Skip to content

Commit eeddf86

Browse files
sunilarjunsunilarjun
authored
Merge pull request #1585 from yiannistri/1582-eks-permissions
docs: Move `eks:DescribeAddon` permission to minimum set of required permissions
2 parents 50ccf01 + f0ae84e commit eeddf86

File tree

3 files changed

+99
-258
lines changed
  • docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers
  • versioned_docs
    • version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers
    • version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers

3 files changed

+99
-258
lines changed

‎docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md

Lines changed: 33 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -93,16 +93,14 @@ This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-ra
9393

9494
## Minimum EKS Permissions
9595

96-
These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources **before** you create the cluster, they'll be available when you configure the cluster.
96+
These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
9797

9898
:::note
9999
In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volumes. You need [specific permissions](#ebs-csi-driver-addon-permissions) to enable this add-on.
100100
:::
101101

102102
Resource | Description
103103
---------|------------
104-
Service Role | Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following [Service Role Permissions](#service-role-permissions).
105-
VPC | Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following [VPC Permissions](#vpc-permissions).
106104
EBS CSI Driver add-on | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following [EBS CSI Driver addon Permissions](#ebs-csi-driver-addon-permissions).
107105

108106

@@ -167,18 +165,23 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
167165
"Sid": "IAMPermissions",
168166
"Effect": "Allow",
169167
"Action": [
168+
"iam:AddRoleToInstanceProfile",
170169
"iam:AttachRolePolicy",
170+
"iam:CreateInstanceProfile",
171171
"iam:CreateRole",
172-
"iam:DetachRolePolicy",
172+
"iam:CreateServiceLinkedRole",
173+
"iam:DeleteInstanceProfile",
173174
"iam:DeleteRole",
174-
"iam:GetRole",
175+
"iam:DetachRolePolicy",
175176
"iam:GetInstanceProfile",
177+
"iam:GetRole",
176178
"iam:ListAttachedRolePolicies",
177-
"iam:ListInstanceProfilesForRole",
178179
"iam:ListInstanceProfiles",
180+
"iam:ListInstanceProfilesForRole",
179181
"iam:ListRoles",
180182
"iam:ListRoleTags",
181-
"iam:PassRole"
183+
"iam:PassRole",
184+
"iam:RemoveRoleFromInstanceProfile",
182185
"iam:TagRole"
183186
],
184187
"Resource": "*"
@@ -199,6 +202,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
199202
"eks:DeleteCluster",
200203
"eks:DeleteFargateProfile",
201204
"eks:DeleteNodegroup",
205+
"eks:DescribeAddon",
202206
"eks:DescribeCluster",
203207
"eks:DescribeFargateProfile",
204208
"eks:DescribeNodegroup",
@@ -216,41 +220,31 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
216220
"eks:UpdateNodegroupVersion"
217221
],
218222
"Resource": "*"
219-
}
220-
]
221-
}
222-
```
223-
224-
### Service Role Permissions
225-
226-
These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf.
227-
228-
```json
229-
{
230-
"Version": "2012-10-17",
231-
"Statement": [
223+
},
232224
{
233-
"Sid": "IAMPermissions",
225+
"Sid": "VPCPermissions",
234226
"Effect": "Allow",
235227
"Action": [
236-
"iam:AddRoleToInstanceProfile",
237-
"iam:AttachRolePolicy",
238-
"iam:CreateInstanceProfile",
239-
"iam:CreateRole",
240-
"iam:CreateServiceLinkedRole",
241-
"iam:DeleteInstanceProfile",
242-
"iam:DeleteRole",
243-
"iam:DetachRolePolicy",
244-
"iam:GetInstanceProfile",
245-
"iam:GetRole",
246-
"iam:ListAttachedRolePolicies",
247-
"iam:ListInstanceProfiles",
248-
"iam:ListInstanceProfilesForRole",
249-
"iam:ListRoles",
250-
"iam:ListRoleTags",
251-
"iam:PassRole",
252-
"iam:RemoveRoleFromInstanceProfile",
253-
"iam:TagRole"
228+
"ec2:AssociateRouteTable",
229+
"ec2:AttachInternetGateway",
230+
"ec2:CreateInternetGateway",
231+
"ec2:CreateRoute",
232+
"ec2:CreateRouteTable",
233+
"ec2:CreateSecurityGroup",
234+
"ec2:CreateSubnet",
235+
"ec2:CreateVpc",
236+
"ec2:DeleteInternetGateway",
237+
"ec2:DeleteRoute",
238+
"ec2:DeleteRouteTable",
239+
"ec2:DeleteSubnet",
240+
"ec2:DeleteTags",
241+
"ec2:DeleteVpc",
242+
"ec2:DescribeVpcs",
243+
"ec2:DetachInternetGateway",
244+
"ec2:DisassociateRouteTable",
245+
"ec2:ModifySubnetAttribute",
246+
"ec2:ModifyVpcAttribute",
247+
"ec2:ReplaceRoute"
254248
],
255249
"Resource": "*"
256250
}
@@ -283,45 +277,6 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
283277
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
284278
```
285279

286-
### VPC Permissions
287-
288-
These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources.
289-
290-
```json
291-
{
292-
"Version": "2012-10-17",
293-
"Statement": [
294-
{
295-
"Sid": "VPCPermissions",
296-
"Effect": "Allow",
297-
"Action": [
298-
"ec2:AssociateRouteTable",
299-
"ec2:AttachInternetGateway",
300-
"ec2:CreateInternetGateway",
301-
"ec2:CreateRoute",
302-
"ec2:CreateRouteTable",
303-
"ec2:CreateSecurityGroup",
304-
"ec2:CreateSubnet",
305-
"ec2:CreateVpc",
306-
"ec2:DeleteInternetGateway",
307-
"ec2:DeleteRoute",
308-
"ec2:DeleteRouteTable",
309-
"ec2:DeleteSubnet",
310-
