Skip to content

NE-2401: Add support for AWS ISO partitions #284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alebedev87 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

NE-2401: Add support for AWS ISO partitions #284

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion api/v1/awsloadbalancercontroller_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ type AWSLoadBalancerCredentialsRequestConfig struct {
// This ARN is added to AWSProviderSpec initiating the creation of a secret containing IAM
// Role details necessary for assuming the IAM Role via Amazon's Secure Token Service (STS).
//
// +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$`
// +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):iam::[0-9]{12}:role\/.*$`
// +kubebuilder:validation:Optional
// +optional
STSIAMRoleARN string `json:"stsIAMRoleARN,omitempty"`
Expand Down
26 changes: 13 additions & 13 deletions assets/iam-policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Resource": "arn:*:ec2:*:*:security-group/*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CreateSecurityGroup"
Expand All @@ -102,7 +102,7 @@
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Resource": "arn:*:ec2:*:*:security-group/*",
"Condition": {
"Null": {
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
Expand Down Expand Up @@ -154,9 +154,9 @@
"elasticloadbalancing:RemoveTags"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
"arn:*:elasticloadbalancing:*:*:targetgroup/*/*",
"arn:*:elasticloadbalancing:*:*:loadbalancer/net/*/*",
"arn:*:elasticloadbalancing:*:*:loadbalancer/app/*/*"
],
"Condition": {
"Null": {
Expand All @@ -172,10 +172,10 @@
"elasticloadbalancing:RemoveTags"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
"arn:*:elasticloadbalancing:*:*:listener/net/*/*/*",
"arn:*:elasticloadbalancing:*:*:listener/app/*/*/*",
"arn:*:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
"arn:*:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
]
},
{
Expand All @@ -184,9 +184,9 @@
"elasticloadbalancing:AddTags"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
"arn:*:elasticloadbalancing:*:*:targetgroup/*/*",
"arn:*:elasticloadbalancing:*:*:loadbalancer/net/*/*",
"arn:*:elasticloadbalancing:*:*:loadbalancer/app/*/*"
],
"Condition": {
"StringEquals": {
Expand Down Expand Up @@ -225,7 +225,7 @@
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets"
],
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
"Resource": "arn:*:elasticloadbalancing:*:*:targetgroup/*/*"
},
{
"Effect": "Allow",
Expand Down
2 changes: 1 addition & 1 deletion assets/operator-iam-policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"ec2:DeleteTags"
],
"Effect": "Allow",
"Resource": "arn:aws:ec2:*:*:subnet/*"
"Resource": "arn:*:ec2:*:*:subnet/*"
},
{
"Action": [
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/networking.olm.openshift.io_awsloadbalancercontrollers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ spec:
which must be manually created for the controller's CredentialsRequest.
This ARN is added to AWSProviderSpec initiating the creation of a secret containing IAM
Role details necessary for assuming the IAM Role via Amazon's Secure Token Service (STS).
pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):iam::[0-9]{12}:role\/.*$
type: string
type: object
enabledAddons:
Expand Down
2 changes: 1 addition & 1 deletion config/crd/bases/networking.olm.openshift.io_awsloadbalancercontrollers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ spec:
which must be manually created for the controller's CredentialsRequest.
This ARN is added to AWSProviderSpec initiating the creation of a secret containing IAM
Role details necessary for assuming the IAM Role via Amazon's Secure Token Service (STS).
pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
pattern: ^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b|aws-iso-e|aws-iso-f):iam::[0-9]{12}:role\/.*$
type: string
type: object
enabledAddons:
Expand Down
26 changes: 13 additions & 13 deletions hack/controller/controller-credentials-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ spec:
- action:
- ec2:CreateTags
effect: Allow
resource: "arn:aws:ec2:*:*:security-group/*"
resource: "arn:*:ec2:*:*:security-group/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
Expand All @@ -84,7 +84,7 @@ spec:
- ec2:CreateTags
- ec2:DeleteTags
effect: Allow
resource: "arn:aws:ec2:*:*:security-group/*"
resource: "arn:*:ec2:*:*:security-group/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "true"
Expand Down Expand Up @@ -117,7 +117,7 @@ spec:
- elasticloadbalancing:AddTags
- elasticloadbalancing:RemoveTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
resource: "arn:*:elasticloadbalancing:*:*:targetgroup/*/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "true"
Expand All @@ -126,7 +126,7 @@ spec:
- elasticloadbalancing:AddTags
- elasticloadbalancing:RemoveTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*"
resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/net/*/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "true"
Expand All @@ -135,7 +135,7 @@ spec:
- elasticloadbalancing:AddTags
- elasticloadbalancing:RemoveTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/app/*/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "true"
Expand All @@ -144,26 +144,26 @@ spec:
- elasticloadbalancing:AddTags
- elasticloadbalancing:RemoveTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*"
resource: "arn:*:elasticloadbalancing:*:*:listener/net/*/*/*"
- action:
- elasticloadbalancing:AddTags
- elasticloadbalancing:RemoveTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*"
resource: "arn:*:elasticloadbalancing:*:*:listener/app/*/*/*"
- action:
- elasticloadbalancing:AddTags
- elasticloadbalancing:RemoveTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*"
resource: "arn:*:elasticloadbalancing:*:*:listener-rule/net/*/*/*"
- action:
- elasticloadbalancing:AddTags
- elasticloadbalancing:RemoveTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
