslice.Slice([]string{ Resource: stringorset.Set([]string{
fmt.Sprintf("arn:%v:s3:::%v", p.partition, s3Bucket), fmt.Sprintf("arn:%v:s3:::%v", p.partition, s3Bucket),
}), }),
}) })
@ -612,13 +612,13 @@ func (b *PolicyBuilder) AddS3Permissions(p *Policy) (*Policy, error) {
func (b *PolicyBuilder) buildS3WriteStatements(p *Policy, iamS3Path string) { func (b *PolicyBuilder) buildS3WriteStatements(p *Policy, iamS3Path string) {
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{ Action: stringorset.Set([]string{
"s3:GetObject", "s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:PutObject", "s3:PutObject",
}), }),
Resource: stringorslice.Of( Resource: stringorset.Of(
fmt.Sprintf("arn:%v:s3:::%v/*", p.partition, iamS3Path), fmt.Sprintf("arn:%v:s3:::%v/*", p.partition, iamS3Path),
), ),
}) })
@ -640,8 +640,8 @@ func (b *PolicyBuilder) buildS3GetStatements(p *Policy, iamS3Path string) error
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{"s3:Get*"}), Action: stringorset.Set([]string{"s3:Get*"}),
Resource: stringorslice.Of(resources...), Resource: stringorset.Of(resources...),
}) })
} }
return nil return nil
@ -800,10 +800,10 @@ func addEtcdManagerPermissions(p *Policy) {
p.Statement = append(p.Statement, p.Statement = append(p.Statement,
&Statement{ &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of( Action: stringorset.Of(
"ec2:AttachVolume", "ec2:AttachVolume",
), ),
Resource: stringorslice.Slice([]string{"*"}), Resource: stringorset.Set([]string{"*"}),
Condition: Condition{ Condition: Condition{
"StringEquals": map[string]string{ "StringEquals": map[string]string{
"aws:ResourceTag/k8s.io/role/master": "1", "aws:ResourceTag/k8s.io/role/master": "1",
@ -1061,22 +1061,22 @@ func AddDNSControllerPermissions(b *PolicyBuilder, p *Policy) {
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of("route53:ChangeResourceRecordSets", Action: stringorset.Of("route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:ListResourceRecordSets",
"route53:GetHostedZone"), "route53:GetHostedZone"),
Resource: stringorslice.Slice([]string{fmt.Sprintf("arn:%v:route53:::hostedzone/%v", b.Partition, hostedZoneID)}), Resource: stringorset.Set([]string{fmt.Sprintf("arn:%v:route53:::hostedzone/%v", b.Partition, hostedZoneID)}),
}) })
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{"route53:GetChange"}), Action: stringorset.Set([]string{"route53:GetChange"}),
Resource: stringorslice.Slice([]string{fmt.Sprintf("arn:%v:route53:::change/*", b.Partition)}), Resource: stringorset.Set([]string{fmt.Sprintf("arn:%v:route53:::change/*", b.Partition)}),
}) })
wildcard := stringorslice.Slice([]string{"*"}) wildcard := stringorset.Set([]string{"*"})
p.Statement = append(p.Statement, &Statement{ p.Statement = append(p.Statement, &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{"route53:ListHostedZones", "route53:ListTagsForResource"}), Action: stringorset.Set([]string{"route53:ListHostedZones", "route53:ListTagsForResource"}),
Resource: wildcard, Resource: wildcard,
}) })
} }
@ -1169,10 +1169,10 @@ func addAmazonVPCCNIPermissions(p *Policy) {
p.Statement = append(p.Statement, p.Statement = append(p.Statement,
&Statement{ &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{ Action: stringorset.Set([]string{
"ec2:CreateTags", "ec2:CreateTags",
}), }),
Resource: stringorslice.Slice([]string{ Resource: stringorset.Set([]string{
strings.Join([]string{"arn:", p.partition, ":ec2:*:*:network-interface/*"}, ""), strings.Join([]string{"arn:", p.partition, ":ec2:*:*:network-interface/*"}, ""),
}), }),
}, },

