Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Gateway-api-controller lacks permissions to create and describe required resources #329

Merged

Conversation

neelaruban
Copy link
Contributor

@neelaruban neelaruban commented Dec 7, 2023

gateway-api-controller lacks permissions to do its job

What does this PR do?

The api gateway controller addon lacks permissions to create httproutes as it currently throwing up errors

{"level":"debug","ts":"2023-12-06T23:49:12.024Z","logger":"controller.route","caller":"lattice/target_group_synthesizer.go:81","msg":"Failed TargetGroupManager.Upsert k8s-default-parking due to AccessDeniedException: User: arn:aws:sts::331334982285:assumed-role/aws-gateway-api-controller-20231206231429634800000015/1701904568794509513 is not authorized to perform: tag:GetResources because no identity-based policy allows the tag:GetResources action\n\tstatus code: 400, request id: 884a076d-a781-49e3-8404-7236d80533bd"}
{"level":"debug","ts":"2023-12-06T23:49:12.102Z","logger":"cloud","caller":"aws/cloud.go:58","msg":"error","error":"AccessDeniedException: User: arn:aws:sts::331334982285:assumed-role/aws-gateway-api-controller-20231206231429634800000015/1701904568794509513 is not authorized to perform: tag:GetResources because no identity-based policy allows the tag:GetResources action\n\tstatus code: 400, request id: 91f30cbb-00f1-4e8f-b0ca-1de568aa0f2a","serviceName":"tagging","operation":"GetResources","params":"{\n  ResourceTypeFilters: [\"vpc-lattice:targetgroup\"],\n  TagFilters: [\n    {\n      Key: \"application-networking.k8s.aws/ServiceNamespace\",\n      Values: [\"default\"]\n    },\n    {\n      Key: \"application-networking.k8s.aws/SourceTypeKey\",\n      Values: [\"HTTPRoute\"]\n    },\n    {\n      Key: \"application-networking.k8s.aws/ProtocolVersion\",\n      Values: [\"HTTP1\"]\n    },\n    {\n      Key: \"application-networking.k8s.aws/RouteName\",\n      Values: [\"rates\"]\n    },\n    {\n      Key: \"application-networking.k8s.aws/RouteNamespace\",\n      Values: [\"default\"]\n    },\n    {\n      Key: \"application-networking.k8s.aws/ClusterName\",\n      Values: [\"cluster1\"]\n    },\n    {\n      Key: \"a

as it turns out that it lacks few more permissions to do its job as deduced from the official documentation

🛑 Please open an issue first to discuss any significant work and flesh out details/direction - we would hate for your time to be wasted.
Consult the CONTRIBUTING guide for submitting pull-requests.

Motivation

More

  • Yes, I have tested the PR using my local account setup (Provide any test evidence report under Additional Notes)
  • Yes, I ran pre-commit run -a with this PR

For Moderators

  • E2E Test successfully complete before merge?

Additional Notes

@neelaruban neelaruban requested a review from a team as a code owner December 7, 2023 00:41
@neelaruban neelaruban changed the title gateway-api-controller lacks permissions to do its job fix: Gateway-api-controller lacks permissions to do its job Dec 7, 2023
@rodrigobersa rodrigobersa changed the title fix: Gateway-api-controller lacks permissions to do its job fix: gateway-api-controller lacks permissions to create and describe required resources Dec 7, 2023
Copy link
Contributor

@rodrigobersa rodrigobersa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR!

@rodrigobersa rodrigobersa changed the title fix: gateway-api-controller lacks permissions to create and describe required resources fix: Gateway-api-controller lacks permissions to create and describe required resources Dec 7, 2023
Copy link
Contributor

@askulkarni2 askulkarni2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍🏽

@rodrigobersa rodrigobersa merged commit 1f7cf9c into aws-ia:main Dec 7, 2023
7 of 11 checks passed
@neelaruban neelaruban deleted the api-gateway-controller-policy-fix branch December 15, 2023 00:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

The api gateway controller addon lacks permissions to create httproutes as it currently throwing up errors
4 participants