Skip to content

Commit e490729

Browse files
kprahulrajkprahulraj
authored
add support to policy for pod-identity-association create and update (#8674)
1 parent fbe1ab0 commit e490729

13 files changed

Lines changed: 117 additions & 41 deletions

File tree

‎go.mod‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,19 @@ require (
1010
github.com/aws/aws-sdk-go-v2 v1.41.1
1111
github.com/aws/aws-sdk-go-v2/config v1.32.7
1212
github.com/aws/aws-sdk-go-v2/credentials v1.19.7
13-
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.62.1
14-
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.1
15-
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.1
16-
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.61.1
13+
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.64.0
14+
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.5
15+
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.5
16+
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.63.1
1717
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.57.7
18-
github.com/aws/aws-sdk-go-v2/service/ec2 v1.275.0
19-
github.com/aws/aws-sdk-go-v2/service/eks v1.77.0
20-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.15
21-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.2
22-
github.com/aws/aws-sdk-go-v2/service/iam v1.52.2
18+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.286.0
19+
github.com/aws/aws-sdk-go-v2/service/eks v1.79.0
20+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.19
21+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.6
22+
github.com/aws/aws-sdk-go-v2/service/iam v1.53.2
2323
github.com/aws/aws-sdk-go-v2/service/kms v1.47.1
24-
github.com/aws/aws-sdk-go-v2/service/outposts v1.57.8
25-
github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4
24+
github.com/aws/aws-sdk-go-v2/service/outposts v1.57.11
25+
github.com/aws/aws-sdk-go-v2/service/ssm v1.67.8
2626
github.com/aws/aws-sdk-go-v2/service/sts v1.41.6
2727
github.com/aws/smithy-go v1.24.0
2828
github.com/awslabs/amazon-eks-ami/nodeadm v0.0.0-20251001043626-89ce6578d960
@@ -133,7 +133,7 @@ require (
133133
github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
134134
github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
135135
github.com/atotto/clipboard v0.1.4 // indirect
136-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
136+
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
137137
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
138138
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
139139
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect

