Expand TestPolicyGeneration to cover gossip/no-gossip cases

kubernetes · Jan 12, 2023 · f06f3c6 · f06f3c6
1 parent c1c75ca
commit f06f3c6
Show file tree

Hide file tree

Showing 7 changed files with 143 additions and 35 deletions.
diff --git a/pkg/model/iam/iam_builder_test.go b/pkg/model/iam/iam_builder_test.go
@@ -97,6 +97,7 @@ func TestRoundTrip(t *testing.T) {
 
 func TestPolicyGeneration(t *testing.T) {
 	grid := []struct {
+		Gossip                 bool
 		Role                   Subject
 		AllowContainerRegistry bool
 		Policy                 string
@@ -111,6 +112,18 @@ func TestPolicyGeneration(t *testing.T) {
 			AllowContainerRegistry: true,
 			Policy:                 "tests/iam_builder_master_strict_ecr.json",
 		},
+		{
+			Gossip:                 true,
+			Role:                   &NodeRoleMaster{},
+			AllowContainerRegistry: false,
+			Policy:                 "tests/iam_builder_master_strict.json",
+		},
+		{
+			Gossip:                 true,
+			Role:                   &NodeRoleMaster{},
+			AllowContainerRegistry: true,
+			Policy:                 "tests/iam_builder_master_strict_ecr.json",
+		},
 		{
 			Role:                   &NodeRoleNode{},
 			AllowContainerRegistry: false,
@@ -121,12 +134,36 @@ func TestPolicyGeneration(t *testing.T) {
 			AllowContainerRegistry: true,
 			Policy:                 "tests/iam_builder_node_strict_ecr.json",
 		},
+		{
+			Gossip:                 true,
+			Role:                   &NodeRoleNode{},
+			AllowContainerRegistry: false,
+			Policy:                 "tests/iam_builder_node_gossip.json",
+		},
+		{
+			Gossip:                 true,
+			Role:                   &NodeRoleNode{},
+			AllowContainerRegistry: true,
+			Policy:                 "tests/iam_builder_node_gossip_ecr.json",
+		},
+		{
+			Role:                   &NodeRoleBastion{},
+			AllowContainerRegistry: false,
+			Policy:                 "tests/iam_builder_bastion.json",
+		},
 		{
+			Role:                   &NodeRoleBastion{},
+			AllowContainerRegistry: true,
+			Policy:                 "tests/iam_builder_bastion.json",
+		},
+		{
+			Gossip:                 true,
 			Role:                   &NodeRoleBastion{},
 			AllowContainerRegistry: false,
 			Policy:                 "tests/iam_builder_bastion.json",
 		},
 		{
+			Gossip:                 true,
 			Role:                   &NodeRoleBastion{},
 			AllowContainerRegistry: true,
 			Policy:                 "tests/iam_builder_bastion.json",
@@ -178,7 +215,11 @@ func TestPolicyGeneration(t *testing.T) {
 			Role:      x.Role,
 			Partition: "aws-test",
 		}
-		b.Cluster.SetName("iam-builder-test.k8s.local")
+		if x.Gossip {
+			b.Cluster.SetName("iam-builder-test.k8s.local")
+		} else {
+			b.Cluster.SetName("iam-builder-test.nonexistant")
+		}
 
 		p, err := b.BuildAWSPolicy()
 		if err != nil {

diff --git a/pkg/model/iam/tests/iam_builder_master_strict.json b/pkg/model/iam/tests/iam_builder_master_strict.json
@@ -4,7 +4,7 @@
       "Action": "ec2:AttachVolume",
       "Condition": {
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local",
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant",
           "aws:ResourceTag/k8s.io/role/master": "1"
         }
       },
@@ -36,7 +36,7 @@
       "Action": "ec2:CreateTags",
       "Condition": {
         "StringEquals": {
-          "aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
+          "aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
           "ec2:CreateAction": [
             "CreateSecurityGroup"
           ]
@@ -57,7 +57,7 @@
           "aws:RequestTag/KubernetesCluster": "true"
         },
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",
@@ -69,7 +69,7 @@
       "Action": "ec2:CreateTags",
       "Condition": {
         "StringEquals": {
-          "aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
+          "aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
           "ec2:CreateAction": [
             "CreateVolume",
             "CreateSnapshot"
@@ -92,7 +92,7 @@
           "aws:RequestTag/KubernetesCluster": "true"
         },
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",
@@ -193,7 +193,7 @@
       ],
       "Condition": {
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",
@@ -210,7 +210,7 @@
       ],
       "Condition": {
         "StringEquals": {
-          "aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",

