Skip to content

Commit 18a0812

Browse files
rifelpetrifelpet
committed
./hack/update-expected.sh
1 parent c24e32e commit 18a0812

5 files changed

Lines changed: 162 additions & 85 deletions

File tree

‎pkg/model/iam/iam_builder.go‎

Lines changed: 34 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1001,28 +1001,41 @@ func AddAWSLoadbalancerControllerPermissions(p *Policy, enableWAF, enableWAFv2,
10011001
"ec2:AuthorizeSecurityGroupIngress", // aws.go
10021002
"ec2:DeleteSecurityGroup", // aws.go
10031003
"ec2:RevokeSecurityGroupIngress", // aws.go
1004-
1005-
"elasticloadbalancing:AddListenerCertificates",
1006-
"elasticloadbalancing:AddTags",
1007-
"elasticloadbalancing:DeleteListener",
1008-
"elasticloadbalancing:DeleteLoadBalancer",
1009-
"elasticloadbalancing:DeleteRule",
1010-
"elasticloadbalancing:DeleteTargetGroup",
1011-
"elasticloadbalancing:DeregisterTargets",
1012-
"elasticloadbalancing:ModifyCapacityReservation",
1013-
"elasticloadbalancing:ModifyListener",
1014-
"elasticloadbalancing:ModifyListenerAttributes",
1015-
"elasticloadbalancing:ModifyLoadBalancerAttributes",
1016-
"elasticloadbalancing:ModifyRule",
1017-
"elasticloadbalancing:ModifyTargetGroup",
1018-
"elasticloadbalancing:ModifyTargetGroupAttributes",
1019-
"elasticloadbalancing:RegisterTargets",
1020-
"elasticloadbalancing:RemoveListenerCertificates",
1021-
"elasticloadbalancing:RemoveTags",
1022-
"elasticloadbalancing:SetIpAddressType",
1023-
"elasticloadbalancing:SetSecurityGroups",
1024-
"elasticloadbalancing:SetSubnets",
10251004
)
1005+
// ELBv2 management actions: resources are tagged with elbv2.k8s.aws/cluster
1006+
// by the LBC tracking provider, not KubernetesCluster, so clusterTaggedAction
1007+
// (which uses aws:ResourceTag/KubernetesCluster) cannot be used here.
1008+
p.Statement = append(p.Statement, &Statement{
1009+
Effect: StatementEffectAllow,
1010+
Action: stringorset.Of(
1011+
"elasticloadbalancing:AddListenerCertificates",
1012+
"elasticloadbalancing:AddTags",
1013+
"elasticloadbalancing:DeleteListener",
1014+
"elasticloadbalancing:DeleteLoadBalancer",
1015+
"elasticloadbalancing:DeleteRule",
1016+
"elasticloadbalancing:DeleteTargetGroup",
1017+
"elasticloadbalancing:DeregisterTargets",
1018+
"elasticloadbalancing:ModifyCapacityReservation",
1019+
"elasticloadbalancing:ModifyListener",
1020+
"elasticloadbalancing:ModifyListenerAttributes",
1021+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
1022+
"elasticloadbalancing:ModifyRule",
1023+
"elasticloadbalancing:ModifyTargetGroup",
1024+
"elasticloadbalancing:ModifyTargetGroupAttributes",
1025+
"elasticloadbalancing:RegisterTargets",
1026+
"elasticloadbalancing:RemoveListenerCertificates",
1027+
"elasticloadbalancing:RemoveTags",
1028+
"elasticloadbalancing:SetIpAddressType",
1029+
"elasticloadbalancing:SetSecurityGroups",
1030+
"elasticloadbalancing:SetSubnets",
1031+
),
1032+
Resource: stringorset.String("*"),
1033+
Condition: Condition{
1034+
"StringEquals": map[string]string{
1035+
"aws:ResourceTag/elbv2.k8s.aws/cluster": p.clusterName,
1036+
},
1037+
},
1038+
})
10261039
// LBC only includes the elbv2.k8s.aws/cluster tag in the create request.
10271040
// KubernetesCluster and other tags are applied separately via AddTags,
10281041
// So aws:RequestTag must reference the elbv2.k8s.aws/cluster tag.

