kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

IRSA support for CCM 

Update pkg/model/components/addonmanifests/awscloudcontroller/iam.go

Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
This commit is contained in:
Ole Markus With 2021-06-19 22:11:27 +02:00
parent 2042912a5b
commit ce86d851aa
63 changed files with 2411 additions and 1824 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/model/components/addonmanifests/BUILD.bazel generated
View File

@ -11,6 +11,7 @@ go_library(
"//pkg/featureflag:go_default_library", "//pkg/featureflag:go_default_library",
"//pkg/kubemanifest:go_default_library", "//pkg/kubemanifest:go_default_library",
"//pkg/model:go_default_library", "//pkg/model:go_default_library",
"//pkg/model/components/addonmanifests/awscloudcontrollermanager:go_default_library",
"//pkg/model/components/addonmanifests/awsebscsidriver:go_default_library", "//pkg/model/components/addonmanifests/awsebscsidriver:go_default_library",
"//pkg/model/components/addonmanifests/awsloadbalancercontroller:go_default_library", "//pkg/model/components/addonmanifests/awsloadbalancercontroller:go_default_library",
"//pkg/model/components/addonmanifests/clusterautoscaler:go_default_library", "//pkg/model/components/addonmanifests/clusterautoscaler:go_default_library",

12
pkg/model/components/addonmanifests/awscloudcontrollermanager/BUILD.bazel generated Normal file
View File

@ -0,0 +1,12 @@
load("@io_bazel_rules_go//go:def.bzl", "go_library")
go_library(
name = "go_default_library",
srcs = ["iam.go"],
importpath = "k8s.io/kops/pkg/model/components/addonmanifests/awscloudcontrollermanager",
visibility = ["//visibility:public"],
deps = [
"//pkg/model/iam:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
],
)

46
pkg/model/components/addonmanifests/awscloudcontrollermanager/iam.go Normal file
View File

@ -0,0 +1,46 @@
/*
Copyright 2020 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package awscloudcontrollermanager
import (
"k8s.io/apimachinery/pkg/types"
"k8s.io/kops/pkg/model/iam"
)
// ServiceAccount represents the service-account used by the AWS Cloud Controller Manager.
// It implements iam.Subject to get AWS IAM permissions.
type ServiceAccount struct {
}
var _ iam.Subject = &ServiceAccount{}
// BuildAWSPolicy generates a custom policy for a ServiceAccount IAM role.
func (r *ServiceAccount) BuildAWSPolicy(b *iam.PolicyBuilder) (*iam.Policy, error) {
clusterName := b.Cluster.ObjectMeta.Name
p := iam.NewPolicy(clusterName)
iam.AddCCMPermissions(p, b.Cluster.Spec.Networking.Kubenet != nil)
iam.AddLegacyCCMPermissions(p)
return p, nil
}
// ServiceAccount returns the kubernetes service account used.
func (r *ServiceAccount) ServiceAccount() (types.NamespacedName, bool) {
return types.NamespacedName{
Namespace: "kube-system",
Name: "aws-cloud-controller-manager",
}, true
}

3
pkg/model/components/addonmanifests/remap.go
View File

@ -28,6 +28,7 @@ import (
"k8s.io/kops/pkg/featureflag" "k8s.io/kops/pkg/featureflag"
"k8s.io/kops/pkg/kubemanifest" "k8s.io/kops/pkg/kubemanifest"
"k8s.io/kops/pkg/model" "k8s.io/kops/pkg/model"
"k8s.io/kops/pkg/model/components/addonmanifests/awscloudcontrollermanager"
"k8s.io/kops/pkg/model/components/addonmanifests/awsebscsidriver" "k8s.io/kops/pkg/model/components/addonmanifests/awsebscsidriver"
"k8s.io/kops/pkg/model/components/addonmanifests/awsloadbalancercontroller" "k8s.io/kops/pkg/model/components/addonmanifests/awsloadbalancercontroller"
"k8s.io/kops/pkg/model/components/addonmanifests/clusterautoscaler" "k8s.io/kops/pkg/model/components/addonmanifests/clusterautoscaler"
@ -123,6 +124,8 @@ func getWellknownServiceAccount(name string) iam.Subject {
return &awsebscsidriver.ServiceAccount{} return &awsebscsidriver.ServiceAccount{}
case "aws-node-termination-handler": case "aws-node-termination-handler":
return &nodeterminationhandler.ServiceAccount{} return &nodeterminationhandler.ServiceAccount{}
case "aws-cloud-controller-manager":
return &awscloudcontrollermanager.ServiceAccount{}
default: default:
return nil return nil
} }