diff --git a/pkg/model/iam/tests/iam_builder_master_strict_ecr.json b/pkg/model/iam/tests/iam_builder_master_strict_ecr.json
@@ -4,7 +4,7 @@
       "Action": "ec2:AttachVolume",
       "Condition": {
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local",
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant",
           "aws:ResourceTag/k8s.io/role/master": "1"
         }
       },
@@ -36,7 +36,7 @@
       "Action": "ec2:CreateTags",
       "Condition": {
         "StringEquals": {
-          "aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
+          "aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
           "ec2:CreateAction": [
             "CreateSecurityGroup"
           ]
@@ -57,7 +57,7 @@
           "aws:RequestTag/KubernetesCluster": "true"
         },
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",
@@ -69,7 +69,7 @@
       "Action": "ec2:CreateTags",
       "Condition": {
         "StringEquals": {
-          "aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local",
+          "aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant",
           "ec2:CreateAction": [
             "CreateVolume",
             "CreateSnapshot"
@@ -92,7 +92,7 @@
           "aws:RequestTag/KubernetesCluster": "true"
         },
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",
@@ -200,7 +200,7 @@
       ],
       "Condition": {
         "StringEquals": {
-          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:ResourceTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",
@@ -217,7 +217,7 @@
       ],
       "Condition": {
         "StringEquals": {
-          "aws:RequestTag/KubernetesCluster": "iam-builder-test.k8s.local"
+          "aws:RequestTag/KubernetesCluster": "iam-builder-test.nonexistant"
         }
       },
       "Effect": "Allow",

diff --git a/pkg/model/iam/tests/iam_builder_node_gossip.json b/pkg/model/iam/tests/iam_builder_node_gossip.json
@@ -0,0 +1,40 @@
+{
+  "Statement": [
+    {
+      "Action": [
+        "s3:Get*"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/cluster-completed.spec",
+        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/igconfig/node/*"
+      ]
+    },
+    {
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:GetEncryptionConfiguration",
+        "s3:ListBucket",
+        "s3:ListBucketVersions"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws-test:s3:::kops-tests"
+      ]
+    },
+    {
+      "Action": [
+        "autoscaling:DescribeAutoScalingInstances",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeInstances",
+        "ec2:DescribeRegions",
+        "iam:GetServerCertificate",
+        "iam:ListServerCertificates",
+        "kms:GenerateRandom"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ],
+  "Version": "2012-10-17"
+}
diff --git a/pkg/model/iam/tests/iam_builder_node_gossip_ecr.json b/pkg/model/iam/tests/iam_builder_node_gossip_ecr.json
@@ -0,0 +1,47 @@
+{
+  "Statement": [
+    {
+      "Action": [
+        "s3:Get*"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/cluster-completed.spec",
+        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/igconfig/node/*"
+      ]
+    },
+    {
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:GetEncryptionConfiguration",
+        "s3:ListBucket",
+        "s3:ListBucketVersions"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws-test:s3:::kops-tests"
+      ]
+    },
+    {
+      "Action": [
+        "autoscaling:DescribeAutoScalingInstances",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeInstances",
+        "ec2:DescribeRegions",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:BatchGetImage",
+        "ecr:DescribeRepositories",
+        "ecr:GetAuthorizationToken",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:GetRepositoryPolicy",
+        "ecr:ListImages",
+        "iam:GetServerCertificate",
+        "iam:ListServerCertificates",
+        "kms:GenerateRandom"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ],
+  "Version": "2012-10-17"
+}
diff --git a/pkg/model/iam/tests/iam_builder_node_strict.json b/pkg/model/iam/tests/iam_builder_node_strict.json
@@ -1,15 +1,5 @@
 {
   "Statement": [
-    {
-      "Action": [
-        "s3:Get*"
-      ],
-      "Effect": "Allow",
-      "Resource": [
-        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/cluster-completed.spec",
-        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/igconfig/node/*"
-      ]
-    },
     {
       "Action": [
         "s3:GetBucketLocation",

diff --git a/pkg/model/iam/tests/iam_builder_node_strict_ecr.json b/pkg/model/iam/tests/iam_builder_node_strict_ecr.json
@@ -1,15 +1,5 @@
 {
   "Statement": [
-    {
-      "Action": [
-        "s3:Get*"
-      ],
-      "Effect": "Allow",
-      "Resource": [
-        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/cluster-completed.spec",
-        "arn:aws-test:s3:::kops-tests/iam-builder-test.k8s.local/igconfig/node/*"
-      ]
-    },
     {
       "Action": [
         "s3:GetBucketLocation",