✨ Support setting role path and permissions boundary on managed IAM roles #5286

robinkb · 2025-01-16T12:03:43Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Allows setting the role path and permissions boundary on managed IAM roles for EKS control plane, EKS Fargate profile, and managed machine pools. This is typically needed in enterprise environments with more stringent IAM requirements.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):

Fixes #5285

Special notes for your reviewer:

This is my first PR on this repository. I noticed a warning when generating code, and I wasn't sure if this needed to be fixed:

E0116 12:53:58.750053   55614 conversion.go:744] Warning: could not find nor generate a final Conversion function for sigs.k8s.io/cluster-api-provider-aws/v2/exp/api/v1beta2.FargateProfileSpec -> sigs.k8s.io/cluster-api-provider-aws/v2/exp/api/v1beta1.FargateProfileSpec
E0116 12:53:58.750274   55614 conversion.go:745]   the following fields need manual conversion:
E0116 12:53:58.750281   55614 conversion.go:747]       - RolePath
E0116 12:53:58.750286   55614 conversion.go:747]       - RolePermissionsBoundary

Checklist:

Release note:

Support setting role path and permissions boundary on managed IAM roles

linux-foundation-easycla · 2025-01-16T12:03:48Z

The committers listed above are authorized under a signed CLA.

✅ login: robinkb / name: Robin Ketelbuters (5254562)

k8s-ci-robot · 2025-01-16T12:03:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dlipovetsky for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-01-16T12:03:53Z

Hi @robinkb. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

pavansokkenagaraj · 2025-01-27T14:56:51Z

@robinkb PermissionsBoundary are required for CloudFormation template rendering for creating roles and permissions.
https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/cmd/clusterawsadm/cloudformation/bootstrap/template.go#L139-L160

robinkb · 2025-01-29T08:09:52Z

Hi @pavansokkenagaraj, thanks for the feedback.

I've amended my commit. However, I see more roles generated in the template:
https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/cmd/clusterawsadm/cloudformation/bootstrap/template.go#L183-L208

Do these need to be changed, too? I didn't use the bootstrap proces, so I'm not really familiar with how it works.

…ane, EKS fargate profile, and managed machine pools Signed-off-by: Robin Ketelbuters <[email protected]>

robinkb · 2025-01-29T12:50:38Z

We are in the process of testing this on our own environment now. The most recent update includes some shenanigans around pointers. I'm not sure which way I am expected to handle them, as the codebase is inconsistent. The Spec for AWSManagedControlPlane uses pointers to strings for optional values, while the Spec for AWSFargateProfile does not, for example.

richardcase · 2025-01-29T18:24:25Z

/ok-to-test

richardcase · 2025-01-29T18:27:24Z

cmd/clusterawsadm/api/bootstrap/v1alpha1/types.go

@@ -83,6 +83,12 @@ type AWSIAMRoleSpec struct {
 	// ExtraStatements are additional IAM statements to be included inline for the role.
 	ExtraStatements []iamv1.StatementEntry `json:"extraStatements,omitempty"`

+	// Path sets the path to the role.
+	Path string `json:"path,omitempty"`


The new fields only need to go into the latest API version (i.e. v1beta1). These can be removed.

But what this means is that the conversions need to be updated so that values for these new fields are restored when roundtripping.

A bit like we do here: https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/api/v1beta1/awscluster_conversion.go#L27

I managed to update the conversions for the other types, but I am confused as to why I need to implement conversion for this type in particular? The bootstrap API is only for a local configuration file, right? It's not stored in etcd?

There is no conversion in place for it today. If I do need to implement conversion for it, then sure, I will do that. But I will require help, because the test is spitting out vague errors that I can make neither heads nor tails out of.

I managed to update the conversions for the other types, but I am confused as to why I need to implement conversion for this type in particular? The bootstrap API is only for a local configuration file, right? It's not stored in etcd?

Normally for any Kubernetes API there is a test that does roundtrip conversion. But actually looking at this API we don't have those tests. With is great. So no need to worry about the conversion. I wonder if it is worth adding conversion functions at some point in the future.

The new field(s) still only need to go into the latest API version.

richardcase · 2025-01-29T18:28:04Z

cmd/clusterawsadm/api/bootstrap/v1beta1/types.go

@@ -83,6 +83,12 @@ type AWSIAMRoleSpec struct {
 	// ExtraStatements are additional IAM statements to be included inline for the role.
 	ExtraStatements []iamv1.StatementEntry `json:"extraStatements,omitempty"`

+	// Path sets the path to the role.
+	Path string `json:"path,omitempty"`


Could you add the "optional" kubebuilder comment?

richardcase · 2025-01-29T18:28:14Z

cmd/clusterawsadm/api/bootstrap/v1beta1/types.go

+	Path string `json:"path,omitempty"`
+
+	// PermissionsBoundary sets the ARN of the managed policy that is used to set the permissions boundary for the role.
+	PermissionsBoundary string `json:"permissionsBoundary,omitempty"`


Same comment about optional.

richardcase · 2025-01-29T18:29:13Z

exp/api/v1beta1/awsfargateprofile_types.go

+	//
+	// This parameter is optional. If it is not included, it defaults to a slash
+	// (/).
+	RolePath string `json:"rolePath,omitempty"`


We don't need these in this API version (see previous comment).

k8s-ci-robot · 2025-01-29T18:32:37Z

@robinkb: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-aws-test	`5254562`	link	true	`/test pull-cluster-api-provider-aws-test`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

pavansokkenagaraj · 2025-01-30T15:54:38Z

@robinkb

Do these need to be changed, too? I didn't use the bootstrap proces, so I'm not really familiar with how it works.