12
pkg/model/iam/iam_builder_test.go
View File

@ -26,7 +26,7 @@ import (
"k8s.io/kops/pkg/apis/kops" "k8s.io/kops/pkg/apis/kops"
"k8s.io/kops/pkg/testutils" "k8s.io/kops/pkg/testutils"
"k8s.io/kops/pkg/testutils/golden" "k8s.io/kops/pkg/testutils/golden"
"k8s.io/kops/pkg/util/stringorslice" "k8s.io/kops/pkg/util/stringorset"
"k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi"
) )
@ -38,18 +38,18 @@ func TestRoundTrip(t *testing.T) {
{ {
IAM: &Statement{ IAM: &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of("ec2:DescribeRegions"), Action: stringorset.Of("ec2:DescribeRegions"),
Resource: stringorslice.Of("*"), Resource: stringorset.Of("*"),
}, },
JSON: "{\"Action\":\"ec2:DescribeRegions\",\"Effect\":\"Allow\",\"Resource\":\"*\"}", JSON: "{\"Action\":\"ec2:DescribeRegions\",\"Effect\":\"Allow\",\"Resource\":\"*\"}",
}, },
{ {
IAM: &Statement{ IAM: &Statement{
Effect: StatementEffectDeny, Effect: StatementEffectDeny,
Action: stringorslice.Of("ec2:DescribeRegions", "ec2:DescribeInstances"), Action: stringorset.Of("ec2:DescribeRegions", "ec2:DescribeInstances"),
Resource: stringorslice.Of("a", "b"), Resource: stringorset.Of("a", "b"),
}, },
JSON: "{\"Action\":[\"ec2:DescribeRegions\",\"ec2:DescribeInstances\"],\"Effect\":\"Deny\",\"Resource\":[\"a\",\"b\"]}", JSON: "{\"Action\":[\"ec2:DescribeInstances\",\"ec2:DescribeRegions\"],\"Effect\":\"Deny\",\"Resource\":[\"a\",\"b\"]}",
}, },
{ {
IAM: &Statement{ IAM: &Statement{

8
pkg/model/iam/tests/iam_builder_master_gossip.json
View File

@ -45,8 +45,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -64,8 +64,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
pkg/model/iam/tests/iam_builder_master_gossip_ecr.json
View File

@ -45,8 +45,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -64,8 +64,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
pkg/model/iam/tests/iam_builder_master_strict.json
View File

@ -45,8 +45,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -64,8 +64,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
pkg/model/iam/tests/iam_builder_master_strict_ecr.json
View File

@ -45,8 +45,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -64,8 +64,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

70
pkg/util/stringorslice/stringorslice.go → pkg/util/stringorset/stringorset.go
View File

