diff --git a/pkg/cfn/builder/karpenter.go b/pkg/cfn/builder/karpenter.go index dc1ac5c3fb..5a42218aba 100644 --- a/pkg/cfn/builder/karpenter.go +++ b/pkg/cfn/builder/karpenter.go @@ -49,9 +49,15 @@ const ( ec2DescribeImages = "ec2:DescribeImages" ec2DescribeSpotPriceHistory = "ec2:DescribeSpotPriceHistory" // IAM - iamPassRole = "iam:PassRole" - iamCreateServiceLinkedRole = "iam:CreateServiceLinkedRole" - ssmGetParameter = "ssm:GetParameter" + iamPassRole = "iam:PassRole" + iamCreateServiceLinkedRole = "iam:CreateServiceLinkedRole" + iamGetInstanceProfile = "iam:GetInstanceProfile" + iamCreateInstanceProfile = "iam:CreateInstanceProfile" + iamDeleteInstanceProfile = "iam:DeleteInstanceProfile" + iamTagInstanceProfile = "iam:TagInstanceProfile" + iamAddRoleToInstanceProfile = "iam:AddRoleToInstanceProfile" + // SSM + ssmGetParameter = "ssm:GetParameter" // Pricing pricingGetProducts = "pricing:GetProducts" // SQS @@ -165,6 +171,11 @@ func (k *KarpenterResourceSet) addResourcesForKarpenter() error { ec2DescribeSpotPriceHistory, iamPassRole, iamCreateServiceLinkedRole, + iamGetInstanceProfile, + iamCreateInstanceProfile, + iamDeleteInstanceProfile, + iamTagInstanceProfile, + iamAddRoleToInstanceProfile, ssmGetParameter, pricingGetProducts, }, diff --git a/pkg/cfn/builder/karpenter_test.go b/pkg/cfn/builder/karpenter_test.go index 11935ea3a1..39605cd7ce 100644 --- a/pkg/cfn/builder/karpenter_test.go +++ b/pkg/cfn/builder/karpenter_test.go @@ -125,6 +125,11 @@ var expectedTemplate = `{ "ec2:DescribeSpotPriceHistory", "iam:PassRole", "iam:CreateServiceLinkedRole", + "iam:GetInstanceProfile", + "iam:CreateInstanceProfile", + "iam:DeleteInstanceProfile", + "iam:TagInstanceProfile", + "iam:AddRoleToInstanceProfile", "ssm:GetParameter", "pricing:GetProducts" ], @@ -262,6 +267,11 @@ var expectedTemplateWithPermissionBoundary = `{ "ec2:DescribeSpotPriceHistory", "iam:PassRole", "iam:CreateServiceLinkedRole", + "iam:GetInstanceProfile", + "iam:CreateInstanceProfile", + "iam:DeleteInstanceProfile", + "iam:TagInstanceProfile", + "iam:AddRoleToInstanceProfile", "ssm:GetParameter", "pricing:GetProducts" ], @@ -424,6 +434,11 @@ var expectedTemplateWithSpotInterruptionQueue = `{ "ec2:DescribeSpotPriceHistory", "iam:PassRole", "iam:CreateServiceLinkedRole", + "iam:GetInstanceProfile", + "iam:CreateInstanceProfile", + "iam:DeleteInstanceProfile", + "iam:TagInstanceProfile", + "iam:AddRoleToInstanceProfile", "ssm:GetParameter", "pricing:GetProducts" ],