Repository navigation
Add missing EFS CSI driver permissions (S3 Files, DescribeMountTargets) to efsCSIController well-known policy - #8907
Open
SivaSaiKrishnaSuryadevara wants to merge 1 commit into
Conversation
…olicy Add elasticfilesystem:DescribeMountTargets, ec2:DescribeAvailabilityZones and the s3files:* actions the driver requires for S3 Files support, and assert the rendered PolicyEFSCSIController document in iam_test.go. Closes eksctl-io#8906 Signed-off-by: Siva sai krishna Suryadevara <83085232+SivaSaiKrishnaSuryadevara@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes #8906.
Adds the actions the EFS CSI driver's example policy (
docs/iam-policy-example.json) requires but theefsCSIControllerwell-known policy lacks:Resource: *):elasticfilesystem:DescribeMountTargets,ec2:DescribeAvailabilityZones,s3files:ListAccessPoints,s3files:ListFileSystems.s3files:CreateAccessPoint,s3files:TagResourceands3files:DeleteAccessPoint, each added to the statement of itselasticfilesystem:counterpart so it carries the same tag condition.The
s3files:*actions came with the driver's S3 Files support (kubernetes-sigs/aws-efs-csi-driver@92c7793). No conditions or resources change; the existingRequestTagcondition onTagResourceandStringLikeonDeleteAccessPointare left as they are to keep this PR to added actions only.iam_test.gorenders a service account with all well-known policies but only asserts the Load Balancer Controller document. This PR adds the same assertion forPolicyEFSCSIController, so the rendered EFS policy is now pinned by a test.Checklist
README.md, or theuserdocsdirectory)go test ./pkg/cfn/builder/passes with the change; the new assertion fails against the previous statements.area/nodegroup) and kind (e.g.kind/improvement)BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