‎tests/integration/update_cluster/aws-lb-controller/data/aws_iam_role_policy_aws-load-balancer-controller.kube-system.sa.minimal.example.com_policy‎

Lines changed: 32 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,36 @@
11
{
22
"Statement": [
3+
{
4+
"Action": [
5+
"elasticloadbalancing:AddListenerCertificates",
6+
"elasticloadbalancing:AddTags",
7+
"elasticloadbalancing:DeleteListener",
8+
"elasticloadbalancing:DeleteLoadBalancer",
9+
"elasticloadbalancing:DeleteRule",
10+
"elasticloadbalancing:DeleteTargetGroup",
11+
"elasticloadbalancing:DeregisterTargets",
12+
"elasticloadbalancing:ModifyCapacityReservation",
13+
"elasticloadbalancing:ModifyListener",
14+
"elasticloadbalancing:ModifyListenerAttributes",
15+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
16+
"elasticloadbalancing:ModifyRule",
17+
"elasticloadbalancing:ModifyTargetGroup",
18+
"elasticloadbalancing:ModifyTargetGroupAttributes",
19+
"elasticloadbalancing:RegisterTargets",
20+
"elasticloadbalancing:RemoveListenerCertificates",
21+
"elasticloadbalancing:RemoveTags",
22+
"elasticloadbalancing:SetIpAddressType",
23+
"elasticloadbalancing:SetSecurityGroups",
24+
"elasticloadbalancing:SetSubnets"
25+
],
26+
"Condition": {
27+
"StringEquals": {
28+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "minimal.example.com"
29+
}
30+
},
31+
"Effect": "Allow",
32+
"Resource": "*"
33+
},
334
{
435
"Action": [
536
"elasticloadbalancing:CreateListener",
@@ -108,27 +139,7 @@
108139
"Action": [
109140
"ec2:AuthorizeSecurityGroupIngress",
110141
"ec2:DeleteSecurityGroup",
111-
"ec2:RevokeSecurityGroupIngress",
112-
"elasticloadbalancing:AddListenerCertificates",
113-
"elasticloadbalancing:AddTags",
114-
"elasticloadbalancing:DeleteListener",
115-
"elasticloadbalancing:DeleteLoadBalancer",
116-
"elasticloadbalancing:DeleteRule",
117-
"elasticloadbalancing:DeleteTargetGroup",
118-
"elasticloadbalancing:DeregisterTargets",
119-
"elasticloadbalancing:ModifyCapacityReservation",
120-
"elasticloadbalancing:ModifyListener",
121-
"elasticloadbalancing:ModifyListenerAttributes",
122-
"elasticloadbalancing:ModifyLoadBalancerAttributes",
123-
"elasticloadbalancing:ModifyRule",
124-
"elasticloadbalancing:ModifyTargetGroup",
125-
"elasticloadbalancing:ModifyTargetGroupAttributes",
126-
"elasticloadbalancing:RegisterTargets",
127-
"elasticloadbalancing:RemoveListenerCertificates",
128-
"elasticloadbalancing:RemoveTags",
129-
"elasticloadbalancing:SetIpAddressType",
130-
"elasticloadbalancing:SetSecurityGroups",
131-
"elasticloadbalancing:SetSubnets"
142+
"ec2:RevokeSecurityGroupIngress"
132143
],
133144
"Condition": {
134145
"StringEquals": {

‎tests/integration/update_cluster/many-addons-ccm-irsa/data/aws_iam_role_policy_aws-load-balancer-controller.kube-system.sa.minimal.example.com_policy‎

