Skip to content
This repository has been archived by the owner on Oct 30, 2024. It is now read-only.

WIP: Split AWS/IAM policies for master and workers #362

Closed
wants to merge 4 commits into from
Closed

WIP: Split AWS/IAM policies for master and workers #362

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b23c338
Add PolicyType to the Policy resource
rossf7 Jul 26, 2017
5933e9c
Generate IAM policies from template files
rossf7 Jul 26, 2017
8c22fc3
Create separate master and worker policies in the addFunc
rossf7 Jul 26, 2017
2988a31
Delete master and worker policies in the deleteFunc
rossf7 Jul 26, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Create separate master and worker policies in the addFunc
  • Loading branch information
@rossf7
rossf7 committed Jul 26, 2017
commit 8c22fc3baf218b7227bea75c066706d48616d3dc
36 changes: 26 additions & 10 deletions service/create/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -544,19 +544,35 @@ func (s *Service) addFunc(obj interface{}) {
// Create policy
bucketName := s.bucketName(cluster)

var policy resources.NamedResource
var masterPolicy resources.NamedResource
var policyErr error
{
policy = &awsresources.Policy{
ClusterID: cluster.Spec.Cluster.Cluster.ID,
KMSKeyArn: kmsKey.Arn(),
S3Bucket: bucketName,
AWSEntity: awsresources.AWSEntity{Clients: clients},
masterPolicy = &awsresources.Policy{
ClusterID: cluster.Spec.Cluster.Cluster.ID,
KMSKeyArn: kmsKey.Arn(),
PolicyType: prefixMaster,
S3Bucket: bucketName,
AWSEntity: awsresources.AWSEntity{Clients: clients},
}
policyErr = masterPolicy.CreateOrFail()
}
if policyErr != nil {
s.logger.Log("error", fmt.Sprintf("could not create master policy: %s", errgo.Details(policyErr)))
}

var workerPolicy resources.NamedResource
{
workerPolicy = &awsresources.Policy{
ClusterID: cluster.Spec.Cluster.Cluster.ID,
KMSKeyArn: kmsKey.Arn(),
PolicyType: prefixWorker,
S3Bucket: bucketName,
AWSEntity: awsresources.AWSEntity{Clients: clients},
}
policyErr = policy.CreateOrFail()
policyErr = workerPolicy.CreateOrFail()
}
if policyErr != nil {
s.logger.Log("error", fmt.Sprintf("could not create policy: %s", errgo.Details(policyErr)))
s.logger.Log("error", fmt.Sprintf("could not create worker policy: %s", errgo.Details(policyErr)))
}

// Create S3 bucket
Expand Down Expand Up @@ -760,7 +776,7 @@ func (s *Service) addFunc(obj interface{}) {
securityGroup: mastersSecurityGroup,
subnet: publicSubnet,
keyPairName: cluster.Name,
instanceProfileName: policy.GetName(),
instanceProfileName: masterPolicy.GetName(),
prefix: prefixMaster,
})
if err != nil {
Expand Down Expand Up @@ -872,7 +888,7 @@ func (s *Service) addFunc(obj interface{}) {
securityGroup: workersSecurityGroup,
subnet: publicSubnet,
keypairName: cluster.Name,
instanceProfileName: policy.GetName(),
instanceProfileName: workerPolicy.GetName(),
prefix: prefixWorker,
ebsStorage: true,
}
Expand Down