‎go.sum‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -110,8 +110,8 @@ github.com/aws/amazon-ec2-instance-selector/v3 v3.1.2 h1:F8GBspJo+RmR4rYyw75XywE
110110
github.com/aws/amazon-ec2-instance-selector/v3 v3.1.2/go.mod h1:wdlMRtz9G4IO6H1yZPsqfGBxR8E6B/bdxHlGkls4kGQ=
111111
github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
112112
github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
113-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 h1:DHctwEM8P8iTXFxC/QK0MRjwEpWQeM9yzidCRjldUz0=
114-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
113+
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
114+
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
115115
github.com/aws/aws-sdk-go-v2/config v1.32.7 h1:vxUyWGUwmkQ2g19n7JY/9YL8MfAIl7bTesIUykECXmY=
116116
github.com/aws/aws-sdk-go-v2/config v1.32.7/go.mod h1:2/Qm5vKUU/r7Y+zUk/Ptt2MDAEKAfUtKc1+3U1Mo3oY=
117117
github.com/aws/aws-sdk-go-v2/credentials v1.19.7 h1:tHK47VqqtJxOymRrNtUXN5SP/zUTvZKeLx4tH6PGQc8=
@@ -126,28 +126,28 @@ github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEG
126126
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
127127
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.14 h1:ITi7qiDSv/mSGDSWNpZ4k4Ve0DQR6Ug2SJQ8zEHoDXg=
128128
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.14/go.mod h1:k1xtME53H1b6YpZt74YmwlONMWf4ecM+lut1WQLAF/U=
129-
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.62.1 h1:CsZyADhNxJU6AbqmieFia8ez9tO3HAPZKWMNZEvvdVM=
130-
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.62.1/go.mod h1:6q/I1pH386VpPfB6FE62X/MOs6NW/oCsY9FXU33YXOU=
131-
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.1 h1:YA9axGdmN8mAnG3uxredzWXFN/x1IiCbseFqU30ZXog=
132-
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.1/go.mod h1:AIfiLeQfCO8suB3zxZp155Sv9KfiDhPyF+SSIRLEUYk=
133-
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.1 h1:fRFvc/mgSPujB9JrKuPt+HGnJE9I+nDwXMhEAwHI/GM=
134-
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.1/go.mod h1:XSNDmicqamWtX6yg5lisFAiFaf56PErQo/cMQvUQWX0=
135-
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.61.1 h1:1Ci283hJE+S3XC4n5b2peV/wlcAo5rTVDb6j6JJ1aTo=
136-
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.61.1/go.mod h1:WXcA3mYRgWVIzjD+kxzap0axltmt4zBVDZaRX0S86gk=
129+
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.64.0 h1:s92jPptCu97RNwU1yF3jD4ahLZrQ0QkUIvrn464rQ2A=
130+
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.64.0/go.mod h1:8O5Pj92iNpfw/Fa7WdHbn6YiEjDoVdutz+9PGRNoP3Y=
131+
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.5 h1:UNllAzfiRvz9il9s0yHJkySMJbxWqEVDfyLdDblnuT4=
132+
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.71.5/go.mod h1:d6XSvIZM3pSKyXNbezwYT3nAcJeUzsJIXtZMNuQ9K2k=
133+
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.5 h1:sSgqtZi6Kp4Pc1V4turyaux7xUXxC1JwbEF6MzTQ9oE=
134+
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.5/go.mod h1:zweZsRPub5YhgUjoMGOeRWuXOOORt6YFiA51hpmNB4c=
135+
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.63.1 h1:l65dmgr7tO26EcHe6WMdseRnFLoJ2nqdkPz1nJdXfaw=
136+
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.63.1/go.mod h1:wvnXh1w1pGS2UpEvPTKSjXYuxiXhuvob/IMaK2AWvek=
137137
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.57.7 h1:1LPBlVrceFenrbWOZBGu8KTmX8TTMpZfRxX0HCnSjz0=
138138
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.57.7/go.mod h1:l8KDrD4EZQwTuM69YK3LFZ4c9VbNHrzaQJjJsoIFqfo=
139-
github.com/aws/aws-sdk-go-v2/service/ec2 v1.275.0 h1:ymusjrsOjrcVBQNQXYFIQEHJIJ17/m+VoDSmWIMjGe0=
140-
github.com/aws/aws-sdk-go-v2/service/ec2 v1.275.0/go.mod h1:QrV+/GjhSrJh6MRRuTO6ZEg4M2I0nwPakf0lZHSrE1o=
141-
github.com/aws/aws-sdk-go-v2/service/eks v1.77.0 h1:Z5mTpmbJKU7jEM7xoXI5tO4Nm0JUZSgVSFkpYuu6Ic0=
142-
github.com/aws/aws-sdk-go-v2/service/eks v1.77.0/go.mod h1:Qg678m+87sCuJhcsZojenz8mblYG+Tq86V4m3hjVz0s=
143-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.15 h1:dJtNm4/eMx8nczyN3P4iAARXMj2rAvOJnj608zCqCmw=
144-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.15/go.mod h1:QEbuU4eh8HGdv4uvld0Jth+KW8L0lOSYlyPcW6+JJo8=
145-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.2 h1:xJkfrBzq4b4JxnxwNNzjUKmbQj1hPa4uUikSeXQFBYk=
146-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.2/go.mod h1:DpGMmFhQwV/HH9zugLT5Ovf9HMKdQ+6ejfJybqEC9i4=
