kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add version logic to UseServiceAccountIAM 

Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
This commit is contained in:
Justin Santa Barbara 2020-09-08 10:32:28 -04:00 committed by Justin SB
parent a61ecf4c58
commit d8895c57ec
3 changed files with 14 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/model/context.go
View File

@ -411,5 +411,5 @@ func (m *KopsModelContext) NodePortRange() (utilnet.PortRange, error) {
// UseServiceAccountIAM returns true if we are using service-account bound IAM roles. // UseServiceAccountIAM returns true if we are using service-account bound IAM roles.
func (m *KopsModelContext) UseServiceAccountIAM() bool { func (m *KopsModelContext) UseServiceAccountIAM() bool {
return featureflag.UseServiceAccountIAM.Enabled() return featureflag.UseServiceAccountIAM.Enabled() && m.IsKubernetesGTE("1.12")
} }

7
pkg/model/iam.go
View File

@ -157,9 +157,10 @@ func (b *IAMModelBuilder) buildIAMRole(role iam.Subject, iamName string, c *fi.M
func (b *IAMModelBuilder) buildIAMRolePolicy(role iam.Subject, iamName string, iamRole *awstasks.IAMRole, c *fi.ModelBuilderContext) error { func (b *IAMModelBuilder) buildIAMRolePolicy(role iam.Subject, iamName string, iamRole *awstasks.IAMRole, c *fi.ModelBuilderContext) error {
iamPolicy := &iam.PolicyResource{ iamPolicy := &iam.PolicyResource{
Builder: &iam.PolicyBuilder{ Builder: &iam.PolicyBuilder{
Cluster: b.Cluster, Cluster: b.Cluster,
Role: role, Role: role,
Region: b.Region, Region: b.Region,
UseServiceAccountIAM: b.UseServiceAccountIAM(),
}, },
} }

23
pkg/model/iam/iam_builder.go
View File

@ -37,7 +37,6 @@ import (
"k8s.io/klog/v2" "k8s.io/klog/v2"
"k8s.io/kops/pkg/apis/kops" "k8s.io/kops/pkg/apis/kops"
"k8s.io/kops/pkg/apis/kops/model" "k8s.io/kops/pkg/apis/kops/model"
"k8s.io/kops/pkg/featureflag"
"k8s.io/kops/pkg/util/stringorslice" "k8s.io/kops/pkg/util/stringorslice"
"k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi"
"k8s.io/kops/upup/pkg/fi/cloudup/awstasks" "k8s.io/kops/upup/pkg/fi/cloudup/awstasks"
@ -107,12 +106,13 @@ func (l *Statement) Equal(r *Statement) bool {
// PolicyBuilder struct defines all valid fields to be used when building the // PolicyBuilder struct defines all valid fields to be used when building the
// AWS IAM policy document for a given instance group role. // AWS IAM policy document for a given instance group role.
type PolicyBuilder struct { type PolicyBuilder struct {
Cluster *kops.Cluster Cluster *kops.Cluster
HostedZoneID string HostedZoneID string
KMSKeys []string KMSKeys []string
Region string Region string
ResourceARN *string ResourceARN *string
Role Subject Role Subject
UseServiceAccountIAM bool
} }
// BuildAWSPolicy builds a set of IAM policy statements based on the // BuildAWSPolicy builds a set of IAM policy statements based on the
@ -157,7 +157,7 @@ func (r *NodeRoleMaster) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
addKMSIAMPolicies(p, stringorslice.Slice(b.KMSKeys), b.Cluster.Spec.IAM.Legacy) addKMSIAMPolicies(p, stringorslice.Slice(b.KMSKeys), b.Cluster.Spec.IAM.Legacy)
} }
if !b.UseServiceAccountIAM() { if !b.UseServiceAccountIAM {
if b.Cluster.Spec.IAM.Legacy { if b.Cluster.Spec.IAM.Legacy {
addLegacyDNSControllerPermissions(b, p) addLegacyDNSControllerPermissions(b, p)
} }
@ -198,7 +198,7 @@ func (r *NodeRoleNode) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
return nil, fmt.Errorf("failed to generate AWS IAM S3 access statements: %v", err) return nil, fmt.Errorf("failed to generate AWS IAM S3 access statements: %v", err)
} }
if !b.UseServiceAccountIAM() && b.Cluster.Spec.IAM.Legacy { if !b.UseServiceAccountIAM && b.Cluster.Spec.IAM.Legacy {
addLegacyDNSControllerPermissions(b, p) addLegacyDNSControllerPermissions(b, p)
AddDNSControllerPermissions(b, p) AddDNSControllerPermissions(b, p)
} }
@ -572,11 +572,6 @@ func addECRPermissions(p *Policy) {
}) })
} }
// UseServiceAccountIAM returns true if we are using service-account bound IAM roles.
func (b *PolicyBuilder) UseServiceAccountIAM() bool {
return featureflag.UseServiceAccountIAM.Enabled()
}
// addLegacyDNSControllerPermissions adds legacy IAM permissions used by the node roles. // addLegacyDNSControllerPermissions adds legacy IAM permissions used by the node roles.
func addLegacyDNSControllerPermissions(b *PolicyBuilder, p *Policy) { func addLegacyDNSControllerPermissions(b *PolicyBuilder, p *Policy) {
// Legacy IAM permissions for node roles // Legacy IAM permissions for node roles