@ -14,49 +14,58 @@ See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
*/ */
package stringorslice package stringorset
import ( import (
"encoding/json" "encoding/json"
"sort"
"strings" "strings"
"k8s.io/apimachinery/pkg/util/sets"
) )
// StringOrSlice is a type that holds a []string, but marshals to a []string or a string. // StringOrSet is a type that holds a []string, but marshals to a []string or a string.
type StringOrSlice struct { type StringOrSet struct {
values []string values sets.Set[string]
forceEncodeAsArray bool forceEncodeAsArray bool
} }
func (s *StringOrSlice) IsEmpty() bool { func (s *StringOrSet) IsEmpty() bool {
return len(s.values) == 0 return len(s.values) == 0
} }
// Slice will build a value that marshals to a JSON array // Set will build a value that marshals to a JSON array
func Slice(v []string) StringOrSlice { func Set(v []string) StringOrSet {
return StringOrSlice{values: v, forceEncodeAsArray: true} values := sets.Set[string]{}
values.Insert(v...)
return StringOrSet{values: values, forceEncodeAsArray: true}
} }
// Of will build a value that marshals to a JSON array if len(v) > 1, // Of will build a value that marshals to a JSON array if len(v) > 1,
// otherwise to a single string // otherwise to a single string
func Of(v ...string) StringOrSlice { func Of(v ...string) StringOrSet {
if v == nil { if v == nil {
v = []string{} v = []string{}
} }
return StringOrSlice{values: v} values := sets.Set[string]{}
values.Insert(v...)
return StringOrSet{values: values}
} }
// String will build a value that marshals to a single string // String will build a value that marshals to a single string
func String(v string) StringOrSlice { func String(v string) StringOrSet {
return StringOrSlice{values: []string{v}, forceEncodeAsArray: false} return StringOrSet{values: sets.New(v), forceEncodeAsArray: false}
} }
// UnmarshalJSON implements the json.Unmarshaller interface. // UnmarshalJSON implements the json.Unmarshaller interface.
func (s *StringOrSlice) UnmarshalJSON(value []byte) error { func (s *StringOrSet) UnmarshalJSON(value []byte) error {
if value[0] == '[' { if value[0] == '[' {
s.forceEncodeAsArray = true s.forceEncodeAsArray = true
if err := json.Unmarshal(value, &s.values); err != nil { var vals []string
if err := json.Unmarshal(value, &vals); err != nil {
return nil return nil
} }
s.values = sets.New(vals...)
return nil return nil
} }
s.forceEncodeAsArray = false s.forceEncodeAsArray = false
@ -64,46 +73,39 @@ func (s *StringOrSlice) UnmarshalJSON(value []byte) error {
if err := json.Unmarshal(value, &stringValue); err != nil { if err := json.Unmarshal(value, &stringValue); err != nil {
return err return err
} }
s.values = []string{stringValue} s.values = sets.New(stringValue)
return nil return nil
} }
// String returns the string value, or the Itoa of the int value. // String returns the string value, or the Itoa of the int value.
func (s StringOrSlice) String() string { func (s StringOrSet) String() string {
return strings.Join(s.values, ",") return strings.Join(sets.List[string](s.values), ",")
} }
func (v *StringOrSlice) Value() []string { func (v *StringOrSet) Value() []string {
return v.values vals := sets.List[string](v.values)
sort.Strings(vals)
return vals
} }
func (l StringOrSlice) Equal(r StringOrSlice) bool { func (l StringOrSet) Equal(r StringOrSet) bool {
if len(l.values) != len(r.values) { return l.values.Equal(r.values)
return false
}
for i := 0; i < len(l.values); i++ {
if l.values[i] != r.values[i] {
return false
}
}
return true
} }
// MarshalJSON implements the json.Marshaller interface. // MarshalJSON implements the json.Marshaller interface.
func (v StringOrSlice) MarshalJSON() ([]byte, error) { func (v StringOrSet) MarshalJSON() ([]byte, error) {
encodeAsJSONArray := v.forceEncodeAsArray encodeAsJSONArray := v.forceEncodeAsArray
if len(v.values) > 1 { if len(v.values) > 1 {
encodeAsJSONArray = true encodeAsJSONArray = true
} }
values := v.values values := v.Value()
if values == nil { if values == nil {
values = []string{} values = []string{}
} }
if encodeAsJSONArray { if encodeAsJSONArray {
return json.Marshal(values) return json.Marshal(values)
} else if len(v.values) == 1 { } else if len(values) == 1 {
s := v.values[0] return json.Marshal(&values[0])
return json.Marshal(&s)
} else { } else {
return json.Marshal(values) return json.Marshal(values)
} }

12
pkg/util/stringorslice/stringorslice_test.go → pkg/util/stringorset/stringorset_test.go
View File

@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
*/ */
package stringorslice package stringorset
import ( import (
"encoding/json" "encoding/json"
@ -25,7 +25,7 @@ import (
func TestRoundTrip(t *testing.T) { func TestRoundTrip(t *testing.T) {
grid := []struct { grid := []struct {
Value StringOrSlice Value StringOrSet
JSON string JSON string
}{ }{
{ {
@ -37,7 +37,7 @@ func TestRoundTrip(t *testing.T) {
JSON: "\"a\"", JSON: "\"a\"",
}, },
{ {
Value: Slice([]string{"a"}), Value: Set([]string{"a"}),
JSON: "[\"a\"]", JSON: "[\"a\"]",
}, },
{ {
@ -45,7 +45,7 @@ func TestRoundTrip(t *testing.T) {
JSON: "[\"a\",\"b\"]", JSON: "[\"a\",\"b\"]",
}, },
{ {
Value: Slice([]string{"a", "b"}), Value: Set([]string{"a", "b"}),
JSON: "[\"a\",\"b\"]", JSON: "[\"a\",\"b\"]",
}, },
{ {
@ -53,7 +53,7 @@ func TestRoundTrip(t *testing.T) {
JSON: "[]", JSON: "[]",
}, },
{ {
Value: Slice(nil), Value: Set(nil),
JSON: "[]", JSON: "[]",
}, },
} }
@ -69,7 +69,7 @@ func TestRoundTrip(t *testing.T) {
t.Errorf("Unexpected JSON encoding. Actual=%q, Expected=%q", string(actualJSON), g.JSON) t.Errorf("Unexpected JSON encoding. Actual=%q, Expected=%q", string(actualJSON), g.JSON)
} }
parsed := &StringOrSlice{} parsed := &StringOrSet{}
err = json.Unmarshal([]byte(g.JSON), parsed) err = json.Unmarshal([]byte(g.JSON), parsed)
if err != nil { if err != nil {
t.Errorf("error decoding StringOrSlice %s to json: %v", g.JSON, err) t.Errorf("error decoding StringOrSlice %s to json: %v", g.JSON, err)

