kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix permissions required for NTH Queue Processor

This commit is contained in:
Jason Haugen 2021-04-23 13:10:29 -05:00
parent 7d936548ca
commit c2a9bdc515
3 changed files with 35 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
docs/addons.md
View File

@ -143,20 +143,27 @@ The kOps CLI requires additional IAM permissions to manage the requisite EventBr
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"events:PutEvents",
"events:PutTargets",
"sqs:CreateQueue",
"sqs:ListQueues",
"sqs:DeleteQueue",
],
"Resource": "*"
}
]
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"events:DeleteRule",
"events:ListRules",
"events:ListTargetsByRule",
"events:ListTagsForResource",
"events:PutEvents",
"events:PutTargets",
"events:RemoveTargets",
"sqs:CreateQueue",
"sqs:DeleteQueue",
"sqs:GetQueueAttributes",
"sqs:ListQueues",
"sqs:ListQueueTags"
],
"Resource": "*"
}
]
}
```

2
docs/releases/1.21-NOTES.md
View File

@ -21,7 +21,7 @@ In 1.21, this feature is behind a feature flag as node role name, labels, taints
# Required Actions
* To support [Node Termination Handler's Queue Process mode](/addons/#node-termination-handler), AWS cluster deletion now requires the kops CLI have `sqs:ListQueues` permission regardless of whether or not the addon is used.
* To support [Node Termination Handler's Queue Process mode](/addons/#node-termination-handler), AWS cluster deletion now requires the kops CLI have `sqs:ListQueues` and `events:ListRules` permissions regardless of whether or not the addon is used.
# Deprecations

26
pkg/resources/aws/eventbridge.go
View File

@ -48,19 +48,19 @@ func DeleteEventBridgeRule(cloud fi.Cloud, r *resources.Resource) error {
if err != nil {
return fmt.Errorf("error listing targets for EventBridge rule %q: %v", r.Name, err)
}
var ids []*string
for _, target := range targets.Targets {
ids = append(ids, target.Id)
}
klog.V(2).Infof("Removing EventBridge Targets for rule %q", r.Name)
_, err = c.EventBridge().RemoveTargets(&eventbridge.RemoveTargetsInput{
Ids: ids,
Rule: aws.String(r.Name),
})
if err != nil {
return fmt.Errorf("error removing targets for EventBridge rule %q: %v", r.Name, err)
if len(targets.Targets) > 0 {
var ids []*string
for _, target := range targets.Targets {
ids = append(ids, target.Id)
}
klog.V(2).Infof("Removing EventBridge Targets for rule %q", r.Name)
_, err = c.EventBridge().RemoveTargets(&eventbridge.RemoveTargetsInput{
Ids: ids,
Rule: aws.String(r.Name),
})
if err != nil {
return fmt.Errorf("error removing targets for EventBridge rule %q: %v", r.Name, err)
}
}
klog.V(2).Infof("Deleting EventBridge rule %q", r.Name)