Skip to content

Commit fc2de5b

Browse files
author
Sedef
committed
Add ASG CreateServiceLinkedRole and DescribeInstanceRefreshes permission
1 parent 8809603 commit fc2de5b

13 files changed

+217
-64
lines changed

‎cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go

+13-1
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ func (t Template) controllersPolicy() *iamv1.PolicyDocument {
120120
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
121121
"elasticloadbalancing:RemoveTags",
122122
"autoscaling:DescribeAutoScalingGroups",
123+
"autoscaling:DescribeInstanceRefreshes",
123124
"ec2:CreateLaunchTemplate",
124125
"ec2:CreateLaunchTemplateVersion",
125126
"ec2:DescribeLaunchTemplates",
@@ -138,11 +139,22 @@ func (t Template) controllersPolicy() *iamv1.PolicyDocument {
138139
"autoscaling:UpdateAutoScalingGroup",
139140
"autoscaling:CreateOrUpdateTags",
140141
"autoscaling:StartInstanceRefresh",
141-
"autoscaling:UpdateAutoScalingGroup",
142142
"autoscaling:DeleteAutoScalingGroup",
143143
"autoscaling:DeleteTags",
144144
},
145145
},
146+
{
147+
Effect: iamv1.EffectAllow,
148+
Resource: iamv1.Resources{
149+
"arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",
150+
},
151+
Action: iamv1.Actions{
152+
"iam:CreateServiceLinkedRole",
153+
},
154+
Condition: iamv1.Conditions{
155+
iamv1.StringLike: map[string]string{"iam:AWSServiceName": "autoscaling.amazonaws.com"},
156+
},
157+
},
146158
{
147159
Effect: iamv1.EffectAllow,
148160
Resource: iamv1.Resources{

