aws-iam: Add autoscaling:DescribeTags

[magnusboman]

Latest versions of the cluster-autoscaler can automatically detect the ASG used by the nodes, but it requires that autoscaling:DescribeTags rights are added to the AWS IAM policy.

[felipejfc]

+1

[chrislovecnm]

I think we have this fixed. Need to check

/assign

[johanneswuerbach]

Looking into kops v1.8.0, autoscaling:DescribeTags seems not be included yet:
Legacy:

kops/pkg/model/iam/tests/iam_builder_master_legacy.json

Lines 17 to 25 in fbfe24a

	"Action": [
	"autoscaling:DescribeAutoScalingGroups",
	"autoscaling:DescribeAutoScalingInstances",
	"autoscaling:DescribeLaunchConfigurations",
	"autoscaling:GetAsgForInstance",
	"autoscaling:SetDesiredCapacity",
	"autoscaling:TerminateInstanceInAutoScalingGroup",
	"autoscaling:UpdateAutoScalingGroup"
	],

Strict:

kops/pkg/model/iam/tests/iam_builder_master_strict_ecr.json

Lines 53 to 81 in fbfe24a

	{
	"Sid": "kopsK8sASMasterPermsAllResources",
	"Effect": "Allow",
	"Action": [
	"autoscaling:DescribeAutoScalingGroups",
	"autoscaling:DescribeLaunchConfigurations",
	"autoscaling:GetAsgForInstance"
	],
	"Resource": [
	"*"
	]
	},
	{
	"Sid": "kopsK8sASMasterPermsTaggedResources",
	"Effect": "Allow",
	"Action": [
	"autoscaling:SetDesiredCapacity",
	"autoscaling:TerminateInstanceInAutoScalingGroup",
	"autoscaling:UpdateAutoScalingGroup"
	],
	"Resource": [
	"*"
	],
	"Condition": {
	"StringEquals": {
	"ec2:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
	}
	}
	},

[robinpercy]

I think we have this fixed. Need to check

@chrislovecnm I just hit this as well with kops 1.8.0. Do we want to fix it in kops? There's a case to be made for using something like kube2iam instead.

[chrislovecnm]

Yes we need this in kops. We may be missing another perms as well. Really we should have a use autoscalig flag to enable / disable in the api.

[robinpercy]

sounds good. Will open a PR.

/assign