139+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.286.0 h1:GgLc+o2oD2sXxlEwGUCCWz/1v3Wa8dN9RRebcIFXeOo=
140+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.286.0/go.mod h1:Uy+C+Sc58jozdoL1McQr8bDsEvNFx+/nBY+vpO1HVUY=
141+
github.com/aws/aws-sdk-go-v2/service/eks v1.79.0 h1:NJv9h+Fmg1bmAAnoH2cWsywcX3gNyn2sbhsn6VvgHNk=
142+
github.com/aws/aws-sdk-go-v2/service/eks v1.79.0/go.mod h1:Qg678m+87sCuJhcsZojenz8mblYG+Tq86V4m3hjVz0s=
143+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.19 h1:ybEda2mkkX2o8NadXZBtcO9tgmW9cTQgeVSjypNsAy0=
144+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.19/go.mod h1:RiMytGvN4azx4yLM0Kn3bX/XO9dLxj+eG72Smy+vNzI=
145+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.6 h1:fQR1aeZKaiPkNPya0JMy2nhsoqoSgIWc3/QTiTiL1K0=
146+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.6/go.mod h1:oJRLDix51wqBDlP9dv+blFkvvf7HESolQz5cdhdmV4A=
147147
github.com/aws/aws-sdk-go-v2/service/eventbridge v1.39.3 h1:T6L7fsONflMeXuvsT8qZ247hA8ShBB0jF9yUEhW4JqI=
148148
github.com/aws/aws-sdk-go-v2/service/eventbridge v1.39.3/go.mod h1:sIrUII6Z+hAVAgcpmsc2e9HvEr++m/v8aBPT7s4ZYUk=
149-
github.com/aws/aws-sdk-go-v2/service/iam v1.52.2 h1:li0ooCUfHIivHn8nB3LstP6HgdNefwu5gnXE4MLVz/U=
150-
github.com/aws/aws-sdk-go-v2/service/iam v1.52.2/go.mod h1:PuHz5kGh1jtsNpjezdYhRp7xgn6DzCNJJfQt7O7U9Aw=
149+
github.com/aws/aws-sdk-go-v2/service/iam v1.53.2 h1:62G6btFUwAa5uR5iPlnlNVAM0zJSLbWgDfKOfUC7oW4=
150+
github.com/aws/aws-sdk-go-v2/service/iam v1.53.2/go.mod h1:av9clChrbZbJ5E21msSsiT2oghl2BJHfQGhCkXmhyu8=
151151
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
152152
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
153153
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.5 h1:Hjkh7kE6D81PgrHlE/m9gx+4TyyeLHuY8xJs7yXN5C4=
@@ -158,8 +158,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.14 h1:FzQE21lNtUor0
158158
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.14/go.mod h1:s1ydyWG9pm3ZwmmYN21HKyG9WzAZhYVW85wMHs5FV6w=
159159
github.com/aws/aws-sdk-go-v2/service/kms v1.47.1 h1:6+C0RoGF4HJQALrsecOXN7cm/l5rgNHCw2xbcvFgpH4=
160160
github.com/aws/aws-sdk-go-v2/service/kms v1.47.1/go.mod h1:VJcNH6BLr+3VJwinRKdotLOMglHO8mIKlD3ea5c7hbw=
161-
github.com/aws/aws-sdk-go-v2/service/outposts v1.57.8 h1:zB9Q/dG0NkURC5E1g4qL/lsUp7aOqilfb7Ru9EOigDU=
162-
github.com/aws/aws-sdk-go-v2/service/outposts v1.57.8/go.mod h1:3osURGv9q/2wxP1qYnB15GWYgr6w2AbQkSxYtE6vTaY=
161+
github.com/aws/aws-sdk-go-v2/service/outposts v1.57.11 h1:pTBv1tqYHwSFkXSxpXrfAY83kBIec5YtVEZJaXcu7es=
162+
github.com/aws/aws-sdk-go-v2/service/outposts v1.57.11/go.mod h1:TcrxIboCEZ2fBS0g66qoDvJ4+MfRGf8Xnf6iDR84nAo=
163163
github.com/aws/aws-sdk-go-v2/service/pricing v1.34.3 h1:vAv0hi3SWcc8cotkWRP4mPkmRbp/XqWKFyPW4Nwpzv0=
164164
github.com/aws/aws-sdk-go-v2/service/pricing v1.34.3/go.mod h1:giTP9ufzBQJRB6bc7P30PO8s35hCp6au5uM70zkohU4=
165165
github.com/aws/aws-sdk-go-v2/service/route53 v1.52.2 h1:dXHWVVPx2W2fq2PTugj8QXpJ0YTRAGx0KLPKhMBmcsY=
@@ -170,8 +170,8 @@ github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 h1:VrhDvQib/i0lxvr3zqlUwLwJP4
170170
github.com/aws/aws-sdk-go-v2/service/signin v1.0.5/go.mod h1:k029+U8SY30/3/ras4G/Fnv/b88N4mAfliNn08Dem4M=
171171
github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 h1:80dpSqWMwx2dAm30Ib7J6ucz1ZHfiv5OCRwN/EnCOXQ=
172172
github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8/go.mod h1:IzNt/udsXlETCdvBOL0nmyMe2t9cGmXmZgsdoZGYYhI=
173-
github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4 h1:pOwUUY5FzKUsxtxGR6qsczZP7MuZMVlMbAOPQOcmJlo=
174-
github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4/go.mod h1:+nlWvcgDPQ56mChEBzTC0puAMck+4onOFaHg5cE+Lgg=
173+
github.com/aws/aws-sdk-go-v2/service/ssm v1.67.8 h1:31Llf5VfrZ78YvYs7sWcS7L2m3waikzRc6q1nYenVS4=
174+
github.com/aws/aws-sdk-go-v2/service/ssm v1.67.8/go.mod h1:/jgaDlU1UImoxTxhRNxXHvBAPqPZQ8oCjcPbbkR6kac=
175175
github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 h1:v6EiMvhEYBoHABfbGB4alOYmCIrcgyPPiBE1wZAEbqk=
176176
github.com/aws/aws-sdk-go-v2/service/sso v1.30.9/go.mod h1:yifAsgBxgJWn3ggx70A3urX2AN49Y5sJTD1UQFlfqBw=
177177
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 h1:gd84Omyu9JLriJVCbGApcLzVR3XtmC4ZDPcAI6Ftvds=