16
tests/integration/update_cluster/additionalobjects/data/aws_iam_role_policy_masters.additionalobjects.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/apiservernodes/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

4
tests/integration/update_cluster/aws-lb-controller/data/aws_iam_role_policy_dns-controller.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/aws-lb-controller/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/aws-lb-controller/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

16
tests/integration/update_cluster/bastionadditional_user-data/data/aws_iam_role_policy_masters.bastionuserdata.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/cluster-autoscaler-priority-expander-custom/data/aws_iam_role_policy_masters.cas-priority-expander-custom.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/cluster-autoscaler-priority-expander/data/aws_iam_role_policy_masters.cas-priority-expander.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/complex/data/aws_iam_role_policy_masters.complex.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/compress/data/aws_iam_role_policy_masters.compress.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/containerd-custom/data/aws_iam_role_policy_masters.containerd.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/containerd/data/aws_iam_role_policy_masters.containerd.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/digit/data/aws_iam_role_policy_masters.123.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/existing_sg/data/aws_iam_role_policy_masters.existingsg.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/external_dns/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/external_dns_irsa/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

4
tests/integration/update_cluster/external_dns_irsa/data/aws_iam_role_policy_external-dns.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/external_dns_irsa/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

16
tests/integration/update_cluster/externallb/data/aws_iam_role_policy_masters.externallb.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/externalpolicies/data/aws_iam_role_policy_masters.externalpolicies.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/ha/data/aws_iam_role_policy_masters.ha.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/irsa/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

4
tests/integration/update_cluster/karpenter/data/aws_iam_role_policy_dns-controller.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/karpenter/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/karpenter/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

4
tests/integration/update_cluster/many-addons-ccm-irsa/data/aws_iam_role_policy_dns-controller.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/many-addons-ccm-irsa/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/many-addons-ccm-irsa/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

4
tests/integration/update_cluster/many-addons-ccm-irsa24/data/aws_iam_role_policy_dns-controller.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/many-addons-ccm-irsa24/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/many-addons-ccm-irsa24/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

4
tests/integration/update_cluster/many-addons-ccm-irsa25/data/aws_iam_role_policy_dns-controller.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/many-addons-ccm-irsa25/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/many-addons-ccm-irsa25/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

4
tests/integration/update_cluster/many-addons-ccm-irsa26/data/aws_iam_role_policy_dns-controller.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/many-addons-ccm-irsa26/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/many-addons-ccm-irsa26/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

16
tests/integration/update_cluster/many-addons-ccm/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/many-addons/data/aws_iam_role_policy_masters.many-addons.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-1.24/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-1.25/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-1.26/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-1.27/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-1.28/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-1.29/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-aws/data/aws_iam_role_policy_masters.minimal-aws.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

12
tests/integration/update_cluster/minimal-dns-none/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -77,8 +77,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -96,8 +96,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-etcd/data/aws_iam_role_policy_masters.minimal-etcd.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-gp3/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-ipv6-calico/data/aws_iam_role_policy_masters.minimal-ipv6.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-ipv6-cilium/data/aws_iam_role_policy_masters.minimal-ipv6.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-ipv6-no-subnet-prefix/data/aws_iam_role_policy_masters.minimal-ipv6.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-ipv6/data/aws_iam_role_policy_masters.minimal-ipv6.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-longclustername/data/aws_iam_role_policy_masters.this.is.truly.a.really.really.long.cluster-name.m-kaamp9_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/minimal-warmpool/data/aws_iam_role_policy_masters.minimal-warmpool.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

