chore: Scope CloudFormation Permissions #3948

jonathan-innis · 2023-05-26T20:07:09Z

Fixes #

Description

Updates CloudFormation permissions in the "Getting Started Guide" to be scoped to sufficiently restrict the tags that can be used when provisioning nodes with Karpenter. It also enforce tag-based authz on the karpenter controller by default.

Note that the CloudFormation file and the permissions that are provided there-in only serve as a starting point for users. The permissions will most likely have to be extended to some degree for most use-cases.

How was this change tested?

/karpenter snapshot

Does this change impact docs?

Yes, PR includes docs updates
Yes, issue opened: #
No

Release Note

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

netlify · 2023-05-26T20:07:17Z

✅ Deploy Preview for karpenter-docs-prod canceled.

Name	Link
🔨 Latest commit	`1d67741`
🔍 Latest deploy log	https://app.netlify.com/sites/karpenter-docs-prod/deploys/64960fd8bd5b9f000894eda7

jonathan-innis

/karpenter snapshot

github-actions · 2023-05-26T22:28:31Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-1ff134ec63873d1ffe7be3e6c5427d72d327e2a3. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

jonathan-innis

/karpenter snapshot

github-actions · 2023-05-26T22:58:46Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-1f058123e1f8e5727009a973ffcb2ce65467a6bc. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

jonathan-innis

/karpenter snapshot

github-actions · 2023-05-26T23:14:03Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-b292a3509cff30ec45a42da54025d9f2eae688dd. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

FernandoMiguel · 2023-05-29T09:48:56Z

I wonder if it is too much to ask that once you finish the cloudformation policy updates, if you wouldnt mind also updating the terraform ones?
https://github.com/terraform-aws-modules/terraform-aws-iam/blob/9cda42890147ee5c29c2c8eea3352e7f8d7446b9/modules/iam-role-for-service-accounts-eks/policies.tf#L586

https://github.com/terraform-aws-modules/terraform-aws-eks/blob/f741db1b2c7c4ef0409d7c2e4f588bbc639cbaf2/modules/karpenter/main.tf#L70

https://github.com/aws-ia/terraform-aws-eks-blueprints/blob/80bd3b92e0f82f45a187805d6d847db320a01c31/modules/kubernetes-addons/karpenter/data.tf#L3

cc @bryantbiggs

jonathan-innis · 2023-05-30T06:30:56Z

if you wouldnt mind also updating the terraform ones

@bryantbiggs There may be some room to align here. There are some cluster-scoped tags that Karpenter already uses by default that might be good to use as part of the default policy rather than asking the user to pass through an IRSA tag that they would also have to pass through to their AWSNodeTemplate.

website/content/en/preview/getting-started/getting-started-with-karpenter/cloudformation.yaml

jonathan-innis

/karpenter snapshot

github-actions · 2023-05-30T21:37:52Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-e62c0f74d611fe5d17e117a9cfbf3bae634ed6b1. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

website/content/en/preview/getting-started/getting-started-with-karpenter/cloudformation.yaml

jonathan-innis

/karpenter snapshot

github-actions · 2023-06-23T16:32:54Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-f561954506fc31963a3ab53fa3ea72f4f61d97b3. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

jonathan-innis

/karpenter snapshot

github-actions · 2023-06-23T17:51:14Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-7accfa79fec61a78510ee954e127b36c4da50dcc. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

jonathan-innis

/karpenter snapshot

github-actions · 2023-06-23T18:45:31Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-d4a2316d7ebdeabecfcaa69ef8d6dc0978129721. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

jonathan-innis

/karpenter snapshot

github-actions · 2023-06-23T21:41:32Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-1d6774142896ca27b785fda51ef59a2790a7cba7. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

jonathan-innis

/karpenter snapshot

github-actions · 2023-06-26T20:48:05Z

Snapshot successfully published to oci://public.ecr.aws/karpenter/karpenter:v0-1d6774142896ca27b785fda51ef59a2790a7cba7. Find the image tag and installation instructions at https://gallery.ecr.aws/karpenter/karpenter/

bwagner5

lgtm

jonathan-innis force-pushed the scope-getting-started-cf branch 2 times, most recently from d7f4de4 to 1ff134e Compare May 26, 2023 22:17

jonathan-innis changed the title ~~chore: Start scoping cloudformation permissions~~ [DRAFT] chore: Scope CloudFormation Permissions May 26, 2023

jonathan-innis commented May 26, 2023

View reviewed changes

jonathan-innis force-pushed the scope-getting-started-cf branch from 1ff134e to 1f05812 Compare May 26, 2023 22:48

jonathan-innis commented May 26, 2023

View reviewed changes

jonathan-innis force-pushed the scope-getting-started-cf branch from 1f05812 to b292a35 Compare May 26, 2023 23:11

jonathan-innis commented May 26, 2023

View reviewed changes

jonathan-innis force-pushed the scope-getting-started-cf branch 3 times, most recently from 0df15aa to 498a4bf Compare May 27, 2023 03:19