‎pkg/actions/podidentityassociation/tasks.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ func (t *createPodIdentityAssociationTask) Do(errorCh chan error) error {
5050
ServiceAccount: &t.podIdentityAssociation.ServiceAccountName,
5151
Tags: t.podIdentityAssociation.Tags,
5252
DisableSessionTags: t.podIdentityAssociation.DisableSessionTags,
53+
Policy: t.podIdentityAssociation.Policy,
5354
}
5455

5556
// Add target role ARN if specified (for cross-account access)

‎pkg/actions/podidentityassociation/updater.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -98,9 +98,10 @@ func (u *Updater) update(ctx context.Context, updateConfig *UpdateConfig, podIde
9898
return err
9999
}
100100

101-
// If there's no change to the IAM role or pod identity association properties, return early
101+
// If there's no change to the IAM role, policy or pod identity association properties, return early
102102
if !hasChanged &&
103103
updateConfig.PodIdentityAssociation.TargetRoleARN == nil &&
104+
updateConfig.PodIdentityAssociation.Policy == nil &&
104105
updateConfig.PodIdentityAssociation.DisableSessionTags == nil {
105106
return nil
106107
}
@@ -116,6 +117,7 @@ func (u *Updater) updatePodIdentityAssociation(ctx context.Context, roleARN stri
116117
RoleArn: aws.String(roleARN),
117118
TargetRoleArn: updateConfig.PodIdentityAssociation.TargetRoleARN,
118119
DisableSessionTags: updateConfig.PodIdentityAssociation.DisableSessionTags,
120+
Policy: updateConfig.PodIdentityAssociation.Policy,
119121
}); err != nil {
120122
return fmt.Errorf("(associationID: %s, roleARN: %s): %w", updateConfig.AssociationID, roleARN, err)
121123
}
@@ -200,10 +202,11 @@ func (r *RoleUpdateValidator) ValidateRoleUpdate(pia api.PodIdentityAssociation,
200202
RoleARN: pia.RoleARN,
201203
TargetRoleARN: pia.TargetRoleARN,
202204
DisableSessionTags: pia.DisableSessionTags,
205+
Policy: pia.Policy,
203206
}
204207

