cluster-api-provider-aws icon indicating copy to clipboard operation
cluster-api-provider-aws copied to clipboard

Published 20 hours ago • verified publisher icon kubernetes-sigs

:bug: Ensure node role and fargate policies are included in IAM bootstrap permissions

Open adammw opened this issue 10 months ago • 7 comments
trafficstars

What type of PR is this? /kind bug

What this PR does / why we need it:

Adds the possible policies needed to the iam:GetPolicy condition, otherwise reconciliation will fail to fetch the policy when ensuring its attachment.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged): Fixes #5254

Special notes for your reviewer:

This requires all custom extraPolicyAttachments to be known at the bootstrap time. A wildcard iam:GetPolicy may be preferable, or changing the logic of how policies are ensured to not require the GetPolicy permission altogether (see #5266).

Checklist:

  • [ ] squashed commits
  • [ ] includes documentation
  • [x] includes emojis
  • [ ] adds unit tests
  • [ ] adds or updates e2e tests

Release note:

fix: bootstrap IAM policies will include permission to get node and fargate managed policies if applicable

adammw avatar Jan 07 '25 02:01 adammw