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/customsuffix.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Resources:
192192
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
193193
- elasticloadbalancing:RemoveTags
194194
- autoscaling:DescribeAutoScalingGroups
195+
- autoscaling:DescribeInstanceRefreshes
195196
- ec2:CreateLaunchTemplate
196197
- ec2:CreateLaunchTemplateVersion
197198
- ec2:DescribeLaunchTemplates
@@ -205,11 +206,20 @@ Resources:
205206
- autoscaling:CreateAutoScalingGroup
206207
- autoscaling:UpdateAutoScalingGroup
207208
- autoscaling:CreateOrUpdateTags
209+
- autoscaling:StartInstanceRefresh
208210
- autoscaling:DeleteAutoScalingGroup
209211
- autoscaling:DeleteTags
210212
Effect: Allow
211213
Resource:
212214
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
215+
- Action:
216+
- iam:CreateServiceLinkedRole
217+
Condition:
218+
StringLike:
219+
iam:AWSServiceName: autoscaling.amazonaws.com
220+
Effect: Allow
221+
Resource:
222+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
213223
- Action:
214224
- iam:CreateServiceLinkedRole
215225
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Resources:
192192
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
193193
- elasticloadbalancing:RemoveTags
194194
- autoscaling:DescribeAutoScalingGroups
195+
- autoscaling:DescribeInstanceRefreshes
195196
- ec2:CreateLaunchTemplate
196197
- ec2:CreateLaunchTemplateVersion
197198
- ec2:DescribeLaunchTemplates
@@ -205,11 +206,20 @@ Resources:
205206
- autoscaling:CreateAutoScalingGroup
206207
- autoscaling:UpdateAutoScalingGroup
207208
- autoscaling:CreateOrUpdateTags
209+
- autoscaling:StartInstanceRefresh
208210
- autoscaling:DeleteAutoScalingGroup
209211
- autoscaling:DeleteTags
210212
Effect: Allow
211213
Resource:
212214
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
215+
- Action:
216+
- iam:CreateServiceLinkedRole
217+
Condition:
218+
StringLike:
219+
iam:AWSServiceName: autoscaling.amazonaws.com
220+
Effect: Allow
221+
Resource:
222+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
213223
- Action:
214224
- iam:CreateServiceLinkedRole
215225
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@ Resources:
198198
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
199199
- elasticloadbalancing:RemoveTags
200200
- autoscaling:DescribeAutoScalingGroups
201+
- autoscaling:DescribeInstanceRefreshes
201202
- ec2:CreateLaunchTemplate
202203
- ec2:CreateLaunchTemplateVersion
203204
- ec2:DescribeLaunchTemplates
@@ -211,11 +212,20 @@ Resources:
211212
- autoscaling:CreateAutoScalingGroup
212213
- autoscaling:UpdateAutoScalingGroup
213214
- autoscaling:CreateOrUpdateTags
215+
- autoscaling:StartInstanceRefresh
214216
- autoscaling:DeleteAutoScalingGroup
215217
- autoscaling:DeleteTags
216218
Effect: Allow
217219
Resource:
218220
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
221+
- Action:
222+
- iam:CreateServiceLinkedRole
223+
Condition:
224+
StringLike:
225+
iam:AWSServiceName: autoscaling.amazonaws.com
226+
Effect: Allow
227+
Resource:
228+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
219229
- Action:
220230
- iam:CreateServiceLinkedRole
221231
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_bootstrap_user.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ Resources:
197197
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
198198
- elasticloadbalancing:RemoveTags
199199
- autoscaling:DescribeAutoScalingGroups
200+
- autoscaling:DescribeInstanceRefreshes
200201
- ec2:CreateLaunchTemplate
201202
- ec2:CreateLaunchTemplateVersion
202203
- ec2:DescribeLaunchTemplates
@@ -210,11 +211,20 @@ Resources:
210211
- autoscaling:CreateAutoScalingGroup
211212
- autoscaling:UpdateAutoScalingGroup
212213
- autoscaling:CreateOrUpdateTags
214+
- autoscaling:StartInstanceRefresh
213215
- autoscaling:DeleteAutoScalingGroup
214216
- autoscaling:DeleteTags
215217
Effect: Allow
216218
Resource:
217219
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
220+
- Action:
221+
- iam:CreateServiceLinkedRole
222+
Condition:
223+
StringLike:
224+
iam:AWSServiceName: autoscaling.amazonaws.com
225+
Effect: Allow
226+
Resource:
227+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
218228
- Action:
219229
- iam:CreateServiceLinkedRole
220230
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_different_instance_profiles.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Resources:
192192
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
193193
- elasticloadbalancing:RemoveTags
194194
- autoscaling:DescribeAutoScalingGroups
195+
- autoscaling:DescribeInstanceRefreshes
195196
- ec2:CreateLaunchTemplate
196197
- ec2:CreateLaunchTemplateVersion
197198
- ec2:DescribeLaunchTemplates
@@ -205,11 +206,20 @@ Resources:
205206
- autoscaling:CreateAutoScalingGroup
206207
- autoscaling:UpdateAutoScalingGroup
207208
- autoscaling:CreateOrUpdateTags
209+
- autoscaling:StartInstanceRefresh
208210
- autoscaling:DeleteAutoScalingGroup
209211
- autoscaling:DeleteTags
210212
Effect: Allow
211213
Resource:
212214
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
215+
- Action:
216+
- iam:CreateServiceLinkedRole
217+
Condition:
218+
StringLike:
219+
iam:AWSServiceName: autoscaling.amazonaws.com
220+
Effect: Allow
221+
Resource:
222+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
213223
- Action:
214224
- iam:CreateServiceLinkedRole
215225
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_default_roles.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Resources:
192192
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
193193
- elasticloadbalancing:RemoveTags
194194
- autoscaling:DescribeAutoScalingGroups
195+
- autoscaling:DescribeInstanceRefreshes
195196
- ec2:CreateLaunchTemplate
196197
- ec2:CreateLaunchTemplateVersion
197198
- ec2:DescribeLaunchTemplates
@@ -205,11 +206,20 @@ Resources:
205206
- autoscaling:CreateAutoScalingGroup
206207
- autoscaling:UpdateAutoScalingGroup
207208
- autoscaling:CreateOrUpdateTags
209+
- autoscaling:StartInstanceRefresh
208210
- autoscaling:DeleteAutoScalingGroup
209211
- autoscaling:DeleteTags
210212
Effect: Allow
211213
Resource:
212214
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
215+
- Action:
216+
- iam:CreateServiceLinkedRole
217+
Condition:
218+
StringLike:
219+
iam:AWSServiceName: autoscaling.amazonaws.com
220+
Effect: Allow
221+
Resource:
222+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
213223
- Action:
214224
- iam:CreateServiceLinkedRole
215225
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_enable.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Resources:
192192
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
193193
- elasticloadbalancing:RemoveTags
194194
- autoscaling:DescribeAutoScalingGroups
195+
- autoscaling:DescribeInstanceRefreshes
195196
- ec2:CreateLaunchTemplate
196197
- ec2:CreateLaunchTemplateVersion
197198
- ec2:DescribeLaunchTemplates
@@ -205,11 +206,20 @@ Resources:
205206
- autoscaling:CreateAutoScalingGroup
206207
- autoscaling:UpdateAutoScalingGroup
207208
- autoscaling:CreateOrUpdateTags
209+
- autoscaling:StartInstanceRefresh
208210
- autoscaling:DeleteAutoScalingGroup
209211
- autoscaling:DeleteTags
210212
Effect: Allow
211213
Resource:
212214
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
215+
- Action:
216+
- iam:CreateServiceLinkedRole
217+
Condition:
218+
StringLike:
219+
iam:AWSServiceName: autoscaling.amazonaws.com
220+
Effect: Allow
221+
Resource:
222+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
213223
- Action:
214224
- iam:CreateServiceLinkedRole
215225
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_extra_statements.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Resources:
192192
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
193193
- elasticloadbalancing:RemoveTags
194194
- autoscaling:DescribeAutoScalingGroups
195+
- autoscaling:DescribeInstanceRefreshes
195196
- ec2:CreateLaunchTemplate
196197
- ec2:CreateLaunchTemplateVersion
197198
- ec2:DescribeLaunchTemplates
@@ -205,11 +206,20 @@ Resources:
205206
- autoscaling:CreateAutoScalingGroup
206207
- autoscaling:UpdateAutoScalingGroup
207208
- autoscaling:CreateOrUpdateTags
209+
- autoscaling:StartInstanceRefresh
208210
- autoscaling:DeleteAutoScalingGroup
209211
- autoscaling:DeleteTags
210212
Effect: Allow
211213
Resource:
212214
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
215+
- Action:
216+
- iam:CreateServiceLinkedRole
217+
Condition:
218+
StringLike:
219+
iam:AWSServiceName: autoscaling.amazonaws.com
220+
Effect: Allow
221+
Resource:
222+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
213223
- Action:
214224
- iam:CreateServiceLinkedRole
215225
Condition:

