Merge pull request #4095 from reactiveops/fix_3883

Automatic merge from submit-queue. Adds permissions for ELB and NLB req'd by 1.9 Adds appropriate IAM permissions to Masters (in restrictive mode) for ELB and NLB. Closes #3883
kubernetes · Dec 17, 2017 · 0bfb273 · 0bfb273
2 parents 7768729 + 59bc52a
commit 0bfb273
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 18 deletions.
diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go
@@ -599,6 +599,7 @@ func addMasterELBPolicies(p *Policy, resource stringorslice.StringOrSlice, legac
 			Sid:    "kopsK8sELBMasterPermsRestrictive",
 			Effect: StatementEffectAllow,
 			Action: stringorslice.Of(
+				"elasticloadbalancing:AddTags",                                 // aws_loadbalancer.go
 				"elasticloadbalancing:AttachLoadBalancerToSubnets",             // aws_loadbalancer.go
 				"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",       // aws_loadbalancer.go
 				"elasticloadbalancing:CreateLoadBalancer",                      // aws_loadbalancer.go
@@ -622,15 +623,20 @@ func addMasterELBPolicies(p *Policy, resource stringorslice.StringOrSlice, legac
 			Sid:    "kopsK8sNLBMasterPermsRestrictive",
 			Effect: StatementEffectAllow,
 			Action: stringorslice.Of(
-				"elasticloadbalancing:CreateListener",       // aws_loadbalancer.go
-				"elasticloadbalancing:DescribeListeners",    // aws_loadbalancer.go
-				"elasticloadbalancing:CreateTargetGroup",    // aws_loadbalancer.go
-				"elasticloadbalancing:DescribeTargetGroups", // aws_loadbalancer.go
-				"elasticloadbalancing:RegisterTargets",      // aws_loadbalancer.go
-				"elasticloadbalancing:DescribeTargetHealth", // aws_loadbalancer.go
-				"elasticloadbalancing:AddTags",              // aws_loadbalancer.go
-				"elasticloadbalancing:ModifyTargetGroup",    // aws_loadbalancer.go
-				"ec2:DescribeVpcs",                          // aws_loadbalancer.go
+				"ec2:DescribeVpcs",                                       // aws_loadbalancer.go
+				"elasticloadbalancing:AddTags",                           // aws_loadbalancer.go
+				"elasticloadbalancing:CreateListener",                    // aws_loadbalancer.go
+				"elasticloadbalancing:CreateTargetGroup",                 // aws_loadbalancer.go
+				"elasticloadbalancing:DeleteListener",                    // aws_loadbalancer.go
+				"elasticloadbalancing:DeleteTargetGroup",                 // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeListeners",                 // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeLoadBalancerPolicies",      // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeTargetGroups",              // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeTargetHealth",              // aws_loadbalancer.go
+				"elasticloadbalancing:ModifyListener",                    // aws_loadbalancer.go
+				"elasticloadbalancing:ModifyTargetGroup",                 // aws_loadbalancer.go
+				"elasticloadbalancing:RegisterTargets",                   // aws_loadbalancer.go
+				"elasticloadbalancing:SetLoadBalancerPoliciesOfListener", // aws_loadbalancer.go
 			),
 			Resource: resource,
 		})

diff --git a/pkg/model/iam/tests/iam_builder_master_strict.json b/pkg/model/iam/tests/iam_builder_master_strict.json
@@ -84,6 +84,7 @@
       "Sid": "kopsK8sELBMasterPermsRestrictive",
       "Effect": "Allow",
       "Action": [
+        "elasticloadbalancing:AddTags",
         "elasticloadbalancing:AttachLoadBalancerToSubnets",
         "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
         "elasticloadbalancing:CreateLoadBalancer",
@@ -108,15 +109,20 @@
       "Sid": "kopsK8sNLBMasterPermsRestrictive",
       "Effect": "Allow",
       "Action": [
+        "ec2:DescribeVpcs",
+        "elasticloadbalancing:AddTags",
         "elasticloadbalancing:CreateListener",
-        "elasticloadbalancing:DescribeListeners",
         "elasticloadbalancing:CreateTargetGroup",
+        "elasticloadbalancing:DeleteListener",
+        "elasticloadbalancing:DeleteTargetGroup",
+        "elasticloadbalancing:DescribeListeners",
+        "elasticloadbalancing:DescribeLoadBalancerPolicies",
         "elasticloadbalancing:DescribeTargetGroups",
-        "elasticloadbalancing:RegisterTargets",
         "elasticloadbalancing:DescribeTargetHealth",
-        "elasticloadbalancing:AddTags",
+        "elasticloadbalancing:ModifyListener",
         "elasticloadbalancing:ModifyTargetGroup",
-        "ec2:DescribeVpcs"
+        "elasticloadbalancing:RegisterTargets",
+        "elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
       ],
       "Resource": [
         "*"

diff --git a/pkg/model/iam/tests/iam_builder_master_strict_ecr.json b/pkg/model/iam/tests/iam_builder_master_strict_ecr.json
@@ -1,4 +1,4 @@
-{
+  {
   "Version": "2012-10-17",
   "Statement": [
     {
@@ -84,6 +84,7 @@
       "Sid": "kopsK8sELBMasterPermsRestrictive",
       "Effect": "Allow",
       "Action": [
+        "elasticloadbalancing:AddTags",
         "elasticloadbalancing:AttachLoadBalancerToSubnets",
         "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
         "elasticloadbalancing:CreateLoadBalancer",
@@ -108,15 +109,20 @@
       "Sid": "kopsK8sNLBMasterPermsRestrictive",
       "Effect": "Allow",
       "Action": [
+        "ec2:DescribeVpcs",
+        "elasticloadbalancing:AddTags",
         "elasticloadbalancing:CreateListener",
-        "elasticloadbalancing:DescribeListeners",
         "elasticloadbalancing:CreateTargetGroup",
+        "elasticloadbalancing:DeleteListener",
+        "elasticloadbalancing:DeleteTargetGroup",
+        "elasticloadbalancing:DescribeListeners",
+        "elasticloadbalancing:DescribeLoadBalancerPolicies",
         "elasticloadbalancing:DescribeTargetGroups",
-        "elasticloadbalancing:RegisterTargets",
         "elasticloadbalancing:DescribeTargetHealth",
-        "elasticloadbalancing:AddTags",
+        "elasticloadbalancing:ModifyListener",
         "elasticloadbalancing:ModifyTargetGroup",
-        "ec2:DescribeVpcs"
+        "elasticloadbalancing:RegisterTargets",
+        "elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
       ],
       "Resource": [
         "*"