Merge pull request #1969 from zytek/fix-1949

Resolve DNS Hosted Zone ID while building IAM policy

pkg/model/context.go

@@ -33,6 +33,7 @@ type KopsModelContext struct {
 	Cluster *kops.Cluster
 
 	Region         string
+	HostedZoneID   string // used to set up route53 IAM policy
 	InstanceGroups []*kops.InstanceGroup
 
 	SSHPublicKeys [][]byte

pkg/model/iam.go

@@ -160,6 +160,7 @@ func (b *IAMModelBuilder) buildAWSIAMPolicy(role kops.InstanceGroupRole) (string
 		Cluster:      b.Cluster,
 		Role:         role,
 		Region:       b.Region,
+		HostedZoneID: b.HostedZoneID,
 	}
 
 	policy, err := pb.BuildAWSIAMPolicy()

pkg/model/iam/iam_builder.go

@@ -71,6 +71,7 @@ type IAMPolicyBuilder struct {
 	Cluster      *api.Cluster
 	Role         api.InstanceGroupRole
 	Region       string
+	HostedZoneID string
 }
 
 func (b *IAMPolicyBuilder) BuildAWSIAMPolicy() (*IAMPolicy, error) {
@@ -101,25 +102,6 @@ func (b *IAMPolicyBuilder) BuildAWSIAMPolicy() (*IAMPolicy, error) {
 			Resource: wildcard,
 		})
 
-		p.Statement = append(p.Statement, &IAMStatement{
-			Effect: IAMStatementEffectAllow,
-			Action: stringorslice.Of("route53:ChangeResourceRecordSets",
-				"route53:ListResourceRecordSets",
-				"route53:GetHostedZone"),
-			Resource: stringorslice.Slice([]string{"arn:aws:route53:::hostedzone/" + b.Cluster.Spec.DNSZone}),
-		})
-
-		p.Statement = append(p.Statement, &IAMStatement{
-			Effect:   IAMStatementEffectAllow,
-			Action:   stringorslice.Slice([]string{"route53:GetChange"}),
-			Resource: stringorslice.Slice([]string{"arn:aws:route53:::change/*"}),
-		})
-
-		p.Statement = append(p.Statement, &IAMStatement{
-			Effect:   IAMStatementEffectAllow,
-			Action:   stringorslice.Slice([]string{"route53:ListHostedZones"}),
-			Resource: wildcard,
-		})
 	}
 
 	{
@@ -148,25 +130,6 @@ func (b *IAMPolicyBuilder) BuildAWSIAMPolicy() (*IAMPolicy, error) {
 			Resource: wildcard,
 		})
 
-		p.Statement = append(p.Statement, &IAMStatement{
-			Effect: IAMStatementEffectAllow,
-			Action: stringorslice.Of("route53:ChangeResourceRecordSets",
-				"route53:ListResourceRecordSets",
-				"route53:GetHostedZone"),
-			Resource: stringorslice.Slice([]string{"arn:aws:route53:::hostedzone/" + b.Cluster.Spec.DNSZone}),
-		})
-		p.Statement = append(p.Statement, &IAMStatement{
-			Effect:   IAMStatementEffectAllow,
-			Action:   stringorslice.Slice([]string{"route53:GetChange"}),
-			Resource: stringorslice.Slice([]string{"arn:aws:route53:::change/*"}),
-		})
-
-		p.Statement = append(p.Statement, &IAMStatement{
-			Effect:   IAMStatementEffectAllow,
-			Action:   stringorslice.Slice([]string{"route53:ListHostedZones"}),
-			Resource: wildcard,
-		})
-
 		p.Statement = append(p.Statement, &IAMStatement{
 			Effect:   IAMStatementEffectAllow,
 			Action:   stringorslice.Slice([]string{"elasticloadbalancing:*"}),
@@ -212,6 +175,26 @@ func (b *IAMPolicyBuilder) BuildAWSIAMPolicy() (*IAMPolicy, error) {
 		}
 	}
 
+	p.Statement = append(p.Statement, &IAMStatement{
+		Effect: IAMStatementEffectAllow,
+		Action: stringorslice.Of("route53:ChangeResourceRecordSets",
+			"route53:ListResourceRecordSets",
+			"route53:GetHostedZone"),
+		Resource: stringorslice.Slice([]string{"arn:aws:route53:::hostedzone/" + b.HostedZoneID}),
+	})
+
+	p.Statement = append(p.Statement, &IAMStatement{
+		Effect:   IAMStatementEffectAllow,
+		Action:   stringorslice.Slice([]string{"route53:GetChange"}),
+		Resource: stringorslice.Slice([]string{"arn:aws:route53:::change/*"}),
+	})
+
+	p.Statement = append(p.Statement, &IAMStatement{
+		Effect:   IAMStatementEffectAllow,
+		Action:   stringorslice.Slice([]string{"route53:ListHostedZones"}),
+		Resource: wildcard,
+	})
+
 	// For S3 IAM permissions, we grant permissions to subtrees.  So find the parents;
 	// we don't need to grant mypath and mypath/child.
 	var roots []string

tests/integration/minimal/cloudformation.json

@@ -550,6 +550,27 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "elasticloadbalancing:*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
+            {
+              "Action": [
+                "autoscaling:DescribeAutoScalingGroups",
+                "autoscaling:DescribeAutoScalingInstances",
+                "autoscaling:SetDesiredCapacity",
+                "autoscaling:TerminateInstanceInAutoScalingGroup"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "route53:ChangeResourceRecordSets",
@@ -578,27 +599,6 @@
               "Resource": [
                 "*"
               ]
-            },
-            {
-              "Action": [
-                "elasticloadbalancing:*"
-              ],
-              "Effect": "Allow",
-              "Resource": [
-                "*"
-              ]
-            },
-            {
-              "Action": [
-                "autoscaling:DescribeAutoScalingGroups",
-                "autoscaling:DescribeAutoScalingInstances",
-                "autoscaling:SetDesiredCapacity",
-                "autoscaling:TerminateInstanceInAutoScalingGroup"
-              ],
-              "Effect": "Allow",
-              "Resource": [
-                "*"
-              ]
             }
           ],
           "Version": "2012-10-17"
@@ -625,6 +625,21 @@
                 "*"
               ]
             },
+            {
+              "Action": [
+                "ecr:GetAuthorizationToken",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:GetRepositoryPolicy",
+                "ecr:DescribeRepositories",
+                "ecr:ListImages",
+                "ecr:BatchGetImage"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                "*"
+              ]
+            },
             {
               "Action": [
                 "route53:ChangeResourceRecordSets",
@@ -653,21 +668,6 @@
               "Resource": [
                 "*"
               ]
-            },
-            {
-              "Action": [
-                "ecr:GetAuthorizationToken",
-                "ecr:BatchCheckLayerAvailability",
-                "ecr:GetDownloadUrlForLayer",
-                "ecr:GetRepositoryPolicy",
-                "ecr:DescribeRepositories",
-                "ecr:ListImages",
-                "ecr:BatchGetImage"
-              ],
-              "Effect": "Allow",
-              "Resource": [
-                "*"
-              ]
             }
           ],
           "Version": "2012-10-17"

upup/pkg/fi/cloudup/apply_cluster.go

@@ -346,6 +346,11 @@ func (c *ApplyClusterCmd) Run() error {
 	if err != nil {
 		return err
 	}
+	dnszone, err := findZone(cluster, cloud)
+	if err != nil {
+		return err
+	}
+	modelContext.HostedZoneID = dnszone.ID()
 
 	clusterTags, err := buildCloudupTags(cluster)
 	if err != nil {