kops/pkg/model/iam
Peter Rifel a15957da2f
IRSA - continue adding route53 permisions to masters
These are needed by protokube to create the kops-controller DNS record to allow nodes to bootstrap.

See these logs: https://storage.googleapis.com/kubernetes-jenkins/logs/e2e-kops-grid-scenario-public-jwks/1345956556562239488/artifacts/ip-172-20-48-1.sa-east-1.compute.internal/protokube.log

```
I0104 05:03:51.264472    6482 dnscache.go:74] querying all DNS zones (no cached results)
I0104 05:03:51.264570    6482 route53.go:53] AWS request: route53 ListHostedZones
W0104 05:03:51.389485    6482 dnscontroller.go:124] Unexpected error in DNS controller, will retry: error querying for zones: error querying for DNS zones: AccessDenied: User: arn:aws:sts::768319786644:assumed-role/masters.e2e-kops-scenario-public-jwks.test-cncf-aws.k8s.io/i-05b1db10d1a5b8637 is not authorized to perform: route53:ListHostedZones
```

and the nodeup logs on nodes that couldn't join the cluster:

```
Jan 04 04:55:53.500187 ip-172-20-38-84 nodeup[2070]: W0104 04:55:53.500117    2070 executor.go:131] error running task "BootstrapClient/BootstrapClient" (9m52s remaining to succeed): Post "https://kops-controller.internal.e2e-kops-scenario-public-jwks.test-cncf-aws.k8s.io:3988/bootstrap": dial tcp: lookup kops-controller.internal.e2e-kops-scenario-public-jwks.test-cncf-aws.k8s.io on 127.0.0.53:53: no such host
```
2021-01-04 21:03:53 -06:00
..
tests Order policy document sections alphabetically 2020-11-04 16:15:00 +02:00
BUILD.bazel IAM ServiceAccount Roles: truncate name at 64 characters 2020-12-16 13:38:38 -05:00
iam_builder.go IRSA - continue adding route53 permisions to masters 2021-01-04 21:03:53 -06:00
iam_builder_test.go Order policy document sections alphabetically 2020-11-04 16:15:00 +02:00
subject.go Use custom-configured ServiceAccountIssuer when present 2020-12-04 09:03:03 -08:00
types.go IAM ServiceAccount Roles: truncate name at 64 characters 2020-12-16 13:38:38 -05:00