public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 04:58:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add iam:TagRole to minimum EKS permissions

Browse Source
This commit is contained in:
Michal Jura
2024-11-28 09:09:50 +01:00
parent 91d9e2b81d
commit 8e10fcd952
4 changed files with 604 additions and 592 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md
+158 -155
View File
@@ -110,113 +110,114 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
```json ```json
{ {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Sid": "EC2Permissions", "Sid": "EC2Permissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:RunInstances", "ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress", "ec2:CreateKeyPair",
"ec2:DescribeInstanceTypes", "ec2:CreateLaunchTemplate",
"ec2:DescribeRegions", "ec2:CreateLaunchTemplateVersion",
"ec2:DescribeVpcs", "ec2:CreateSecurityGroup",
"ec2:DescribeTags", "ec2:CreateTags",
"ec2:DescribeSubnets", "ec2:DeleteKeyPair",
"ec2:DescribeSecurityGroups", "ec2:DeleteLaunchTemplate",
"ec2:DescribeRouteTables", "ec2:DeleteLaunchTemplateVersions",
"ec2:DescribeLaunchTemplateVersions", "ec2:DeleteSecurityGroup",
"ec2:DescribeLaunchTemplates", "ec2:DeleteTags",
"ec2:DescribeKeyPairs", "ec2:DescribeAccountAttributes",
"ec2:DescribeInternetGateways", "ec2:DescribeAvailabilityZones",
"ec2:DescribeImages", "ec2:DescribeImages",
"ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways",
"ec2:DescribeAccountAttributes", "ec2:DescribeInstanceTypes",
"ec2:DeleteTags", "ec2:DescribeKeyPairs",
"ec2:DeleteLaunchTemplateVersions", "ec2:DescribeLaunchTemplateVersions",
"ec2:DeleteLaunchTemplate", "ec2:DescribeLaunchTemplates",
"ec2:DeleteSecurityGroup", "ec2:DescribeRegions",
"ec2:DeleteKeyPair", "ec2:DescribeRouteTables",
"ec2:CreateTags", "ec2:DescribeSecurityGroups",
"ec2:CreateSecurityGroup", "ec2:DescribeSubnets",
"ec2:CreateLaunchTemplateVersion", "ec2:DescribeTags",
"ec2:CreateLaunchTemplate", "ec2:DescribeVpcs",
"ec2:CreateKeyPair", "ec2:RevokeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress" "ec2:RunInstances"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "CloudFormationPermissions", "Sid": "CloudFormationPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"cloudformation:ListStacks", "cloudformation:CreateStack",
"cloudformation:ListStackResources", "cloudformation:CreateStackSet",
"cloudformation:DescribeStacks", "cloudformation:DeleteStack",
"cloudformation:DescribeStackResources", "cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources",
"cloudformation:DeleteStack", "cloudformation:DescribeStacks",
"cloudformation:CreateStackSet", "cloudformation:ListStackResources",
"cloudformation:CreateStack" "cloudformation:ListStacks"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "IAMPermissions", "Sid": "IAMPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:PassRole", "iam:AttachRolePolicy",
"iam:ListRoles", "iam:CreateRole",
"iam:ListRoleTags", "iam:DetachRolePolicy",
"iam:ListInstanceProfilesForRole", "iam:DeleteRole",
"iam:ListInstanceProfiles", "iam:GetRole",
"iam:ListAttachedRolePolicies", "iam:GetInstanceProfile",
"iam:GetRole", "iam:ListAttachedRolePolicies",
"iam:GetInstanceProfile", "iam:ListInstanceProfilesForRole",
"iam:DetachRolePolicy", "iam:ListInstanceProfiles",
"iam:DeleteRole", "iam:ListRoles",
"iam:CreateRole", "iam:ListRoleTags",
"iam:AttachRolePolicy" "iam:PassRole"
], "iam:TagRole"
"Resource": "*" ],
}, "Resource": "*"
{ },
"Sid": "KMSPermissions", {
"Effect": "Allow", "Sid": "KMSPermissions",
"Action": "kms:ListKeys", "Effect": "Allow",
"Resource": "*" "Action": "kms:ListKeys",
}, "Resource": "*"
{ },
"Sid": "EKSPermissions", {
"Effect": "Allow", "Sid": "EKSPermissions",
"Action": [ "Effect": "Allow",
"eks:UpdateNodegroupVersion", "Action": [
"eks:UpdateNodegroupConfig", "eks:CreateCluster",
"eks:UpdateClusterVersion", "eks:CreateFargateProfile",
"eks:UpdateClusterConfig", "eks:CreateNodegroup",
"eks:UntagResource", "eks:DeleteCluster",
"eks:TagResource", "eks:DeleteFargateProfile",
"eks:ListUpdates", "eks:DeleteNodegroup",
"eks:ListTagsForResource", "eks:DescribeCluster",
"eks:ListNodegroups", "eks:DescribeFargateProfile",
"eks:ListFargateProfiles", "eks:DescribeNodegroup",
"eks:ListClusters", "eks:DescribeUpdate",
"eks:DescribeUpdate", "eks:ListClusters",
"eks:DescribeNodegroup", "eks:ListFargateProfiles",
"eks:DescribeFargateProfile", "eks:ListNodegroups",
"eks:DescribeCluster", "eks:ListTagsForResource",
"eks:DeleteNodegroup", "eks:ListUpdates",
"eks:DeleteFargateProfile", "eks:TagResource",
"eks:DeleteCluster", "eks:UntagResource",
"eks:CreateNodegroup", "eks:UpdateClusterConfig",