Lines changed: 32 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,36 @@
11
{
22
"Statement": [
3+
{
4+
"Action": [
5+
"elasticloadbalancing:AddListenerCertificates",
6+
"elasticloadbalancing:AddTags",
7+
"elasticloadbalancing:DeleteListener",
8+
"elasticloadbalancing:DeleteLoadBalancer",
9+
"elasticloadbalancing:DeleteRule",
10+
"elasticloadbalancing:DeleteTargetGroup",
11+
"elasticloadbalancing:DeregisterTargets",
12+
"elasticloadbalancing:ModifyCapacityReservation",
13+
"elasticloadbalancing:ModifyListener",
14+
"elasticloadbalancing:ModifyListenerAttributes",
15+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
16+
"elasticloadbalancing:ModifyRule",
17+
"elasticloadbalancing:ModifyTargetGroup",
18+
"elasticloadbalancing:ModifyTargetGroupAttributes",
19+
"elasticloadbalancing:RegisterTargets",
20+
"elasticloadbalancing:RemoveListenerCertificates",
21+
"elasticloadbalancing:RemoveTags",
22+
"elasticloadbalancing:SetIpAddressType",
23+
"elasticloadbalancing:SetSecurityGroups",
24+
"elasticloadbalancing:SetSubnets"
25+
],
26+
"Condition": {
27+
"StringEquals": {
28+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "minimal.example.com"
29+
}
30+
},
31+
"Effect": "Allow",
32+
"Resource": "*"
33+
},
334
{
435
"Action": [
536
"elasticloadbalancing:CreateListener",
@@ -108,27 +139,7 @@
108139
"Action": [
109140
"ec2:AuthorizeSecurityGroupIngress",
110141
"ec2:DeleteSecurityGroup",
111-
"ec2:RevokeSecurityGroupIngress",
112-
"elasticloadbalancing:AddListenerCertificates",
113-
"elasticloadbalancing:AddTags",
114-
"elasticloadbalancing:DeleteListener",
115-
"elasticloadbalancing:DeleteLoadBalancer",
116-
"elasticloadbalancing:DeleteRule",
117-
"elasticloadbalancing:DeleteTargetGroup",
118-
"elasticloadbalancing:DeregisterTargets",
119-
"elasticloadbalancing:ModifyCapacityReservation",
120-
"elasticloadbalancing:ModifyListener",
121-
"elasticloadbalancing:ModifyListenerAttributes",
122-
"elasticloadbalancing:ModifyLoadBalancerAttributes",
123-
"elasticloadbalancing:ModifyRule",
124-
"elasticloadbalancing:ModifyTargetGroup",
125-
"elasticloadbalancing:ModifyTargetGroupAttributes",
126-
"elasticloadbalancing:RegisterTargets",
127-
"elasticloadbalancing:RemoveListenerCertificates",
128-
"elasticloadbalancing:RemoveTags",
129-
"elasticloadbalancing:SetIpAddressType",
130-
"elasticloadbalancing:SetSecurityGroups",
131-
"elasticloadbalancing:SetSubnets"
142+
"ec2:RevokeSecurityGroupIngress"
132143
],
133144
"Condition": {
134145
"StringEquals": {

‎tests/integration/update_cluster/many-addons-ccm/data/aws_iam_role_policy_masters.minimal.example.com_policy‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,37 @@
175175
"arn:aws-test:ec2:*:*:security-group/*"
176176
]
177177
},
178+
{
179+
"Action": [
180+
"elasticloadbalancing:AddListenerCertificates",
181+
"elasticloadbalancing:AddTags",
182+
"elasticloadbalancing:DeleteListener",
183+
"elasticloadbalancing:DeleteLoadBalancer",
184+
"elasticloadbalancing:DeleteRule",
185+
"elasticloadbalancing:DeleteTargetGroup",
186+
"elasticloadbalancing:DeregisterTargets",
187+
"elasticloadbalancing:ModifyCapacityReservation",
188+
"elasticloadbalancing:ModifyListener",
189+
"elasticloadbalancing:ModifyListenerAttributes",
190+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
191+
"elasticloadbalancing:ModifyRule",
192+
"elasticloadbalancing:ModifyTargetGroup",
193+
"elasticloadbalancing:ModifyTargetGroupAttributes",
194+
"elasticloadbalancing:RegisterTargets",
195+
"elasticloadbalancing:RemoveListenerCertificates",
196+
"elasticloadbalancing:RemoveTags",
197+
"elasticloadbalancing:SetIpAddressType",
198+
"elasticloadbalancing:SetSecurityGroups",
199+
"elasticloadbalancing:SetSubnets"
200+
],
201+
"Condition": {
202+
"StringEquals": {
203+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "minimal.example.com"
204+
}
205+
},
206+
"Effect": "Allow",
207+
"Resource": "*"
208+
},
178209
{
179210
"Action": [
180211
"elasticloadbalancing:CreateListener",
@@ -339,7 +370,6 @@
339370
"ec2:ModifyInstanceAttribute",
340371
"ec2:ModifyVolume",
341372
"ec2:RevokeSecurityGroupIngress",
342-
"elasticloadbalancing:AddListenerCertificates",
343373
"elasticloadbalancing:AddTags",
344374
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
345375
"elasticloadbalancing:AttachLoadBalancerToSubnets",
@@ -349,27 +379,18 @@
349379
"elasticloadbalancing:DeleteListener",
350380
"elasticloadbalancing:DeleteLoadBalancer",
351381
"elasticloadbalancing:DeleteLoadBalancerListeners",
352-
"elasticloadbalancing:DeleteRule",
353382
"elasticloadbalancing:DeleteTargetGroup",
354383
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
355384
"elasticloadbalancing:DeregisterTargets",
356385
"elasticloadbalancing:DetachLoadBalancerFromSubnets",
357-
"elasticloadbalancing:ModifyCapacityReservation",
358386
"elasticloadbalancing:ModifyListener",
359-
"elasticloadbalancing:ModifyListenerAttributes",
360387
"elasticloadbalancing:ModifyLoadBalancerAttributes",
361-
"elasticloadbalancing:ModifyRule",
362388
"elasticloadbalancing:ModifyTargetGroup",
363389
"elasticloadbalancing:ModifyTargetGroupAttributes",
364390
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
365391
"elasticloadbalancing:RegisterTargets",
366-
"elasticloadbalancing:RemoveListenerCertificates",
367-
"elasticloadbalancing:RemoveTags",
368-
"elasticloadbalancing:SetIpAddressType",
369392
"elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
370-
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
371-
"elasticloadbalancing:SetSecurityGroups",
372-
"elasticloadbalancing:SetSubnets"
393+
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
373394
],
374395
"Condition": {
375396
"StringEquals": {

