Skip to content

Commit e6cc69b

Browse files
Gezi-lzqGezi-lzq
authored
feat: add Kubernetes IAM policy and update role attachment logic base… (#27)
* feat: add Kubernetes IAM policy and update role attachment logic based on deploy type * fix: remove unnecessary S3 ListBucket action from IAM policy template * feat: add IAM roles and policies for AutoMQ BYOC node deployment in Kubernetes * feat: add documentation links for IAM role policies in aws.tf
1 parent f3fa992 commit e6cc69b

7 files changed

+485
-10
lines changed

‎aws.tf‎

Lines changed: 91 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,81 @@ resource "aws_iam_role" "automq_byoc_role" {
233233
}
234234
}
235235

236+
resource "aws_iam_role" "automq_byoc_node_role" {
237+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
238+
name = "automq-byoc-node-role-${var.automq_byoc_env_id}"
239+
240+
assume_role_policy = jsonencode({
241+
Version = "2012-10-17"
242+
Statement = [
243+
{
244+
Action = "sts:AssumeRole"
245+
Effect = "Allow"
246+
Sid = ""
247+
Principal = {
248+
Service = "ec2.amazonaws.com"
249+
}
250+
},
251+
]
252+
})
253+
254+
tags = {
255+
automqVendor = "automq"
256+
automqEnvironmentID = var.automq_byoc_env_id
257+
}
258+
}
259+
260+
# https://docs.aws.amazon.com/zh_cn/eks/latest/userguide/create-node-role.html
261+
resource "aws_iam_role_policy_attachment" "nodes-AmazonEKSWorkerNodePolicy" {
262+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
263+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
264+
role = aws_iam_role.automq_byoc_node_role[0].name
265+
}
266+
267+
resource "aws_iam_role_policy_attachment" "nodes-AmazonEKS_CNI_Policy" {
268+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
269+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
270+
role = aws_iam_role.automq_byoc_node_role[0].name
271+
}
272+
273+
resource "aws_iam_role_policy_attachment" "nodes-AmazonEC2ContainerRegistryReadOnly" {
274+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
275+
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
276+
role = aws_iam_role.automq_byoc_node_role[0].name
277+
}
278+
279+
# https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/installation/#option-b-attach-iam-policies-to-nodes
280+
resource "aws_iam_role_policy" "aws_load-balancer_policy" {
281+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
282+
name = "aws-load-balancer-controller-service-policy-${var.automq_byoc_env_id}"
283+
role = aws_iam_role.automq_byoc_node_role[0].name
284+
285+
policy = file("${path.module}/tpls/aws_load_balancer_controller_service_policy.json.tpl")
286+
}
287+
288+
# https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md
289+
resource "aws_iam_role_policy" "aws_cluster_auto_scaler_policy" {
290+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
291+
name = "aws-cluster-auto-scaler-policy-${var.automq_byoc_env_id}"
292+
role = aws_iam_role.automq_byoc_node_role[0].name
293+
294+
policy = file("${path.module}/tpls/aws_cluster_auto_scaler_policy.json.tpl")
295+
}
296+
297+
resource "aws_iam_role_policy" "automq_s3_policy" {
298+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
299+
name = "automq-s3-policy-${var.automq_byoc_env_id}"
300+
role = aws_iam_role.automq_byoc_node_role[0].name
301+
302+
policy = templatefile("${path.module}/tpls/automq_node_s3_policy.json.tpl", {
303+
automq_data_bucket = local.automq_data_bucket
304+
automq_ops_bucket = local.automq_ops_bucket
305+
})
306+
}
307+
308+
236309
resource "aws_iam_policy" "automq_byoc_policy" {
310+
count = var.automq_byoc_default_deploy_type == "vm" ? 1 : 0
237311
name = "automq-byoc-service-policy-${var.automq_byoc_env_id}"
238312
description = "Custom policy for automq_byoc service"
239313

@@ -248,9 +322,25 @@ resource "aws_iam_policy" "automq_byoc_policy" {
248322
}
249323
}
250324

325+
resource "aws_iam_policy" "automq_byoc_k8s_policy" {
326+
count = var.automq_byoc_default_deploy_type == "k8s" ? 1 : 0
327+
name = "automq-byoc-service-k8s-policy-${var.automq_byoc_env_id}"
328+
description = "Custom policy for automq_byoc service"
329+
330+
policy = templatefile("${path.module}/tpls/automq_byoc_role_k8s_policy.json.tpl", {
331+
automq_data_bucket = local.automq_data_bucket
332+
automq_ops_bucket = local.automq_ops_bucket
333+
})
334+
335+
tags = {
336+
automqVendor = "automq"
337+
automqEnvironmentID = var.automq_byoc_env_id
338+
}
339+
}
340+
251341
resource "aws_iam_role_policy_attachment" "automq_byoc_role_attachment" {
252342
role = aws_iam_role.automq_byoc_role.name
253-
policy_arn = aws_iam_policy.automq_byoc_policy.arn
343+
policy_arn = var.automq_byoc_default_deploy_type == "k8s" ? aws_iam_policy.automq_byoc_k8s_policy[0].arn : aws_iam_policy.automq_byoc_policy[0].arn
254344
}
255345

256346
resource "aws_iam_instance_profile" "automq_byoc_instance_profile" {

‎outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,16 @@ output "automq_byoc_instance_id" {
2828
value = aws_instance.automq_byoc_console.id
2929
}
3030

31+
output "automq_byoc_console_role_arn" {
32+
description = "AutoMQ BYOC is bound to the role arn of the Console."
33+
value = aws_iam_role.automq_byoc_role.arn
34+
}
35+
36+
output "automq_byoc_eks_node_role_arn" {
37+
description = "AutoMQ BYOC requires this role to be bound to the EKS Node group."
38+
value = aws_iam_role.automq_byoc_role.arn
39+
}
40+
3141
/*
3242
output "automq_byoc_data_bucket_name" {
3343
description = "The object storage bucket for that used to store message data generated by applications. The message data Bucket must be separate from the Ops Bucket."

