Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix AWS Permissions for KKP > 1.22 #1555

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix AWS Permissions for KKP > 1.22 #1555

wants to merge 1 commit into from
+2 −0

Conversation

toschneck
Copy link
Member

@toschneck toschneck commented Oct 30, 2023 •
edited

Based on the used role at our demo environment, the documented AWS role was missing the permission TagInstanceProfile.

@toschneck
fix AWS Permissions for KKP > 1.22
bdc7808 
add missing permission TagInstanceProfile
@kubermatic-bot kubermatic-bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 30, 2023
@kubermatic-bot
Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@kubermatic-bot kubermatic-bot added dco-signoff: yes Denotes that all commits in the pull request have the valid DCO signoff message. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 30, 2023
@toschneck toschneck marked this pull request as ready for review October 30, 2023 16:32
@kubermatic-bot kubermatic-bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 30, 2023
@toschneck
Copy link
Member Author

/assign @embik

embik
embik requested changes Oct 31, 2023
View reviewed changes
content/kubermatic/main/architecture/supported-providers/aws/_index.en.md
@@ -60,6 +60,7 @@ Ensure that the assigned policy contains at least the following permissions. Pol
"Effect": "Allow",
"Action": [
"ec2:*",
"iam:TagInstanceProfile",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at the permission in question, I think this should only be given for "Resource": "arn:aws:iam::YOUR_ACCOUNT_ID:instance-profile/*", i.e. the first block of permissions. So I would move this to line 30.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm I would need to test this (will do after kubecon)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did this ever happen? 😁

@xrstf xrstf mentioned this pull request Nov 9, 2023
Open
@kubermatic-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.
After a furter 30 days, they will turn rotten.
Mark the issue as fresh with /remove-lifecycle stale.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@kubermatic-bot kubermatic-bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 7, 2024
@kubermatic-bot
Copy link
Contributor

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

/lifecycle rotten

@kubermatic-bot kubermatic-bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Apr 5, 2024
@kubermatic-bot
Copy link
Contributor

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

@kubermatic-bot
Copy link
Contributor

@kubermatic-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@xrstf xrstf reopened this May 5, 2024
@kubermatic-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from embik. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@xrstf xrstf removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale. label May 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xrstf xrstf xrstf left review comments

@embik embik embik requested changes

Assignees

@embik embik

Labels
dco-signoff: yes Denotes that all commits in the pull request have the valid DCO signoff message. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@toschneck @kubermatic-bot @xrstf @embik