Skip to content

Instantly share code, notes, and snippets.

@callum-p

callum-p/external-dns-trust.json.tpl

Created February 5, 2019 04:36
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save callum-p/cc00c48002a5c016eadba073f8f87ff7 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save callum-p/cc00c48002a5c016eadba073f8f87ff7 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. callum-p revised this gist Feb 5, 2019. 1 changed file with 21 additions and 0 deletions.
    21 changes: 21 additions & 0 deletions external-dns-trust.json.tpl
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,21 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "",
    "Effect": "Allow",
    "Principal": {
    "Service": "ec2.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
    },
    {
    "Sid": "",
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::$AWS_ACCOUNT_ID:role/$KIAM_ROLE_NAME"
    },
    "Action": "sts:AssumeRole"
    }
    ]
    }
  2. callum-p created this gist Feb 5, 2019.
    20 changes: 20 additions & 0 deletions kiam-install.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,20 @@
    # annotate namespace kube-system and default to allow iam role assumptions
    kubectl annotate namespace kube-system iam.amazonaws.com/permitted=".*" --overwrite
    kubectl annotate namespace default iam.amazonaws.com/permitted=".*" --overwrite

    # setup json policies with variables
    envsubst '$AWS_ACCOUNT_ID $CLUSTER_NAME' < ./.docker/scripts/addons/kiam/trust.json.tpl > ./.docker/scripts/addons/kiam/trust.json

    # create kiam server role if it doesn't exist
    while ! aws iam get-role --role-name masters.$CLUSTER_NAME; do
    echo "Waiting for masters role to be created..."
    sleep 5
    done

    aws iam get-role --role-name $KIAM_ROLE_NAME > /dev/null || \
    aws iam create-role --role-name $KIAM_ROLE_NAME --assume-role-policy-document file://./.docker/scripts/addons/kiam/trust.json
    # update the kiam trust policy in case it already exists
    aws iam update-assume-role-policy --role-name $KIAM_ROLE_NAME --policy-document file://./.docker/scripts/addons/kiam/trust.json

    # assign the kiam iam policy to the role
    aws iam put-role-policy --role-name $KIAM_ROLE_NAME --policy-name kiam --policy-document file://./.docker/scripts/addons/kiam/kiam_server_policy.json
    14 changes: 14 additions & 0 deletions kiam_server_policy.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "sts:AssumeRole"
    ],
    "Resource": [
    "*"
    ]
    }
    ]
    }
    21 changes: 21 additions & 0 deletions trust.json.tpl
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,21 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "",
    "Effect": "Allow",
    "Principal": {
    "Service": "ec2.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
    },
    {
    "Sid": "",
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/masters.$CLUSTER_NAME"
    },
    "Action": "sts:AssumeRole"
    }
    ]
    }