12
tests/integration/update_cluster/minimal_gossip/data/aws_iam_role_policy_masters.minimal.k8s.local_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -77,8 +77,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -96,8 +96,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/minimal_gossip_irsa/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.k8s.local_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

4
tests/integration/update_cluster/minimal_gossip_irsa/data/aws_iam_role_policy_masters.minimal.k8s.local_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",

16
tests/integration/update_cluster/mixed_instances/data/aws_iam_role_policy_masters.mixedinstances.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/mixed_instances_spot/data/aws_iam_role_policy_masters.mixedinstances.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

4
tests/integration/update_cluster/nth-imds-processor-irsa/data/aws_iam_role_policy_dns-controller.kube-system.sa.nthimdsprocessor.longcluste-e6uuer_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/nth-imds-processor-irsa/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.nthimdsprocessor.lon-kfj86l_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/nth-imds-processor-irsa/data/aws_iam_role_policy_masters.nthimdsprocessor.longclustername.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

16
tests/integration/update_cluster/nth-imds-processor/data/aws_iam_role_policy_masters.nthimdsprocessor.longclustername.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/nvidia/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/private-shared-ip/data/aws_iam_role_policy_masters.private-shared-ip.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/private-shared-subnet/data/aws_iam_role_policy_masters.private-shared-subnet.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatecalico/data/aws_iam_role_policy_masters.privatecalico.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatecanal/data/aws_iam_role_policy_masters.privatecanal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatecilium-eni/data/aws_iam_role_policy_masters.privatecilium.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatecilium/data/aws_iam_role_policy_masters.privatecilium.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatecilium2/data/aws_iam_role_policy_masters.privatecilium.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

18
tests/integration/update_cluster/privateciliumadvanced/data/aws_iam_role_policy_masters.privateciliumadvanced.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -42,9 +42,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -77,8 +77,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -117,8 +117,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -136,8 +136,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatedns1/data/aws_iam_role_policy_masters.privatedns1.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatedns2/data/aws_iam_role_policy_masters.privatedns2.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privateflannel/data/aws_iam_role_policy_masters.privateflannel.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/privatekopeio/data/aws_iam_role_policy_masters.privatekopeio.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

4
tests/integration/update_cluster/public-jwks-apiserver/data/aws_iam_role_policy_dns-controller.kube-system.sa.minimal.example.com_policy
View File

@ -3,8 +3,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

8
tests/integration/update_cluster/public-jwks-apiserver/data/aws_iam_role_policy_ebs-csi-controller-sa.kube-system.sa.minimal.example.com_policy
View File

@ -13,8 +13,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -32,8 +32,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

8
tests/integration/update_cluster/public-jwks-apiserver/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [

16
tests/integration/update_cluster/shared_subnet/data/aws_iam_role_policy_masters.sharedsubnet.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/shared_vpc/data/aws_iam_role_policy_masters.sharedvpc.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/shared_vpc_ipv6/data/aws_iam_role_policy_masters.minimal-ipv6.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/unmanaged/data/aws_iam_role_policy_masters.unmanaged.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {

16
tests/integration/update_cluster/vfs-said/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -22,9 +22,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -32,9 +32,9 @@
}, },
{ {
"Action": [ "Action": [
"s3:GetObject",
"s3:DeleteObject", "s3:DeleteObject",
"s3:DeleteObjectVersion", "s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject" "s3:PutObject"
], ],
"Effect": "Allow", "Effect": "Allow",
@ -67,8 +67,8 @@
{ {
"Action": [ "Action": [
"route53:ChangeResourceRecordSets", "route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets", "route53:GetHostedZone",
"route53:GetHostedZone" "route53:ListResourceRecordSets"
], ],
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
@ -107,8 +107,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {
@ -126,8 +126,8 @@
}, },
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"arn:aws-test:ec2:*:*:volume/*", "arn:aws-test:ec2:*:*:snapshot/*",
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:volume/*"
] ]
}, },
{ {