‎tpls/automq_byoc_role_k8s_policy.json.tpl‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "EC2InstanceProfileManagement",
6+
"Effect": "Allow",
7+
"Action": [
8+
"iam:PassRole"
9+
],
10+
"Resource": "*",
11+
"Condition": {
12+
"StringLike": {
13+
"iam:PassedToService": "ec2.amazonaws.com*"
14+
}
15+
}
16+
},
17+
{
18+
"Effect": "Allow",
19+
"Action": [
20+
"ec2:DescribeVolumes",
21+
"ec2:DescribeVolumes"
22+
],
23+
"Resource": "*"
24+
},
25+
{
26+
"Effect": "Allow",
27+
"Action": [
28+
"cloudwatch:PutMetricData",
29+
"ec2:DescribeSubnets",
30+
"ec2:DescribeVpcs",
31+
"ec2:DescribeTags",
32+
"route53:CreateHostedZone",
33+
"route53:GetHostedZone",
34+
"route53:ChangeResourceRecordSets",
35+
"route53:ListHostedZonesByName",
36+
"route53:ListResourceRecordSets",
37+
"route53:DeleteHostedZone"
38+
],
39+
"Resource": "*"
40+
},
41+
{
42+
"Effect": "Allow",
43+
"Action": [
44+
"s3:GetLifecycleConfiguration",
45+
"s3:PutLifecycleConfiguration",
46+
"s3:ListBucket"
47+
],
48+
"Resource": [
49+
"arn:aws:s3:::${automq_data_bucket}",
50+
"arn:aws:s3:::${automq_ops_bucket}"
51+
]
52+
},
53+
{
54+
"Effect": "Allow",
55+
"Action": [
56+
"s3:PutObject",
57+
"s3:GetObject",
58+
"s3:AbortMultipartUpload",
59+
"s3:PutObjectTagging",
60+
"s3:DeleteObject"
61+
],
62+
"Resource": [
63+
"arn:aws:s3:::${automq_data_bucket}/*",
64+
"arn:aws:s3:::${automq_ops_bucket}/*"
65+
]
66+
},
67+
{
68+
"Effect": "Allow",
69+
"Action": [
70+
"eks:DescribeCluster",
71+
"eks:ListNodegroups",
72+
"eks:DescribeNodegroup"
73+
],
74+
"Resource": "*"
75+
}
76+
]
77+
}

‎tpls/automq_byoc_role_policy.json.tpl‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -83,15 +83,6 @@
8383
],
8484
"Resource": "*"
8585
},
86-
{
87-
"Effect": "Allow",
88-
"Action": [
89-
"s3:GetLifecycleConfiguration",
90-
"s3:PutLifecycleConfiguration",
91-
"s3:ListBucket"
92-
],
93-
"Resource": "*"
94-
},
9586
{
9687
"Effect": "Allow",
9788
"Action": [

‎tpls/automq_node_s3_policy.json.tpl‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "VisualEditor0",
6+
"Effect": "Allow",
7+
"Action": [
8+
"s3:PutObject",
9+
"s3:GetObject",
10+
"s3:AbortMultipartUpload",
11+
"s3:PutObjectTagging",
12+
"s3:DeleteObject"
13+
],
14+
"Resource": [
15+
"arn:aws:s3:::${automq_data_bucket}/*",
16+
"arn:aws:s3:::${automq_ops_bucket}/*"
17+
]
18+
},
19+
{
20+
"Action": [
21+
"s3:ListBucket"
22+
],
23+
"Resource": [
24+
"arn:aws:s3:::${automq_data_bucket}",
25+
"arn:aws:s3:::${automq_ops_bucket}"
26+
],
27+
"Effect": "Allow"
28+
}
29+
]
30+
}

‎tpls/aws_cluster_auto_scaler_policy.json.tpl‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"autoscaling:DescribeAutoScalingGroups",
8+
"autoscaling:DescribeAutoScalingInstances",
9+
"autoscaling:DescribeLaunchConfigurations",
10+
"autoscaling:DescribeScalingActivities",
11+
"ec2:DescribeImages",
12+
"ec2:DescribeInstanceTypes",
13+
"ec2:DescribeLaunchTemplateVersions",
14+
"ec2:GetInstanceTypesFromInstanceRequirements",
15+
"eks:DescribeNodegroup"
16+
],
17+
"Resource": [
18+
"*"
19+
]
20+
},
21+
{
22+
"Effect": "Allow",
23+
"Action": [
24+
"autoscaling:SetDesiredCapacity",
25+
"autoscaling:TerminateInstanceInAutoScalingGroup"
26+
],
27+
"Resource": [
28+
"*"
29+
]
30+
}
31+
]
32+
}

0 commit comments

Comments
 (0)