Yes, roles/permissions which are created in template function for eks need to be updated.

ref: - https://github.com/pavansokkenagaraj/cluster-api-provider-aws/blob/c518150b3a4aeabb38cab546d8a89988307cd053/cmd/clusterawsadm/cloudformation/bootstrap/template.go#L201-L238

The other thing I had to do was to set the permissionsBoundary if it is not nil/empty
if permissionsBoundary is empty, AWS IAM role creation returns an err expecting permissionsBoundary to be length of greater than 0(This needs some testing)

https://github.com/pavansokkenagaraj/cluster-api-provider-aws/blob/c518150b3a4aeabb38cab546d8a89988307cd053/pkg/cloud/services/eks/iam/iam.go#L190-L203

robinkb · 2025-02-03T13:11:49Z

@pavansokkenagaraj Thanks for the testing, I will get that fixed.

Regarding the failing apidiff: How do we handle that? I don't see how I could fix this issue without breaking the API of that particular package, unless we want to add a whole other function.

richardcase · 2025-02-03T14:50:36Z

@robinkb - we don't need to worry about the apidiff if its outside an api directory. The project doesn't provider guarantees for the exported API types outside of the APIs.

richardcase · 2025-02-03T14:50:48Z

/override pull-cluster-api-provider-aws-apidiff-main

k8s-ci-robot · 2025-02-03T14:50:53Z

@richardcase: Overrode contexts on behalf of richardcase: pull-cluster-api-provider-aws-apidiff-main

In response to this:

/override pull-cluster-api-provider-aws-apidiff-main

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jan 16, 2025

k8s-ci-robot requested review from fiunchinho and richardcase January 16, 2025 12:03

k8s-ci-robot added the needs-priority label Jan 16, 2025

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 16, 2025

robinkb changed the title ~~WIP: ✨ Support setting role path and permissions boundary on managed IAM roles~~ ✨ Support setting role path and permissions boundary on managed IAM roles Jan 16, 2025

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 16, 2025

robinkb force-pushed the main branch from 376df9d to 9fdd445 Compare January 16, 2025 12:43

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jan 16, 2025

robinkb force-pushed the main branch from 9fdd445 to f55d22f Compare January 23, 2025 08:42

robinkb force-pushed the main branch from f55d22f to 4078bd9 Compare January 29, 2025 08:05

Support setting role path and permissions boundary for EKS control pl…

5254562

…ane, EKS fargate profile, and managed machine pools Signed-off-by: Robin Ketelbuters <[email protected]>

robinkb force-pushed the main branch from 4078bd9 to 5254562 Compare January 29, 2025 12:24

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 29, 2025

richardcase reviewed Jan 29, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Support setting role path and permissions boundary on managed IAM roles #5286

✨ Support setting role path and permissions boundary on managed IAM roles #5286

robinkb commented Jan 16, 2025 •

edited

Loading

linux-foundation-easycla bot commented Jan 16, 2025 •

edited

Loading

k8s-ci-robot commented Jan 16, 2025

k8s-ci-robot commented Jan 16, 2025

pavansokkenagaraj commented Jan 27, 2025 •

edited

Loading

robinkb commented Jan 29, 2025

robinkb commented Jan 29, 2025

richardcase commented Jan 29, 2025

richardcase Jan 29, 2025

robinkb Feb 3, 2025

richardcase Feb 3, 2025

richardcase Jan 29, 2025

richardcase Jan 29, 2025

richardcase Jan 29, 2025

k8s-ci-robot commented Jan 29, 2025 •

edited

Loading

pavansokkenagaraj commented Jan 30, 2025

robinkb commented Feb 3, 2025

richardcase commented Feb 3, 2025

richardcase commented Feb 3, 2025

k8s-ci-robot commented Feb 3, 2025

✨ Support setting role path and permissions boundary on managed IAM roles #5286

Are you sure you want to change the base?

✨ Support setting role path and permissions boundary on managed IAM roles #5286

Conversation

robinkb commented Jan 16, 2025 • edited Loading

linux-foundation-easycla bot commented Jan 16, 2025 • edited Loading

k8s-ci-robot commented Jan 16, 2025

k8s-ci-robot commented Jan 16, 2025

pavansokkenagaraj commented Jan 27, 2025 • edited Loading

robinkb commented Jan 29, 2025

robinkb commented Jan 29, 2025

richardcase commented Jan 29, 2025

richardcase Jan 29, 2025

Choose a reason for hiding this comment

robinkb Feb 3, 2025

Choose a reason for hiding this comment

richardcase Feb 3, 2025

Choose a reason for hiding this comment

richardcase Jan 29, 2025

Choose a reason for hiding this comment

richardcase Jan 29, 2025

Choose a reason for hiding this comment

richardcase Jan 29, 2025

Choose a reason for hiding this comment

k8s-ci-robot commented Jan 29, 2025 • edited Loading

pavansokkenagaraj commented Jan 30, 2025

robinkb commented Feb 3, 2025

richardcase commented Feb 3, 2025

richardcase commented Feb 3, 2025

k8s-ci-robot commented Feb 3, 2025

robinkb commented Jan 16, 2025 •

edited

Loading

linux-foundation-easycla bot commented Jan 16, 2025 •

edited

Loading

pavansokkenagaraj commented Jan 27, 2025 •

edited

Loading

k8s-ci-robot commented Jan 29, 2025 •

edited

Loading