"ec2:DeleteTags",
311-
"ec2:DeleteVpc",
312-
"ec2:DescribeVpcs",
313-
"ec2:DetachInternetGateway",
314-
"ec2:DisassociateRouteTable",
315-
"ec2:ModifySubnetAttribute",
316-
"ec2:ModifyVpcAttribute",
317-
"ec2:ReplaceRoute"
318-
],
319-
"Resource": "*"
320-
}
321-
]
322-
}
323-
```
324-
325280
### EBS CSI Driver addon Permissions
326281

327282
The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
@@ -336,22 +291,14 @@ The following are the required permissions for installing the Amazon EBS CSI Dri
336291
"eks:AssociateIdentityProviderConfig",
337292
"eks:CreateAddon",
338293
"eks:DeleteAddon",
339-
"eks:DescribeAddon",
340294
"eks:DescribeAddonConfiguration",
341295
"eks:DescribeAddonVersions",
342-
"eks:DescribeCluster",
343296
"eks:DescribeIdentityProviderConfig",
344297
"eks:ListAddons",
345298
"eks:ListIdentityProviderConfigs",
346299
"eks:UpdateAddon",
347-
"iam:AttachRolePolicy",
348300
"iam:CreateOpenIDConnectProvider",
349-
"iam:CreateRole",
350-
"iam:GetRole",
351-
"iam:ListAttachedRolePolicies",
352301
"iam:ListOpenIDConnectProviders",
353-
"iam:PassRole",
354-
"iam:TagRole",
355302
"sts:AssumeRoleWithWebIdentity"
356303
],
357304
"Resource": "*"

‎versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md

Lines changed: 33 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -93,16 +93,14 @@ This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-ra
9393

9494
## Minimum EKS Permissions
9595

96-
These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources **before** you create the cluster, they'll be available when you configure the cluster.
96+
These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary.
9797

9898
:::note
9999
In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volumes. You need [specific permissions](#ebs-csi-driver-addon-permissions) to enable this add-on.
100100
:::
101101

102102
Resource | Description
103103
---------|------------
104-
Service Role | Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following [Service Role Permissions](#service-role-permissions).
105-
VPC | Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following [VPC Permissions](#vpc-permissions).
106104
EBS CSI Driver add-on | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following [EBS CSI Driver addon Permissions](#ebs-csi-driver-addon-permissions).
107105

108106

@@ -167,18 +165,23 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
167165
"Sid": "IAMPermissions",
168166
"Effect": "Allow",
169167
"Action": [
168+
"iam:AddRoleToInstanceProfile",
170169
"iam:AttachRolePolicy",
170+
"iam:CreateInstanceProfile",
171171
"iam:CreateRole",
172-
"iam:DetachRolePolicy",
172+
"iam:CreateServiceLinkedRole",
173+
"iam:DeleteInstanceProfile",
173174
"iam:DeleteRole",
174-
"iam:GetRole",
175+
"iam:DetachRolePolicy",
175176
"iam:GetInstanceProfile",
177+
"iam:GetRole",
176178
"iam:ListAttachedRolePolicies",
177-
"iam:ListInstanceProfilesForRole",
178179
"iam:ListInstanceProfiles",
180+
"iam:ListInstanceProfilesForRole",
179181
"iam:ListRoles",
180182
"iam:ListRoleTags",
181-
"iam:PassRole"
183+
"iam:PassRole",
184+
"iam:RemoveRoleFromInstanceProfile",
182185
"iam:TagRole"
183186
],
184187
"Resource": "*"
@@ -199,6 +202,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
199202
"eks:DeleteCluster",
200203
"eks:DeleteFargateProfile",
201204
"eks:DeleteNodegroup",
205+
"eks:DescribeAddon",
202206
"eks:DescribeCluster",
203207
"eks:DescribeFargateProfile",
204208
"eks:DescribeNodegroup",
@@ -216,41 +220,31 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
216220
"eks:UpdateNodegroupVersion"
217221
],
218222
"Resource": "*"
219-
}
220-
]
221-
}
222-
```
223-
224-
### Service Role Permissions
225-
226-
These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf.
227-
228-
```json
229-
{
230-
"Version": "2012-10-17",
231-
"Statement": [
223+
},
232224
{
233-
"Sid": "IAMPermissions",
225+
"Sid": "VPCPermissions",
234226
"Effect": "Allow",
235227
"Action": [
236-
"iam:AddRoleToInstanceProfile",
237-
"iam:AttachRolePolicy",
238-
"iam:CreateInstanceProfile",
239-
"iam:CreateRole",
240-
"iam:CreateServiceLinkedRole",
241-
"iam:DeleteInstanceProfile",
242-
"iam:DeleteRole",
243-
"iam:DetachRolePolicy",
244-
"iam:GetInstanceProfile",
245-
"iam:GetRole",
246-
"iam:ListAttachedRolePolicies",
247-
"iam:ListInstanceProfiles",
248-
"iam:ListInstanceProfilesForRole",
249-
"iam:ListRoles",
250-
"iam:ListRoleTags",
251-
"iam:PassRole",
252-
"iam:RemoveRoleFromInstanceProfile",
253-
"iam:TagRole"
228+
"ec2:AssociateRouteTable",
229+
"ec2:AttachInternetGateway",
230+
"ec2:CreateInternetGateway",
231+
"ec2:CreateRoute",
232+
"ec2:CreateRouteTable",
233+
"ec2:CreateSecurityGroup",
234+
"ec2:CreateSubnet",
235+
"ec2:CreateVpc",
236+
"ec2:DeleteInternetGateway",
237+
"ec2:DeleteRoute",
238+
"ec2:DeleteRouteTable",
239+
"ec2:DeleteSubnet",
240+
"ec2:DeleteTags",
241+
"ec2:DeleteVpc",
242+
"ec2:DescribeVpcs",
243+
"ec2:DetachInternetGateway",
244+
"ec2:DisassociateRouteTable",
245+
"ec2:ModifySubnetAttribute",
246+
"ec2:ModifyVpcAttribute",
247+
"ec2:ReplaceRoute"
254248
],
255249
"Resource": "*"
256250
}
@@ -283,45 +277,6 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
283277
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
284278
```
285279

