✨ Made changes for clusteradm accept to create role and policies on hub #819
Conversation
Signed-off-by: “Jeffrey <[email protected]>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: alex0chan The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: “Jeffrey <[email protected]>
Signed-off-by: “Jeffrey <[email protected]>
…reation Signed-off-by: “Jeffrey <[email protected]>
| "Effect": "Allow", | ||
| "Action": [ | ||
| "eks:DescribeCluster", | ||
| "eks:ListClusters" |
There was a problem hiding this comment.
I think these permissions are not needed as we are copying cert authority data from bootstrap kubeconfig.
pkg/common/helpers/helpers.go
Outdated
There was a problem hiding this comment.
If we have a similar method used by kluster-agent, can we reuse it?
| @@ -203,6 +210,21 @@ func (c *managedClusterController) sync(ctx context.Context, syncCtx factory.Syn | |||
| } | |||
| } | |||
|
|
|||
| // Only create new IAM roles when status is not present | |||
| if !meta.IsStatusConditionTrue(managedCluster.Status.Conditions, v1.ManagedClusterConditionHubAccepted) { | |||
There was a problem hiding this comment.
Would it make sense to remove this if condition and overwrite role, policy and access entry on every reconciliation? This would also ensure that the IAM resources are repaired if somebody accidentally or intentionally changes them manually.
Also suggesting to overwrite directly instead of making a get call first and them comparing, to save an api call.
…error Signed-off-by: “Jeffrey <[email protected]>
Yes I guess this is still WIP, we created PR to get early feedback. |
| @@ -203,6 +210,21 @@ func (c *managedClusterController) sync(ctx context.Context, syncCtx factory.Syn | |||
| } | |||
| } | |||
|
|
|||
| // Only create new IAM roles when status is not present | |||
| if !meta.IsStatusConditionTrue(managedCluster.Status.Conditions, v1.ManagedClusterConditionHubAccepted) { | |||
| clusterManager, err := c.operatorClient.OperatorV1().ClusterManagers().Get(context.TODO(), "cluster-manager", metav1.GetOptions{}) | |||
There was a problem hiding this comment.
Instead of making this API server call and adding another permission to clusterrole, can we instead pass this info from clustermanager CR to registration-controller on hub through these command line options similar to this?
Signed-off-by: suvaanshkumar <[email protected]>
suvaanshkumar
force-pushed
the
GWCP-65858-clusteradm-accept_bkp
branch
from
63faa0b to
76289f7
Compare
…ion and tested by created new image Signed-off-by: suvaanshkumar <[email protected]>
Signed-off-by: suvaanshkumar <[email protected]>
|
I am wondering whether we need to import aws sdk here, or we just ask user to install aws cli as the prereq? |
Summary
This PR has the enhancement for clusteradm accept to create roles and policies on the hub
Related issue(s)
Ref: #514