‎tests/integration/update_cluster/many-addons/data/aws_iam_role_policy_masters.many-addons.example.com_policy‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,37 @@
175175
"arn:aws-test:ec2:*:*:security-group/*"
176176
]
177177
},
178+
{
179+
"Action": [
180+
"elasticloadbalancing:AddListenerCertificates",
181+
"elasticloadbalancing:AddTags",
182+
"elasticloadbalancing:DeleteListener",
183+
"elasticloadbalancing:DeleteLoadBalancer",
184+
"elasticloadbalancing:DeleteRule",
185+
"elasticloadbalancing:DeleteTargetGroup",
186+
"elasticloadbalancing:DeregisterTargets",
187+
"elasticloadbalancing:ModifyCapacityReservation",
188+
"elasticloadbalancing:ModifyListener",
189+
"elasticloadbalancing:ModifyListenerAttributes",
190+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
191+
"elasticloadbalancing:ModifyRule",
192+
"elasticloadbalancing:ModifyTargetGroup",
193+
"elasticloadbalancing:ModifyTargetGroupAttributes",
194+
"elasticloadbalancing:RegisterTargets",
195+
"elasticloadbalancing:RemoveListenerCertificates",
196+
"elasticloadbalancing:RemoveTags",
197+
"elasticloadbalancing:SetIpAddressType",
198+
"elasticloadbalancing:SetSecurityGroups",
199+
"elasticloadbalancing:SetSubnets"
200+
],
201+
"Condition": {
202+
"StringEquals": {
203+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "many-addons.example.com"
204+
}
205+
},
206+
"Effect": "Allow",
207+
"Resource": "*"
208+
},
178209
{
179210
"Action": [
180211
"elasticloadbalancing:CreateListener",
@@ -339,7 +370,6 @@
339370
"ec2:ModifyInstanceAttribute",
340371
"ec2:ModifyVolume",
341372
"ec2:RevokeSecurityGroupIngress",
342-
"elasticloadbalancing:AddListenerCertificates",
343373
"elasticloadbalancing:AddTags",
344374
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
345375
"elasticloadbalancing:AttachLoadBalancerToSubnets",
@@ -349,27 +379,18 @@
349379
"elasticloadbalancing:DeleteListener",
350380
"elasticloadbalancing:DeleteLoadBalancer",
351381
"elasticloadbalancing:DeleteLoadBalancerListeners",
352-
"elasticloadbalancing:DeleteRule",
353382
"elasticloadbalancing:DeleteTargetGroup",
354383
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
355384
"elasticloadbalancing:DeregisterTargets",
356385
"elasticloadbalancing:DetachLoadBalancerFromSubnets",
357-
"elasticloadbalancing:ModifyCapacityReservation",
358386
"elasticloadbalancing:ModifyListener",
359-
"elasticloadbalancing:ModifyListenerAttributes",
360387
"elasticloadbalancing:ModifyLoadBalancerAttributes",
361-
"elasticloadbalancing:ModifyRule",
362388
"elasticloadbalancing:ModifyTargetGroup",
363389
"elasticloadbalancing:ModifyTargetGroupAttributes",
364390
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
365391
"elasticloadbalancing:RegisterTargets",
366-
"elasticloadbalancing:RemoveListenerCertificates",
367-
"elasticloadbalancing:RemoveTags",
368-
"elasticloadbalancing:SetIpAddressType",
369392
"elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
370-
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
371-
"elasticloadbalancing:SetSecurityGroups",
372-
"elasticloadbalancing:SetSubnets"
393+
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
373394
],
374395
"Condition": {
375396
"StringEquals": {

0 commit comments

Comments
 (0)