resource: "arn:*:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
- action:
- elasticloadbalancing:AddTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
resource: "arn:*:elasticloadbalancing:*:*:targetgroup/*/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
Expand All @@ -172,7 +172,7 @@ spec:
- action:
- elasticloadbalancing:AddTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*"
resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/net/*/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
Expand All @@ -181,7 +181,7 @@ spec:
- action:
- elasticloadbalancing:AddTags
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/app/*/*"
policyCondition:
"Null":
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
Expand All @@ -205,7 +205,7 @@ spec:
- elasticloadbalancing:RegisterTargets
- elasticloadbalancing:DeregisterTargets
effect: Allow
resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
resource: "arn:*:elasticloadbalancing:*:*:targetgroup/*/*"
- action:
- elasticloadbalancing:SetWebAcl
- elasticloadbalancing:ModifyListener
Expand Down
2 changes: 1 addition & 1 deletion hack/operator-credentials-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ spec:
- ec2:CreateTags
- ec2:DeleteTags
effect: Allow
resource: arn:aws:ec2:*:*:subnet/*
resource: arn:*:ec2:*:*:subnet/*
- action:
- ec2:DescribeVpcs
effect: Allow
Expand Down
2 changes: 1 addition & 1 deletion hack/operator-permission-policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"ec2:DeleteTags"
],
"Effect": "Allow",
"Resource": "arn:aws:ec2:*:*:subnet/*"
"Resource": "arn:*:ec2:*:*:subnet/*"
},
{
"Action": [
Expand Down
26 changes: 13 additions & 13 deletions pkg/controllers/awsloadbalancercontroller/iam_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:ec2:*:*:security-group/*",
Resource: "arn:*:ec2:*:*:security-group/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "false",
Expand All @@ -111,7 +111,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:ec2:*:*:security-group/*",
Resource: "arn:*:ec2:*:*:security-group/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
Expand Down Expand Up @@ -163,7 +163,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:targetgroup/*/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
Expand All @@ -177,7 +177,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/net/*/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
Expand All @@ -191,7 +191,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/app/*/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
Expand All @@ -205,7 +205,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:listener/net/*/*/*",
PolicyCondition: cco.IAMPolicyCondition{},
Action: []string{
"elasticloadbalancing:AddTags",
Expand All @@ -214,7 +214,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:listener/app/*/*/*",
PolicyCondition: cco.IAMPolicyCondition{},
Action: []string{
"elasticloadbalancing:AddTags",
Expand All @@ -223,7 +223,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
PolicyCondition: cco.IAMPolicyCondition{},
Action: []string{
"elasticloadbalancing:AddTags",
Expand All @@ -232,7 +232,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
PolicyCondition: cco.IAMPolicyCondition{},
Action: []string{
"elasticloadbalancing:AddTags",
Expand All @@ -241,7 +241,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:targetgroup/*/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "false",
Expand All @@ -256,7 +256,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/net/*/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "false",
Expand All @@ -271,7 +271,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:loadbalancer/app/*/*",
PolicyCondition: cco.IAMPolicyCondition{
"Null": cco.IAMPolicyConditionKeyValue{
"aws:RequestTag/elbv2.k8s.aws/cluster": "false",
Expand Down Expand Up @@ -305,7 +305,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
Resource: "arn:*:elasticloadbalancing:*:*:targetgroup/*/*",
PolicyCondition: cco.IAMPolicyCondition{},
Action: []string{
"elasticloadbalancing:RegisterTargets",
Expand Down
30 changes: 30 additions & 0 deletions pkg/operator/credentials_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,36 @@ func Test_ProvisionCredentials(t *testing.T) {
},
expectedContents: "oksts",
},
{
name: "nominal sts iso partition",
envVars: map[string]string{
"ROLEARN": "arn:aws-iso:iam::123456789012:role/foo",
},
scheme: test.Scheme,
provisionedSecret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: "aws-load-balancer-operator",
Namespace: "aws-load-balancer-operator",
},
Data: map[string][]byte{
"credentials": []byte("okiso"),
},
},
expectedCredReqName: types.NamespacedName{
Namespace: "openshift-cloud-credential-operator",
Name: "aws-load-balancer-operator",
},
compareCredReq: func(credReq *cco.CredentialsRequest, providerSpec *cco.AWSProviderSpec) error {
if providerSpec.STSIAMRoleARN != "arn:aws-iso:iam::123456789012:role/foo" {
return fmt.Errorf("got unexpected role arn: %q", providerSpec.STSIAMRoleARN)
}
if credReq.Spec.CloudTokenPath != "/var/run/secrets/openshift/serviceaccount/token" {
return fmt.Errorf("got unexpected token path: %q", credReq.Spec.CloudTokenPath)
}
return nil
},
expectedContents: "okiso",
},
{
name: "nominal non sts",
scheme: test.Scheme,
Expand Down
2 changes: 1 addition & 1 deletion pkg/operator/iam_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ func GetIAMPolicy() IAMPolicy {
},
{
Effect: "Allow",
Resource: "arn:aws:ec2:*:*:subnet/*",
Resource: "arn:*:ec2:*:*:subnet/*",
PolicyCondition: cco.IAMPolicyCondition{},
Action: []string{
"ec2:CreateTags",
Expand Down
2 changes: 1 addition & 1 deletion pkg/utils/resource/update/credentials_request_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ func Test_CredentialsRequest(t *testing.T) {
StatementEntries: []cco.StatementEntry{
{
Effect: "Allow",
Resource: "arn:aws:ec2:*:*:subnet/*",
Resource: "arn:*:ec2:*:*:subnet/*",
PolicyCondition: cco.IAMPolicyCondition{},
Action: []string{
"ec2:DescribeSubnets",
Expand Down