24
pkg/model/iam/iam_builder.go
View File

@ -315,8 +315,6 @@ func (r *NodeRoleMaster) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
addEtcdManagerPermissions(p) addEtcdManagerPermissions(p)
addNodeupPermissions(p, false) addNodeupPermissions(p, false)
AddCCMPermissions(p, clusterName, b.Cluster.Spec.Networking.Kubenet != nil)
AddLegacyCCMPermissions(p)
var err error var err error
if p, err = b.AddS3Permissions(p); err != nil { if p, err = b.AddS3Permissions(p); err != nil {
@ -330,11 +328,22 @@ func (r *NodeRoleMaster) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
// Protokube needs dns-controller permissions in instance role even if UseServiceAccountIAM. // Protokube needs dns-controller permissions in instance role even if UseServiceAccountIAM.
AddDNSControllerPermissions(b, p) AddDNSControllerPermissions(b, p)
// If cluster does not use external CCM, the master IAM Role needs CCM permissions
if b.Cluster.Spec.ExternalCloudControllerManager == nil {
AddCCMPermissions(p, b.Cluster.Spec.Networking.Kubenet != nil)
AddLegacyCCMPermissions(p)
}
if !b.UseServiceAccountIAM { if !b.UseServiceAccountIAM {
esc := b.Cluster.Spec.SnapshotController != nil && esc := b.Cluster.Spec.SnapshotController != nil &&
fi.BoolValue(b.Cluster.Spec.SnapshotController.Enabled) fi.BoolValue(b.Cluster.Spec.SnapshotController.Enabled)
AddAWSEBSCSIDriverPermissions(p, esc) AddAWSEBSCSIDriverPermissions(p, esc)
if b.Cluster.Spec.ExternalCloudControllerManager != nil {
AddCCMPermissions(p, b.Cluster.Spec.Networking.Kubenet != nil)
AddLegacyCCMPermissions(p)
}
if b.Cluster.Spec.AWSLoadBalancerController != nil && fi.BoolValue(b.Cluster.Spec.AWSLoadBalancerController.Enabled) { if b.Cluster.Spec.AWSLoadBalancerController != nil && fi.BoolValue(b.Cluster.Spec.AWSLoadBalancerController.Enabled) {
AddAWSLoadbalancerControllerPermissions(p) AddAWSLoadbalancerControllerPermissions(p)
} }
@ -764,6 +773,13 @@ func addEtcdManagerPermissions(p *Policy) {
) )
p.Statement = append(p.Statement, p.Statement = append(p.Statement,
&Statement{
Effect: StatementEffectAllow,
Action: stringorslice.Slice([]string{
"ec2:DescribeVolumes", // aws.go
}),
Resource: resource,
},
&Statement{ &Statement{
Effect: StatementEffectAllow, Effect: StatementEffectAllow,
Action: stringorslice.Of( Action: stringorslice.Of(
@ -788,7 +804,7 @@ func AddLegacyCCMPermissions(p *Policy) {
) )
} }
func AddCCMPermissions(p *Policy, clusterName string, cloudRoutes bool) { func AddCCMPermissions(p *Policy, cloudRoutes bool) {
resource := stringorslice.Slice([]string{"*"}) resource := stringorslice.Slice([]string{"*"})
p.unconditionalAction.Insert( p.unconditionalAction.Insert(
@ -877,7 +893,7 @@ func AddCCMPermissions(p *Policy, clusterName string, cloudRoutes bool) {
Condition: Condition{ Condition: Condition{
"StringEquals": map[string]string{ "StringEquals": map[string]string{
"aws:RequestTag/KubernetesCluster": clusterName, "aws:RequestTag/KubernetesCluster": p.clusterName,
}, },
}, },
}, },

