iam

Documentation

Index

• Constants
• type Condition
• type Policy
  • func (p *Policy) AsJSON() (string, error)
• type PolicyBuilder
  • func (b *PolicyBuilder) AddS3Permissions(p *Policy) (*Policy, error)
  • func (b *PolicyBuilder) BuildAWSPolicy() (*Policy, error)
  • func (b *PolicyBuilder) BuildAWSPolicyBastion() (*Policy, error)
  • func (b *PolicyBuilder) BuildAWSPolicyMaster() (*Policy, error)
  • func (b *PolicyBuilder) BuildAWSPolicyNode() (*Policy, error)
  • func (b *PolicyBuilder) IAMPrefix() string
• type PolicyResource
  • func (b *PolicyResource) GetDependencies(tasks map[string]fi.Task) []fi.Task
  • func (b *PolicyResource) Open() (io.Reader, error)
• type SID
• type Statement
  • func (l *Statement) Equal(r *Statement) bool
• type StatementEffect

Constants

const PolicyDefaultVersion = "2012-10-17"

PolicyDefaultVersion is the default version included in all policy documents

Types

type Condition

type Condition map[string]interface{}

Condition is a map of Conditions to be evaluated for a given IAM Statement

type Policy

type Policy struct {
	Version   string
	Statement []*Statement
}

Policy Struct is a collection of fields that form a valid AWS policy document

func (*Policy) AsJSON

func (p *Policy) AsJSON() (string, error)

AsJSON converts the policy document to JSON format (parsable by AWS)

type PolicyBuilder

type PolicyBuilder struct {
	Cluster      *kops.Cluster
	HostedZoneID string
	KMSKeys      []string
	Region       string
	ResourceARN  *string
	Role         kops.InstanceGroupRole
}

PolicyBuilder struct defines all valid fields to be used when building the AWS IAM policy document for a given instance group role.

func (*PolicyBuilder) AddS3Permissions

func (b *PolicyBuilder) AddS3Permissions(p *Policy) (*Policy, error)

AddS3Permissions updates an IAM Policy with statements granting tailored access to S3 assets, depending on the instance group role

func (*PolicyBuilder) BuildAWSPolicy

func (b *PolicyBuilder) BuildAWSPolicy() (*Policy, error)

BuildAWSPolicy builds a set of IAM policy statements based on the instance group type and IAM Legacy flag within the Cluster Spec

func (*PolicyBuilder) BuildAWSPolicyBastion

func (b *PolicyBuilder) BuildAWSPolicyBastion() (*Policy, error)

BuildAWSPolicyBastion generates a custom policy for a bastion host.

func (*PolicyBuilder) BuildAWSPolicyMaster

func (b *PolicyBuilder) BuildAWSPolicyMaster() (*Policy, error)

BuildAWSPolicyMaster generates a custom policy for a Kubernetes master.

func (*PolicyBuilder) BuildAWSPolicyNode

func (b *PolicyBuilder) BuildAWSPolicyNode() (*Policy, error)

BuildAWSPolicyNode generates a custom policy for a Kubernetes node.

func (*PolicyBuilder) IAMPrefix

func (b *PolicyBuilder) IAMPrefix() string

IAMPrefix returns the prefix for AWS ARNs in the current region, for use with IAM it is arn:aws everywhere but in cn-north and us-gov-west-1

type PolicyResource

type PolicyResource struct {
	Builder *PolicyBuilder
	DNSZone *awstasks.DNSZone
}

PolicyResource defines the PolicyBuilder and DNSZone to use when building the IAM policy document for a given instance group role

func (*PolicyResource) GetDependencies

func (b *PolicyResource) GetDependencies(tasks map[string]fi.Task) []fi.Task

GetDependencies adds the DNSZone task to the list of dependencies if set

func (*PolicyResource) Open

func (b *PolicyResource) Open() (io.Reader, error)

Open produces the AWS IAM policy for the given role

type SID

type SID string

SID (Statement ID) is an optional identifier for the policy statement

type Statement

type Statement struct {
	Sid       SID
	Effect    StatementEffect
	Action    stringorslice.StringOrSlice
	Resource  stringorslice.StringOrSlice
	Condition Condition `json:",omitempty"`
}

Statement is an AWS IAM Policy Statement Object: http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Statement

func (*Statement) Equal

func (l *Statement) Equal(r *Statement) bool

Equal compares two IAM Statements and returns a bool TODO: Extend to support Condition Keys

type StatementEffect

type StatementEffect string

StatementEffect is required and specifies what type of access the statement results in

const StatementEffectAllow StatementEffect = "Allow"

StatementEffectAllow allows access for the given resources in the statement (based on conditions)

const StatementEffectDeny StatementEffect = "Deny"

StatementEffectDeny allows access for the given resources in the statement (based on conditions)