Add missing permissions for NLB creation

kubernetes · Dec 1, 2017 · 9eb0dd4 · 9eb0dd4
1 parent cf70f99
commit 9eb0dd4
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go
@@ -617,6 +617,21 @@ func addMasterELBPolicies(p *Policy, resource stringorslice.StringOrSlice, legac
 			),
 			Resource: resource,
 		})
+
+		p.Statement = append(p.Statement, &Statement{
+			Sid:    "kopsK8sNLBMasterPermsRestrictive",
+			Effect: StatementEffectAllow,
+			Action: stringorslice.Of(
+				"elasticloadbalancing:CreateListeners",      // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeListeners",    // aws_loadbalancer.go
+				"elasticloadbalancing:CreateTargetGroup",    // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeTargetGroups", // aws_loadbalancer.go
+				"elasticloadbalancing:RegisterTargets",      // aws_loadbalancer.go
+				"elasticloadbalancing:DescribeTargetHealth", // aws_loadbalancer.go
+				"ec2:DescribeVpcs",                          // aws_loadbalancer.go
+			),
+			Resource: resource,
+		})
 	}
 }
 

diff --git a/pkg/model/iam/tests/iam_builder_master_strict.json b/pkg/model/iam/tests/iam_builder_master_strict.json
@@ -103,6 +103,22 @@
         "*"
       ]
     },
+    {
+      "Sid": "kopsK8sNLBMasterPermsRestrictive",
+      "Effect": "Allow",
+      "Action": [
+				"elasticloadbalancing:CreateListeners",
+				"elasticloadbalancing:DescribeListeners",
+				"elasticloadbalancing:CreateTargetGroup",
+				"elasticloadbalancing:DescribeTargetGroups",
+				"elasticloadbalancing:RegisterTargets",
+				"elasticloadbalancing:DescribeTargetHealth",
+				"ec2:DescribeVpcs"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
     {
       "Sid": "kopsMasterCertIAMPerms",
       "Effect": "Allow",