205208
if !reflect.DeepEqual(pia, podIDWithCrossAccountFields) {
206-
return errors.New("only namespace, serviceAccountName and roleARN can be specified if the role was not created by eksctl")
209+
return errors.New("only namespace, serviceAccountName, roleARN and policy can be specified if the role was not created by eksctl")
207210
}
208211
}
209212
return nil

‎pkg/actions/podidentityassociation/updater_test.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ var _ = Describe("Pod Identity Update", func() {
4747
describeStackOutputs []cfntypes.Output
4848
describeStackCapabilities []cfntypes.Capability
4949
makeStackName func(podidentityassociation.Identifier) string
50+
policy *string
5051
}
5152

5253
mockCalls := func(stackManager *managerfakes.FakeStackManager, eksAPI *mocksv2.EKS, o mockOptions) {
@@ -74,6 +75,7 @@ var _ = Describe("Pod Identity Update", func() {
7475
AssociationId: aws.String(associationID),
7576
ClusterName: aws.String(clusterName),
7677
RoleArn: aws.String(o.updateRoleARN),
78+
Policy: o.policy,
7779
}
7880

7981
// For the cross-account access test case
@@ -262,7 +264,7 @@ var _ = Describe("Pod Identity Update", func() {
262264
eksAPI.AssertExpectations(GinkgoT())
263265
},
264266

265-
expectedErr: `error updating pod identity association "kube-system/aws-node": only namespace, serviceAccountName and roleARN can be specified if the role was not created by eksctl`,
267+
expectedErr: `error updating pod identity association "kube-system/aws-node": only namespace, serviceAccountName, roleARN and policy can be specified if the role was not created by eksctl`,
266268
}),
267269

268270
Entry("roleName specified when the pod identity association was not created with a roleName", updateEntry{

‎pkg/apis/eksctl.io/v1alpha5/assets/schema.json‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2868,6 +2868,11 @@
28682868
"permissionsBoundaryARN": {
28692869
"type": "string"
28702870
},
2871+
"policy": {
2872+
"type": "string",
2873+
"description": "optional policy that applies additional restrictions to this pod identity association beyond the IAM policies attached to the IAM role.",
2874+
"x-intellij-html-description": "optional policy that applies additional restrictions to this pod identity association beyond the IAM policies attached to the IAM role."
2875+
},
28712876
"roleARN": {
28722877
"type": "string"
28732878
},
@@ -2905,7 +2910,8 @@
29052910
"wellKnownPolicies",
29062911
"tags",
29072912
"targetRoleARN",
2908-
"disableSessionTags"
2913+
"disableSessionTags",
2914+
"policy"
29092915
],
29102916
"additionalProperties": false
29112917
},

‎pkg/apis/eksctl.io/v1alpha5/iam.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,10 @@ type PodIdentityAssociation struct {
209209
// +optional
210210
// DisableSessionTags disables the tags that are automatically added to role session by Amazon EKS.
211211
DisableSessionTags *bool `json:"disableSessionTags,omitempty"`
212+
213+
// +optional
214+
// Policy is the optional policy that applies additional restrictions to this pod identity association beyond the IAM policies attached to the IAM role.
215+
Policy *string `json:"policy,omitempty"`
212216
}
213217

214218
func (p PodIdentityAssociation) NameString() string {

‎pkg/ctl/cmdutils/cmdutils.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,7 @@ func ErrUnsupportedManagedFlag(flag string) error {
249249
func ErrUnsupportedNameArg() error {
250250
return errors.New("name argument is not supported")
251251
}
252+
253+
func ErrDisableSessionTagsMustBeSet() error {
254+
return errors.New("--disable-session-tags must be set to true when using --policy")
255+
}