47
pkg/model/iam/tests/iam_builder_master_strict.json
View File

@ -1,5 +1,14 @@
{ {
"Statement": [ "Statement": [
{
"Action": [
"ec2:DescribeVolumes"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": "ec2:AttachVolume", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
@ -13,6 +22,25 @@
"*" "*"
] ]
}, },
{
"Action": [
"s3:Get*"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::kops-tests/iam-builder-test.k8s.local/*"
},
{
"Action": [
"s3:GetBucketLocation",
"s3:GetEncryptionConfiguration",
"s3:ListBucket",
"s3:ListBucketVersions"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::kops-tests"
]
},
{ {
"Action": "ec2:CreateTags", "Action": "ec2:CreateTags",
"Condition": { "Condition": {
@ -49,25 +77,6 @@
"*" "*"
] ]
}, },
{
"Action": [
"s3:Get*"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::kops-tests/iam-builder-test.k8s.local/*"
},
{
"Action": [
"s3:GetBucketLocation",
"s3:GetEncryptionConfiguration",
"s3:ListBucket",
"s3:ListBucketVersions"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::kops-tests"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

47
pkg/model/iam/tests/iam_builder_master_strict_ecr.json
View File

@ -1,5 +1,14 @@
{ {
"Statement": [ "Statement": [
{
"Action": [
"ec2:DescribeVolumes"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": "ec2:AttachVolume", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
@ -13,6 +22,25 @@
"*" "*"
] ]
}, },
{
"Action": [
"s3:Get*"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::kops-tests/iam-builder-test.k8s.local/*"
},
{
"Action": [
"s3:GetBucketLocation",
"s3:GetEncryptionConfiguration",
"s3:ListBucket",
"s3:ListBucketVersions"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::kops-tests"
]
},
{ {
"Action": "ec2:CreateTags", "Action": "ec2:CreateTags",
"Condition": { "Condition": {
@ -49,25 +77,6 @@
"*" "*"
] ]
}, },
{
"Action": [
"s3:Get*"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::kops-tests/iam-builder-test.k8s.local/*"
},
{
"Action": [
"s3:GetBucketLocation",
"s3:GetEncryptionConfiguration",
"s3:ListBucket",
"s3:ListBucketVersions"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::kops-tests"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/apiservernodes/cloudformation.json
View File

@ -1217,47 +1217,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1345,6 +1318,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/aws-lb-controller/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingGroups",

75
tests/integration/update_cluster/bastionadditional_user-data/data/aws_iam_role_policy_masters.bastionuserdata.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "bastionuserdata.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "bastionuserdata.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "bastionuserdata.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "bastionuserdata.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/complex/cloudformation.json
View File

@ -1567,47 +1567,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "complex.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "complex.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "complex.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1695,6 +1668,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "complex.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/complex/data/aws_iam_role_policy_masters.complex.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "complex.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "complex.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "complex.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "complex.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/compress/data/aws_iam_role_policy_masters.compress.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "compress.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "compress.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "compress.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "compress.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/containerd-custom/cloudformation.json
View File

@ -953,47 +953,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "containerd.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "containerd.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "containerd.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1081,6 +1054,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "containerd.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/containerd/cloudformation.json
View File

@ -953,47 +953,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "containerd.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "containerd.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "containerd.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1081,6 +1054,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "containerd.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/docker-custom/cloudformation.json
View File

@ -953,47 +953,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "docker.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "docker.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "docker.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1081,6 +1054,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "docker.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/existing_sg/data/aws_iam_role_policy_masters.existingsg.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "existingsg.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "existingsg.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "existingsg.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "existingsg.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/externallb/cloudformation.json
View File

@ -969,47 +969,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "externallb.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "externallb.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "externallb.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1097,6 +1070,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "externallb.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/externallb/data/aws_iam_role_policy_masters.externallb.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "externallb.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "externallb.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "externallb.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "externallb.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/externalpolicies/data/aws_iam_role_policy_masters.externalpolicies.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "externalpolicies.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "externalpolicies.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "externalpolicies.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "externalpolicies.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/ha/data/aws_iam_role_policy_masters.ha.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "ha.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "ha.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "ha.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "ha.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/irsa/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/many-addons/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal-etcd/cloudformation.json
View File

@ -953,47 +953,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal-etcd.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal-etcd.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-etcd.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1081,6 +1054,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-etcd.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal-gp3/cloudformation.json
View File

@ -949,47 +949,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1077,6 +1050,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal-gp3/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal-ipv6/cloudformation.json
View File

@ -1130,47 +1130,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal-ipv6.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal-ipv6.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-ipv6.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1258,6 +1231,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-ipv6.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal-ipv6/data/aws_iam_role_policy_masters.minimal-ipv6.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal-ipv6.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal-ipv6.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-ipv6.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-ipv6.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal-json/data/aws_iam_role_policy_masters.minimal-json.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal-json.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal-json.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-json.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-json.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal-warmpool/data/aws_iam_role_policy_masters.minimal-warmpool.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal-warmpool.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal-warmpool.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-warmpool.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal-warmpool.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal/cloudformation.json
View File

