kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update IAM builder tests to use external CCM

This commit is contained in:
John Gardiner Myers 2023-09-04 15:54:05 -07:00
parent 965712d22b
commit daf3d0808c
5 changed files with 133 additions and 196 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/model/iam/iam_builder_test.go
View File

@ -209,6 +209,7 @@ func TestPolicyGeneration(t *testing.T) {
}, },
}, },
}, },
ExternalCloudControllerManager: &kops.CloudControllerManagerConfig{},
Networking: kops.NetworkingSpec{ Networking: kops.NetworkingSpec{
Kubenet: &kops.KubenetNetworkingSpec{}, Kubenet: &kops.KubenetNetworkingSpec{},
}, },

82
pkg/model/iam/tests/iam_builder_master_gossip.json
View File

@ -32,39 +32,6 @@
"arn:aws-test:s3:::kops-tests" "arn:aws-test:s3:::kops-tests"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": "ec2:CreateTags", "Action": "ec2:CreateTags",
"Condition": { "Condition": {
@ -101,6 +68,39 @@
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:snapshot/*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": [ "Action": [
"autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingGroups",
@ -108,13 +108,6 @@
"autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeScalingActivities", "autoscaling:DescribeScalingActivities",
"autoscaling:DescribeTags", "autoscaling:DescribeTags",
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:CreateTags",
"ec2:DeleteRoute",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones",
"ec2:DescribeInstanceTypes", "ec2:DescribeInstanceTypes",
@ -128,21 +121,12 @@
"ec2:DescribeVolumes", "ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications", "ec2:DescribeVolumesModifications",
"ec2:DescribeVpcs", "ec2:DescribeVpcs",
"ec2:DetachVolume",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyVolume",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:RegisterTargets",
"iam:GetServerCertificate", "iam:GetServerCertificate",
"iam:ListServerCertificates", "iam:ListServerCertificates",
"kms:CreateGrant", "kms:CreateGrant",

82
pkg/model/iam/tests/iam_builder_master_gossip_ecr.json
View File

@ -32,39 +32,6 @@
"arn:aws-test:s3:::kops-tests" "arn:aws-test:s3:::kops-tests"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": "ec2:CreateTags", "Action": "ec2:CreateTags",
"Condition": { "Condition": {
@ -101,6 +68,39 @@
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:snapshot/*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": [ "Action": [
"autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingGroups",
@ -108,13 +108,6 @@
"autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeScalingActivities", "autoscaling:DescribeScalingActivities",
"autoscaling:DescribeTags", "autoscaling:DescribeTags",
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:CreateTags",
"ec2:DeleteRoute",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones",
"ec2:DescribeInstanceTypes", "ec2:DescribeInstanceTypes",
@ -128,9 +121,6 @@
"ec2:DescribeVolumes", "ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications", "ec2:DescribeVolumesModifications",
"ec2:DescribeVpcs", "ec2:DescribeVpcs",
"ec2:DetachVolume",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyVolume",
"ecr:BatchCheckLayerAvailability", "ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage", "ecr:BatchGetImage",
"ecr:DescribeRepositories", "ecr:DescribeRepositories",
@ -138,18 +128,12 @@
"ecr:GetDownloadUrlForLayer", "ecr:GetDownloadUrlForLayer",
"ecr:GetRepositoryPolicy", "ecr:GetRepositoryPolicy",
"ecr:ListImages", "ecr:ListImages",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:RegisterTargets",
"iam:GetServerCertificate", "iam:GetServerCertificate",
"iam:ListServerCertificates", "iam:ListServerCertificates",
"kms:CreateGrant", "kms:CreateGrant",

82
pkg/model/iam/tests/iam_builder_master_strict.json
View File

@ -32,39 +32,6 @@
"arn:aws-test:s3:::kops-tests" "arn:aws-test:s3:::kops-tests"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": "ec2:CreateTags", "Action": "ec2:CreateTags",
"Condition": { "Condition": {
@ -101,6 +68,39 @@
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:snapshot/*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": [ "Action": [
"autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingGroups",
@ -108,13 +108,6 @@
"autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeScalingActivities", "autoscaling:DescribeScalingActivities",
"autoscaling:DescribeTags", "autoscaling:DescribeTags",
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:CreateTags",
"ec2:DeleteRoute",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones",
"ec2:DescribeInstanceTypes", "ec2:DescribeInstanceTypes",
@ -128,21 +121,12 @@
"ec2:DescribeVolumes", "ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications", "ec2:DescribeVolumesModifications",
"ec2:DescribeVpcs", "ec2:DescribeVpcs",
"ec2:DetachVolume",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyVolume",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:RegisterTargets",
"iam:GetServerCertificate", "iam:GetServerCertificate",
"iam:ListServerCertificates", "iam:ListServerCertificates",
"kms:CreateGrant", "kms:CreateGrant",

82
pkg/model/iam/tests/iam_builder_master_strict_ecr.json
View File

@ -32,39 +32,6 @@
"arn:aws-test:s3:::kops-tests" "arn:aws-test:s3:::kops-tests"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": "ec2:CreateTags", "Action": "ec2:CreateTags",
"Condition": { "Condition": {
@ -101,6 +68,39 @@
"arn:aws-test:ec2:*:*:snapshot/*" "arn:aws-test:ec2:*:*:snapshot/*"
] ]
}, },
{
"Action": "ec2:CreateTags",
"Condition": {
"StringEquals": {
"aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Condition": {
"Null": {
"aws:RequestTag/KubernetesCluster": "true"
},
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
}
},
"Effect": "Allow",
"Resource": [
"arn:aws-test:ec2:*:*:security-group/*"
]
},
{ {
"Action": [ "Action": [
"autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingGroups",
@ -108,13 +108,6 @@
"autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeScalingActivities", "autoscaling:DescribeScalingActivities",
"autoscaling:DescribeTags", "autoscaling:DescribeTags",
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:CreateTags",
"ec2:DeleteRoute",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DescribeAccountAttributes", "ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones", "ec2:DescribeAvailabilityZones",
"ec2:DescribeInstanceTypes", "ec2:DescribeInstanceTypes",
@ -128,9 +121,6 @@
"ec2:DescribeVolumes", "ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications", "ec2:DescribeVolumesModifications",
"ec2:DescribeVpcs", "ec2:DescribeVpcs",
"ec2:DetachVolume",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyVolume",
"ecr:BatchCheckLayerAvailability", "ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage", "ecr:BatchGetImage",
"ecr:DescribeRepositories", "ecr:DescribeRepositories",
@ -138,18 +128,12 @@
"ecr:GetDownloadUrlForLayer", "ecr:GetDownloadUrlForLayer",
"ecr:GetRepositoryPolicy", "ecr:GetRepositoryPolicy",
"ecr:ListImages", "ecr:ListImages",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:RegisterTargets",
"iam:GetServerCertificate", "iam:GetServerCertificate",
"iam:ListServerCertificates", "iam:ListServerCertificates",
"kms:CreateGrant", "kms:CreateGrant",