‎pkg/ctl/cmdutils/pod_identity_association.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ var (
2222
"create-service-account",
2323
"target-role-arn",
2424
"disable-session-tags",
25+
"policy",
2526
}
2627
)
2728

@@ -181,12 +182,14 @@ type UpdatePodIdentityAssociationOptions struct {
181182
// DisableSessionTags is a boolean flag to enable or disable session tags.
182183
// This is used for cross-account pod identity access.
183184
DisableSessionTags *bool
185+
// Policy is the optional policy that applies additional restrictions to this pod identity association beyond the IAM policies attached to the IAM role.
186+
Policy *string
184187
}
185188

186189
// NewUpdatePodIdentityAssociationLoader will load config or use flags for `eksctl update podidentityassociation`.
187190
func NewUpdatePodIdentityAssociationLoader(cmd *Cmd, options UpdatePodIdentityAssociationOptions) ClusterConfigLoader {
188191
l := newCommonClusterConfigLoader(cmd)
189-
l.flagsIncompatibleWithConfigFile.Insert("namespace", "service-account-name", "role-arn", "target-role-arn", "disable-session-tags")
192+
l.flagsIncompatibleWithConfigFile.Insert("namespace", "service-account-name", "role-arn", "target-role-arn", "disable-session-tags", "policy")
190193

191194
l.validateWithoutConfigFile = func() error {
192195
if err := validatePodIdentityAssociation(l, options.PodIdentityAssociationOptions); err != nil {

‎pkg/ctl/create/pod_identity_association.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,12 @@ func doCreatePodIdentityAssociation(cmd *cmdutils.Cmd) error {
3737
cfg := cmd.ClusterConfig
3838
ctx := context.Background()
3939

40+
for _, pia := range cfg.IAM.PodIdentityAssociations {
41+
if pia.Policy != nil && (pia.DisableSessionTags == nil || !*pia.DisableSessionTags) {
42+
return cmdutils.ErrDisableSessionTagsMustBeSet()
43+
}
44+
}
45+
4046
ctl, err := cmd.NewProviderForExistingCluster(ctx)
4147
if err != nil {
4248
return err
@@ -74,8 +80,10 @@ func configureCreatePodIdentityAssociationCmd(cmd *cmdutils.Cmd, pia *api.PodIde
7480
fs.StringVar(&pia.PermissionsBoundaryARN, "permission-boundary-arn", "", "ARN of the policy that is used to set the permission boundary for the role")
7581
var targetRoleARN string
7682
var disableSessionTags bool
83+
var policy string
7784
fs.StringVar(&targetRoleARN, "target-role-arn", "", "ARN of the target IAM role for cross-account access (default to empty string for no cross-account access)")
7885
fs.BoolVar(&disableSessionTags, "disable-session-tags", false, "Disable session tags added by EKS Pod Identity (if not provided, session tags are enabled by default)")
86+
fs.StringVar(&policy, "policy", "", "Optional policy that applies additional restrictions to this pod identity association beyond the IAM policies attached to the IAM role")
7987

8088
// Store the flag values in the struct
8189
cmdutils.AddPreRun(cmd.CobraCommand, func(cobraCmd *cobra.Command, args []string) {
@@ -85,6 +93,9 @@ func configureCreatePodIdentityAssociationCmd(cmd *cmdutils.Cmd, pia *api.PodIde
8593
if fs.Changed("disable-session-tags") {
8694
pia.DisableSessionTags = aws.Bool(true)
8795
}
96+
if fs.Changed("policy") {
97+
pia.Policy = &policy
98+
}
8899
})
89100

90101
fs.BoolVar(&pia.CreateServiceAccount, "create-service-account", false, "instructs eksctl to create the K8s service account")

0 commit comments

Comments
 (0)