@ -953,47 +953,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1081,6 +1054,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/minimal_gossip/data/aws_iam_role_policy_masters.minimal.k8s.local_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.k8s.local",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.k8s.local",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.k8s.local"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -100,6 +73,42 @@
"arn:aws:s3:::placeholder-write-bucket" "arn:aws:s3:::placeholder-write-bucket"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.k8s.local"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/mixed_instances/cloudformation.json
View File

@ -1672,47 +1672,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1800,6 +1773,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/mixed_instances/data/aws_iam_role_policy_masters.mixedinstances.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/mixed_instances_spot/cloudformation.json
View File

@ -1673,47 +1673,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1801,6 +1774,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/mixed_instances_spot/data/aws_iam_role_policy_masters.mixedinstances.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "mixedinstances.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "mixedinstances.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/nth_sqs_resources/cloudformation.json
View File

@ -1063,47 +1063,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "nthsqsresources.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "nthsqsresources.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "nthsqsresources.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1191,6 +1164,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "nthsqsresources.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/nth_sqs_resources/data/aws_iam_role_policy_masters.nthsqsresources.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "nthsqsresources.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "nthsqsresources.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "nthsqsresources.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "nthsqsresources.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/private-shared-ip/cloudformation.json
View File

@ -1469,47 +1469,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "private-shared-ip.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "private-shared-ip.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "private-shared-ip.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1597,6 +1570,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "private-shared-ip.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/private-shared-ip/data/aws_iam_role_policy_masters.private-shared-ip.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "private-shared-ip.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "private-shared-ip.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "private-shared-ip.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "private-shared-ip.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/private-shared-subnet/data/aws_iam_role_policy_masters.private-shared-subnet.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "private-shared-subnet.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "private-shared-subnet.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "private-shared-subnet.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "private-shared-subnet.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatecalico/cloudformation.json
View File

@ -1625,47 +1625,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatecalico.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatecalico.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecalico.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1753,6 +1726,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecalico.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatecalico/data/aws_iam_role_policy_masters.privatecalico.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatecalico.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatecalico.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecalico.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecalico.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatecanal/data/aws_iam_role_policy_masters.privatecanal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatecanal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatecanal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecanal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecanal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatecilium/cloudformation.json
View File

@ -1611,47 +1611,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1739,6 +1712,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatecilium/data/aws_iam_role_policy_masters.privatecilium.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatecilium2/cloudformation.json
View File

@ -1611,47 +1611,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1739,6 +1712,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatecilium2/data/aws_iam_role_policy_masters.privatecilium.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatecilium.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatecilium.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privateciliumadvanced/cloudformation.json
View File

@ -1644,47 +1644,20 @@
"PolicyDocument": { "PolicyDocument": {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privateciliumadvanced.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privateciliumadvanced.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateciliumadvanced.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -1782,6 +1755,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateciliumadvanced.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privateciliumadvanced/data/aws_iam_role_policy_masters.privateciliumadvanced.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privateciliumadvanced.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privateciliumadvanced.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateciliumadvanced.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -139,6 +112,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateciliumadvanced.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatedns1/data/aws_iam_role_policy_masters.privatedns1.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatedns1.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatedns1.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatedns1.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatedns1.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatedns2/data/aws_iam_role_policy_masters.privatedns2.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatedns2.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatedns2.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatedns2.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatedns2.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privateflannel/data/aws_iam_role_policy_masters.privateflannel.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privateflannel.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privateflannel.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateflannel.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateflannel.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privatekopeio/data/aws_iam_role_policy_masters.privatekopeio.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privatekopeio.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privatekopeio.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatekopeio.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privatekopeio.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/privateweave/data/aws_iam_role_policy_masters.privateweave.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "privateweave.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "privateweave.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateweave.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "privateweave.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/public-jwks-apiserver/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingGroups",

75
tests/integration/update_cluster/shared_subnet/data/aws_iam_role_policy_masters.sharedsubnet.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "sharedsubnet.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "sharedsubnet.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "sharedsubnet.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "sharedsubnet.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/shared_vpc/data/aws_iam_role_policy_masters.sharedvpc.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "sharedvpc.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "sharedvpc.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "sharedvpc.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "sharedvpc.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/unmanaged/data/aws_iam_role_policy_masters.unmanaged.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "unmanaged.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "unmanaged.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "unmanaged.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "unmanaged.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

