Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

✨ Add support for AWS_CONTROLLER_IAM_ROLE env var #2100

Merged
merged 2 commits into from
Dec 3, 2020
Merged

✨ Add support for AWS_CONTROLLER_IAM_ROLE env var #2100

merged 2 commits into from
Dec 3, 2020

Conversation

MarcusNoble
Copy link
Contributor

What this PR does / why we need it:
Second attempt. See previous #2052

Provide the ability to set the AWS_CONTROLLER_IAM_ROLE environment var which will then be used to add an EKS annotation to the service account the management components run as. This will allow those components to run as that IAM role when using IAM for Service Accounts.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #2053

/assign @randomvariable

@k8s-ci-robot
Copy link
Contributor

Hi @MarcusNoble. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 9, 2020
@k8s-ci-robot k8s-ci-robot requested review from chuckha and ncdc November 9, 2020 08:55
@richardcase
Copy link
Member

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 9, 2020
@MarcusNoble
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e

@randomvariable
Copy link
Member

randomvariable commented Nov 9, 2020 •
edited
Loading

This isn't working because the service account is also being applied to the webhook server (which isn't needed), and the service account is only being created in capa-system.

https://storage.googleapis.com/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_cluster-api-provider-aws/2100/pull-cluster-api-provider-aws-e2e/1325783253608566784/artifacts/repository/infrastructure-aws/v0.5.0/components.yaml

@MarcusNoble
Copy link
Contributor Author

/test pull-cluster-api-provider-aws-e2e

@randomvariable randomvariable mentioned this pull request Nov 12, 2020
Closed
randomvariable
randomvariable reviewed Dec 2, 2020
View reviewed changes
bootstrap/eks/config/rbac/serviceaccount.yaml
labels:
control-plane: controller-manager
annotations:
${AWS_CONTROLLER_IAM_ROLE/#arn/eks.amazonaws.com/role-arn: arn}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add a comment to this one, as this is a very special hack that is specific to https://github.com/drone/envsubst, and doesn't work with gettext?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added.

Is there any scenario where this would be used with envsubst from gettext? Or are you just thinking about potential issues in the future?

Copy link
Member

@randomvariable randomvariable Dec 3, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

potential issues in the future. when we started using envsubst in clusterctl, everything broke and that was within a v1alpha3 release, so in case something happened again it'd be a little easier to diagnose.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to know! 👍

@randomvariable
Copy link
Member

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 3, 2020
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: randomvariable

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 3, 2020
@k8s-ci-robot k8s-ci-robot merged commit 14282e4 into kubernetes-sigs:master Dec 3, 2020
@MarcusNoble MarcusNoble deleted the irsa_management_cluster branch December 3, 2020 13:39
@sedefsavas sedefsavas mentioned this pull request Jan 4, 2021
Closed
@dhess dhess mentioned this pull request Nov 27, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@randomvariable randomvariable randomvariable left review comments

@chuckha chuckha Awaiting requested review from chuckha

@ncdc ncdc Awaiting requested review from ncdc

Assignees

@randomvariable randomvariable

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support using IAM for Service Accounts on the management cluster components
4 participants
@MarcusNoble @k8s-ci-robot @richardcase @randomvariable