Question: IAM and K8s Permissions

[VasifAghayev]

Hi! I want to implement eks-rolling-update tool with least privilege permissions in my environment. I have created IAM Role with required permissions listed in README.md file and found out that there is a typo in one of the permissions - ec2:DescribeInstances - should be with "s" at the end. If I am not wrong, "autoscaling:DescribeLaunchConfigurations" permission is required in addition to the listed in README for this utility to work with LaunchConfigurations too. Did anyone actually test this tool with permissions listed in README file?

Also, I’m planning to give least privilege permissions on kubernetes side – I have created such a ClusterRole:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: eks-rolling
rules:
  - apiGroups: [""]
    resources: ["pods/eviction"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["delete", "get", "list", "patch"]
  - apiGroups: ["apps"]
    resources: ["statefulsets"]
    verbs: ["get", "list"]
  - apiGroups: ["extensions"]
    resources: ["daemonsets", "replicasets"]
    verbs: ["get", "list"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["cluster-autoscaler"]
    verbs: ["update", "get"]

Could anyone please confirm if the permissions listed in this ClusterRole are sufficient for this utility to work properly? Many thanks