bwagner5 reviewed May 30, 2023

View reviewed changes

website/content/en/preview/getting-started/getting-started-with-karpenter/cloudformation.yaml Outdated Show resolved Hide resolved

jonathan-innis changed the title ~~[DRAFT] chore: Scope CloudFormation Permissions~~ chore: Scope CloudFormation Permissions May 30, 2023

jonathan-innis commented May 30, 2023

View reviewed changes

jonathan-innis marked this pull request as ready for review May 30, 2023 21:38

jonathan-innis requested a review from a team as a code owner May 30, 2023 21:38

jonathan-innis requested a review from bwagner5 May 30, 2023 21:38

jonathan-innis force-pushed the scope-getting-started-cf branch from e62c0f7 to d52d192 Compare May 30, 2023 21:44

jonathan-innis commented May 30, 2023

View reviewed changes

website/content/en/preview/getting-started/getting-started-with-karpenter/cloudformation.yaml Show resolved Hide resolved

bwagner5 reviewed May 31, 2023

View reviewed changes

website/content/en/preview/getting-started/getting-started-with-karpenter/cloudformation.yaml Outdated Show resolved Hide resolved

bwagner5 reviewed May 31, 2023

View reviewed changes

website/content/en/preview/getting-started/getting-started-with-karpenter/cloudformation.yaml Outdated Show resolved Hide resolved

jonathan-innis force-pushed the scope-getting-started-cf branch 2 times, most recently from ee2e43f to 4da472f Compare June 1, 2023 07:24

jonathan-innis commented Jun 23, 2023

View reviewed changes

jonathan-innis force-pushed the scope-getting-started-cf branch from f561954 to 7accfa7 Compare June 23, 2023 16:51

jonathan-innis commented Jun 23, 2023

View reviewed changes

jonathan-innis force-pushed the scope-getting-started-cf branch from 7accfa7 to d4a2316 Compare June 23, 2023 18:39

jonathan-innis commented Jun 23, 2023

View reviewed changes

jonathan-innis added 9 commits June 23, 2023 14:34

Start scoping cloudformation permissions

c35026f

Convert policy document to JSON string

6870874

Update cloudformation across versions

712ae76

Scope down policies to do tag-based authz

d85516b

PR comments

2a7daaa

Wildcard the account id for permissions

49e73ab

Inject tags used in testing in the cloudformation

4b592d8

Add sed replacement for GHA

d1711d6

Propagate changes to v0.28 docs

1d67741

jonathan-innis force-pushed the scope-getting-started-cf branch from d4a2316 to 1d67741 Compare June 23, 2023 21:34

jonathan-innis commented Jun 23, 2023

View reviewed changes

jonathan-innis commented Jun 26, 2023

View reviewed changes

bwagner5 approved these changes Jun 27, 2023

View reviewed changes

jonathan-innis enabled auto-merge (squash) June 27, 2023 18:01

jonathan-innis merged commit 49642f0 into aws:main Jun 27, 2023

jonathan-innis deleted the scope-getting-started-cf branch June 27, 2023 18:02

jonathan-innis mentioned this pull request Jun 29, 2023

Tighten IAM permissions around deletion #4159

Closed

mbarrien mentioned this pull request Oct 21, 2023

feat: IAM for Karpenter v1beta1 resources terraform-aws-modules/terraform-aws-eks#2788

Closed

3 tasks

This was referenced Oct 31, 2023

Karpenter IRSA IAM policy to be like blueprints one terraform-aws-modules/terraform-aws-eks#2733

Closed

feat: Add Karpenter v1beta1 compatibility terraform-aws-modules/terraform-aws-eks#2800

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Scope CloudFormation Permissions #3948

chore: Scope CloudFormation Permissions #3948

jonathan-innis commented May 26, 2023 •

edited

Loading

netlify bot commented May 26, 2023 •

edited

Loading

jonathan-innis left a comment

github-actions bot commented May 26, 2023

jonathan-innis left a comment

github-actions bot commented May 26, 2023

jonathan-innis left a comment

github-actions bot commented May 26, 2023

FernandoMiguel commented May 29, 2023

jonathan-innis commented May 30, 2023

jonathan-innis left a comment

github-actions bot commented May 30, 2023

jonathan-innis left a comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

github-actions bot commented Jun 26, 2023

bwagner5 left a comment

chore: Scope CloudFormation Permissions #3948

chore: Scope CloudFormation Permissions #3948

Conversation

jonathan-innis commented May 26, 2023 • edited Loading

netlify bot commented May 26, 2023 • edited Loading

✅ Deploy Preview for karpenter-docs-prod canceled.

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented May 26, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented May 26, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented May 26, 2023

FernandoMiguel commented May 29, 2023

jonathan-innis commented May 30, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented May 30, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented Jun 23, 2023

jonathan-innis left a comment

Choose a reason for hiding this comment

github-actions bot commented Jun 26, 2023

bwagner5 left a comment

Choose a reason for hiding this comment

jonathan-innis commented May 26, 2023 •

edited

Loading

netlify bot commented May 26, 2023 •

edited

Loading