iam

Documentation

Overview

Package iam provides a service for managing IAM roles and policies.

Index

• Constants
• func ControlPlaneTrustRelationship(enableFargate bool) *iamv1.PolicyDocument
• func FargateTrustRelationship() *iamv1.PolicyDocument
• func NodegroupTrustRelationship() *iamv1.PolicyDocument
• func RoleTags(key string, additionalTags infrav1.Tags) []*iam.Tag
• type IAMService
  • func (s *IAMService) CreateOIDCProvider(cluster *eks.Cluster) (string, error)
  • func (s *IAMService) CreateRole(roleName string, key string, trustRelationship *iamv1.PolicyDocument, ...) (*iam.Role, error)
  • func (s *IAMService) DeleteOIDCProvider(arn *string) error
  • func (s *IAMService) DeleteRole(name string) error
  • func (s *IAMService) EnsurePoliciesAttached(role *iam.Role, policies []*string) (bool, error)
  • func (s *IAMService) EnsureTagsAndPolicy(role *iam.Role, key string, trustRelationship *iamv1.PolicyDocument, ...) (bool, error)
  • func (s *IAMService) FindAndVerifyOIDCProvider(cluster *eks.Cluster) (string, error)
  • func (s *IAMService) GetIAMRole(name string) (*iam.Role, error)
  • func (s *IAMService) IsUnmanaged(role *iam.Role, key string) bool

Constants

const (
	// EKSFargateService is the service to trust for fargate pod execution roles.
	EKSFargateService = "eks-fargate-pods.amazonaws.com"
)

Functions

func ControlPlaneTrustRelationship

func ControlPlaneTrustRelationship(enableFargate bool) *iamv1.PolicyDocument

ControlPlaneTrustRelationship will generate a ControlPlane PolicyDocument.

func FargateTrustRelationship

func FargateTrustRelationship() *iamv1.PolicyDocument

FargateTrustRelationship will generate a Fargate PolicyDocument.

func NodegroupTrustRelationship

func NodegroupTrustRelationship() *iamv1.PolicyDocument

NodegroupTrustRelationship will generate a Nodegroup PolicyDocument.

func RoleTags

func RoleTags(key string, additionalTags infrav1.Tags) []*iam.Tag

RoleTags returns the tags for the given role.

Types

type IAMService

type IAMService struct {
	logger.Wrapper
	IAMClient iamiface.IAMAPI
	Client    *http.Client
}

IAMService defines the specs for an IAM service.

func (*IAMService) CreateOIDCProvider

func (s *IAMService) CreateOIDCProvider(cluster *eks.Cluster) (string, error)

CreateOIDCProvider will create an OIDC provider.

func (*IAMService) CreateRole

func (s *IAMService) CreateRole(
	roleName string,
	key string,
	trustRelationship *iamv1.PolicyDocument,
	additionalTags infrav1.Tags,
) (*iam.Role, error)

CreateRole will create a role from the IAMService.

func (*IAMService) DeleteOIDCProvider

func (s *IAMService) DeleteOIDCProvider(arn *string) error

DeleteOIDCProvider will delete an OIDC provider.

func (*IAMService) DeleteRole

func (s *IAMService) DeleteRole(name string) error

DeleteRole will delete a role from the IAMService.

func (*IAMService) EnsurePoliciesAttached

func (s *IAMService) EnsurePoliciesAttached(role *iam.Role, policies []*string) (bool, error)

EnsurePoliciesAttached will ensure the IAMService has policies attached.

func (*IAMService) EnsureTagsAndPolicy

func (s *IAMService) EnsureTagsAndPolicy(
	role *iam.Role,
	key string,
	trustRelationship *iamv1.PolicyDocument,
	additionalTags infrav1.Tags,
) (bool, error)

EnsureTagsAndPolicy will ensure any tags and policies against the IAMService.

func (*IAMService) FindAndVerifyOIDCProvider

func (s *IAMService) FindAndVerifyOIDCProvider(cluster *eks.Cluster) (string, error)

FindAndVerifyOIDCProvider will try to find an OIDC provider. It will return an error if the found provider does not match the cluster spec.

func (*IAMService) GetIAMRole

func (s *IAMService) GetIAMRole(name string) (*iam.Role, error)

GetIAMRole will return the IAM role for the IAMService.

func (*IAMService) IsUnmanaged

func (s *IAMService) IsUnmanaged(role *iam.Role, key string) bool

IsUnmanaged will check if a given role and tag are unmanaged against the IAMService.