286-
### VPC Permissions
287-
288-
These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources.
289-
290-
```json
291-
{
292-
"Version": "2012-10-17",
293-
"Statement": [
294-
{
295-
"Sid": "VPCPermissions",
296-
"Effect": "Allow",
297-
"Action": [
298-
"ec2:AssociateRouteTable",
299-
"ec2:AttachInternetGateway",
300-
"ec2:CreateInternetGateway",
301-
"ec2:CreateRoute",
302-
"ec2:CreateRouteTable",
303-
"ec2:CreateSecurityGroup",
304-
"ec2:CreateSubnet",
305-
"ec2:CreateVpc",
306-
"ec2:DeleteInternetGateway",
307-
"ec2:DeleteRoute",
308-
"ec2:DeleteRouteTable",
309-
"ec2:DeleteSubnet",
310-
"ec2:DeleteTags",
311-
"ec2:DeleteVpc",
312-
"ec2:DescribeVpcs",
313-
"ec2:DetachInternetGateway",
314-
"ec2:DisassociateRouteTable",
315-
"ec2:ModifySubnetAttribute",
316-
"ec2:ModifyVpcAttribute",
317-
"ec2:ReplaceRoute"
318-
],
319-
"Resource": "*"
320-
}
321-
]
322-
}
323-
```
324-
325280
### EBS CSI Driver addon Permissions
326281

327282
The following are the required permissions for installing the Amazon EBS CSI Driver add-on.
@@ -336,22 +291,14 @@ The following are the required permissions for installing the Amazon EBS CSI Dri
336291
"eks:AssociateIdentityProviderConfig",
337292
"eks:CreateAddon",
338293
"eks:DeleteAddon",
339-
"eks:DescribeAddon",
340294
"eks:DescribeAddonConfiguration",
341295
"eks:DescribeAddonVersions",
342-
"eks:DescribeCluster",
343296
"eks:DescribeIdentityProviderConfig",
344297
"eks:ListAddons",
345298
"eks:ListIdentityProviderConfigs",
346299
"eks:UpdateAddon",
347-
"iam:AttachRolePolicy",
348300
"iam:CreateOpenIDConnectProvider",
349-
"iam:CreateRole",
350-
"iam:GetRole",
351-
"iam:ListAttachedRolePolicies",
352301
"iam:ListOpenIDConnectProviders",
353-
"iam:PassRole",
354-
"iam:TagRole",
355302
"sts:AssumeRoleWithWebIdentity"
356303
],
357304
"Resource": "*"

0 commit comments

Comments
 (0)