Merge pull request #3976 from aledbf/missing-elb-permission

Automatic merge from submit-queue. Add missing permissions for NLB creation Without this permissions is not possible to create a network load balancer (alpha in k8s >= 1.9)
kubernetes · Dec 4, 2017 · 26d931e · 26d931e
2 parents e633bb4 + 683799c
commit 26d931e
Show file tree

Hide file tree

Showing 3 changed files with 53 additions and 0 deletions.
diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go
@@ -617,6 +617,23 @@ func addMasterELBPolicies(p *Policy, resource stringorslice.StringOrSlice, legac
 			),
 			Resource: resource,
 		})
+
+		p.Statement = append(p.Statement, &Statement{
+			Sid:    "kopsK8sNLBMasterPermsRestrictive",
+			Effect: StatementEffectAllow,
+			Action: stringorslice.Of(
+				"elasticloadbalancing:CreateListener",       // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeListeners",    // aws_loadbalancer.go
+				"elasticloadbalancing:CreateTargetGroup",    // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeTargetGroups", // aws_loadbalancer.go
+				"elasticloadbalancing:RegisterTargets",      // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeTargetHealth", // aws_loadbalancer.go
+				"elasticloadbalancing:AddTags",              // aws_loadbalancer.go
+				"elasticloadbalancing:ModifyTargetGroup",    // aws_loadbalancer.go
+				"ec2:DescribeVpcs",                          // aws_loadbalancer.go
+			),
+			Resource: resource,
+		})
 	}
 }
 

diff --git a/pkg/model/iam/tests/iam_builder_master_strict.json b/pkg/model/iam/tests/iam_builder_master_strict.json
@@ -103,6 +103,24 @@
         "*"
       ]
     },
+    {
+      "Sid": "kopsK8sNLBMasterPermsRestrictive",
+      "Effect": "Allow",
+      "Action": [
+        "elasticloadbalancing:CreateListener",
+        "elasticloadbalancing:DescribeListeners",
+        "elasticloadbalancing:CreateTargetGroup",
+        "elasticloadbalancing:DescribeTargetGroups",
+        "elasticloadbalancing:RegisterTargets",
+        "elasticloadbalancing:DescribeTargetHealth",
+        "elasticloadbalancing:AddTags",
+        "elasticloadbalancing:ModifyTargetGroup",
+        "ec2:DescribeVpcs"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Sid": "kopsMasterCertIAMPerms",
       "Effect": "Allow",

diff --git a/pkg/model/iam/tests/iam_builder_master_strict_ecr.json b/pkg/model/iam/tests/iam_builder_master_strict_ecr.json
@@ -103,6 +103,24 @@
         "*"
       ]
     },
+    {
+      "Sid": "kopsK8sNLBMasterPermsRestrictive",
+      "Effect": "Allow",
+      "Action": [
+        "elasticloadbalancing:CreateListener",
+        "elasticloadbalancing:DescribeListeners",
+        "elasticloadbalancing:CreateTargetGroup",
+        "elasticloadbalancing:DescribeTargetGroups",
+        "elasticloadbalancing:RegisterTargets",
+        "elasticloadbalancing:DescribeTargetHealth",
+        "elasticloadbalancing:AddTags",
+        "elasticloadbalancing:ModifyTargetGroup",
+        "ec2:DescribeVpcs"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Sid": "kopsMasterCertIAMPerms",
       "Effect": "Allow",