‎cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_ssm_secret_backend.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Resources:
192192
- elasticloadbalancing:DeregisterInstancesFromLoadBalancer
193193
- elasticloadbalancing:RemoveTags
194194
- autoscaling:DescribeAutoScalingGroups
195+
- autoscaling:DescribeInstanceRefreshes
195196
- ec2:CreateLaunchTemplate
196197
- ec2:CreateLaunchTemplateVersion
197198
- ec2:DescribeLaunchTemplates
@@ -205,11 +206,20 @@ Resources:
205206
- autoscaling:CreateAutoScalingGroup
206207
- autoscaling:UpdateAutoScalingGroup
207208
- autoscaling:CreateOrUpdateTags
209+
- autoscaling:StartInstanceRefresh
208210
- autoscaling:DeleteAutoScalingGroup
209211
- autoscaling:DeleteTags
210212
Effect: Allow
211213
Resource:
212214
- arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
215+
- Action:
216+
- iam:CreateServiceLinkedRole
217+
Condition:
218+
StringLike:
219+
iam:AWSServiceName: autoscaling.amazonaws.com
220+
Effect: Allow
221+
Resource:
222+
- arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
213223
- Action:
214224
- iam:CreateServiceLinkedRole
215225
Condition:

‎test/e2e/data/e2e_conf.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -137,4 +137,4 @@ intervals:
137137
default/wait-machine-status: ["40m", "10s"]
138138
default/wait-infra-subnets: ["5m", "30s"]
139139
default/wait-machine-pool-nodes: ["40m", "10s"]
140-
default/wait-machine-pool-upgrade: [ "40m", "10s" ]
140+
default/wait-machine-pool-upgrade: [ "50m", "10s" ]

0 commit comments

Comments
 (0)