75
tests/integration/update_cluster/vfs-said/data/aws_iam_role_policy_masters.minimal.example.com_policy
View File

@ -1,47 +1,20 @@
{ {
"Statement": [ "Statement": [
{ {
"Action": "ec2:AttachVolume", "Action": [
"Condition": { "ec2:DescribeVolumes"
"StringEquals": { ],
"aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"aws:ResourceTag/k8s.io/role/master": "1"
}
},
"Effect": "Allow", "Effect": "Allow",
"Resource": [ "Resource": [
"*" "*"
] ]
}, },
{ {
"Action": "ec2:CreateTags", "Action": "ec2:AttachVolume",
"Condition": { "Condition": {
"StringEquals": { "StringEquals": {
"ec2:CreateAction": [ "aws:ResourceTag/KubernetesCluster": "minimal.example.com",
"CreateVolume", "aws:ResourceTag/k8s.io/role/master": "1"
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
} }
}, },
"Effect": "Allow", "Effect": "Allow",
@ -129,6 +102,42 @@
"*" "*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:CreateLoadBalancerListeners",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": [
"*"
]
},
{ {
"Action": [ "Action": [
"ec2:CreateVolume" "ec2:CreateVolume"

1
upup/pkg/fi/cloudup/bootstrapchannelbuilder/BUILD.bazel generated
View File

@ -17,6 +17,7 @@ go_library(
"//pkg/model:go_default_library", "//pkg/model:go_default_library",
"//pkg/model/awsmodel:go_default_library", "//pkg/model/awsmodel:go_default_library",
"//pkg/model/components/addonmanifests:go_default_library", "//pkg/model/components/addonmanifests:go_default_library",
"//pkg/model/components/addonmanifests/awscloudcontrollermanager:go_default_library",
"//pkg/model/components/addonmanifests/awsebscsidriver:go_default_library", "//pkg/model/components/addonmanifests/awsebscsidriver:go_default_library",
"//pkg/model/components/addonmanifests/awsloadbalancercontroller:go_default_library", "//pkg/model/components/addonmanifests/awsloadbalancercontroller:go_default_library",
"//pkg/model/components/addonmanifests/clusterautoscaler:go_default_library", "//pkg/model/components/addonmanifests/clusterautoscaler:go_default_library",

4
upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go
View File

@ -29,6 +29,7 @@ import (
"k8s.io/kops/pkg/model" "k8s.io/kops/pkg/model"
"k8s.io/kops/pkg/model/awsmodel" "k8s.io/kops/pkg/model/awsmodel"
"k8s.io/kops/pkg/model/components/addonmanifests" "k8s.io/kops/pkg/model/components/addonmanifests"
"k8s.io/kops/pkg/model/components/addonmanifests/awscloudcontrollermanager"
"k8s.io/kops/pkg/model/components/addonmanifests/awsebscsidriver" "k8s.io/kops/pkg/model/components/addonmanifests/awsebscsidriver"
"k8s.io/kops/pkg/model/components/addonmanifests/awsloadbalancercontroller" "k8s.io/kops/pkg/model/components/addonmanifests/awsloadbalancercontroller"
"k8s.io/kops/pkg/model/components/addonmanifests/clusterautoscaler" "k8s.io/kops/pkg/model/components/addonmanifests/clusterautoscaler"
@ -905,6 +906,9 @@ func (b *BootstrapChannelBuilder) buildAddons(c *fi.ModelBuilderContext) (*chann
Id: id, Id: id,
}) })
} }
if b.UseServiceAccountIAM() {
serviceAccountRoles = append(serviceAccountRoles, &awscloudcontrollermanager.ServiceAccount{})
}
} }
if b.Cluster.Spec.CloudConfig != nil && b.Cluster.Spec.CloudConfig.AWSEBSCSIDriver != nil && fi.BoolValue(b.Cluster.Spec.CloudConfig.AWSEBSCSIDriver.Enabled) { if b.Cluster.Spec.CloudConfig != nil && b.Cluster.Spec.CloudConfig.AWSEBSCSIDriver != nil && fi.BoolValue(b.Cluster.Spec.CloudConfig.AWSEBSCSIDriver.Enabled) {
key := "aws-ebs-csi-driver.addons.k8s.io" key := "aws-ebs-csi-driver.addons.k8s.io"