"eks:CreateFargateProfile", "eks:UpdateClusterVersion",
"eks:CreateCluster" "eks:UpdateNodegroupConfig",
], "eks:UpdateNodegroupVersion"
"Resource": "*" ],
} "Resource": "*"
] }
]
} }
``` ```
@@ -248,7 +249,8 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
"iam:ListRoles", "iam:ListRoles",
"iam:ListRoleTags", "iam:ListRoleTags",
"iam:PassRole", "iam:PassRole",
"iam:RemoveRoleFromInstanceProfile" "iam:RemoveRoleFromInstanceProfile",
"iam:TagRole"
], ],
"Resource": "*" "Resource": "*"
} }
@@ -293,26 +295,26 @@ These are permissions that are needed by Rancher to create a Virtual Private Clo
"Sid": "VPCPermissions", "Sid": "VPCPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:ReplaceRoute", "ec2:AssociateRouteTable",
"ec2:ModifyVpcAttribute",
"ec2:ModifySubnetAttribute",
"ec2:DisassociateRouteTable",
"ec2:DetachInternetGateway",
"ec2:DescribeVpcs",
"ec2:DeleteVpc",
"ec2:DeleteTags",
"ec2:DeleteSubnet",
"ec2:DeleteRouteTable",
"ec2:DeleteRoute",
"ec2:DeleteInternetGateway",
"ec2:CreateVpc",
"ec2:CreateSubnet",
"ec2:CreateSecurityGroup",
"ec2:CreateRouteTable",
"ec2:CreateRoute",
"ec2:CreateInternetGateway",
"ec2:AttachInternetGateway", "ec2:AttachInternetGateway",
"ec2:AssociateRouteTable" "ec2:CreateInternetGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:DeleteInternetGateway",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DeleteVpc",
"ec2:DescribeVpcs",
"ec2:DetachInternetGateway",
"ec2:DisassociateRouteTable",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVpcAttribute",
"ec2:ReplaceRoute"
], ],
"Resource": "*" "Resource": "*"
} }
@@ -326,34 +328,35 @@ The following are the required permissions for installing the Amazon EBS CSI Dri
```json ```json
{ {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:GetRole", "eks:AssociateIdentityProviderConfig",
"eks:DescribeAddonConfiguration", "eks:CreateAddon",
"eks:UpdateAddon", "eks:DeleteAddon",
"eks:ListAddons", "eks:DescribeAddon",
"iam:CreateRole", "eks:DescribeAddonConfiguration",
"iam:AttachRolePolicy", "eks:DescribeAddonVersions",
"eks:DescribeAddon", "eks:DescribeCluster",
"iam:CreateOpenIDConnectProvider", "eks:DescribeIdentityProviderConfig",
"iam:PassRole", "eks:ListAddons",
"eks:DescribeIdentityProviderConfig", "eks:ListIdentityProviderConfigs",
"eks:DeleteAddon", "eks:UpdateAddon",
"iam:ListOpenIDConnectProviders", "iam:AttachRolePolicy",
"iam:ListAttachedRolePolicies", "iam:CreateOpenIDConnectProvider",
"eks:CreateAddon", "iam:CreateRole",
"eks:DescribeCluster", "iam:GetRole",
"eks:DescribeAddonVersions", "iam:ListAttachedRolePolicies",
"sts:AssumeRoleWithWebIdentity", "iam:ListOpenIDConnectProviders",
"eks:AssociateIdentityProviderConfig", "iam:PassRole",
"eks:ListIdentityProviderConfigs" "iam:TagRole",
], "sts:AssumeRoleWithWebIdentity"
"Resource": "*" ],
} "Resource": "*"
] }
]
} }
``` ```
versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md
+158 -155
View File
@@ -110,113 +110,114 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
```json ```json
{ {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Sid": "EC2Permissions", "Sid": "EC2Permissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:RunInstances", "ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress", "ec2:CreateKeyPair",
"ec2:DescribeInstanceTypes", "ec2:CreateLaunchTemplate",
"ec2:DescribeRegions", "ec2:CreateLaunchTemplateVersion",
"ec2:DescribeVpcs", "ec2:CreateSecurityGroup",
"ec2:DescribeTags", "ec2:CreateTags",
"ec2:DescribeSubnets", "ec2:DeleteKeyPair",
"ec2:DescribeSecurityGroups", "ec2:DeleteLaunchTemplate",
"ec2:DescribeRouteTables", "ec2:DeleteLaunchTemplateVersions",
"ec2:DescribeLaunchTemplateVersions", "ec2:DeleteSecurityGroup",
"ec2:DescribeLaunchTemplates", "ec2:DeleteTags",
"ec2:DescribeKeyPairs", "ec2:DescribeAccountAttributes",
"ec2:DescribeInternetGateways", "ec2:DescribeAvailabilityZones",
"ec2:DescribeImages", "ec2:DescribeImages",
"ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways",
"ec2:DescribeAccountAttributes", "ec2:DescribeInstanceTypes",
"ec2:DeleteTags", "ec2:DescribeKeyPairs",
"ec2:DeleteLaunchTemplateVersions", "ec2:DescribeLaunchTemplateVersions",
"ec2:DeleteLaunchTemplate", "ec2:DescribeLaunchTemplates",
"ec2:DeleteSecurityGroup", "ec2:DescribeRegions",
"ec2:DeleteKeyPair", "ec2:DescribeRouteTables",
"ec2:CreateTags", "ec2:DescribeSecurityGroups",
"ec2:CreateSecurityGroup", "ec2:DescribeSubnets",
"ec2:CreateLaunchTemplateVersion", "ec2:DescribeTags",
"ec2:CreateLaunchTemplate", "ec2:DescribeVpcs",
"ec2:CreateKeyPair", "ec2:RevokeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress" "ec2:RunInstances"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "CloudFormationPermissions", "Sid": "CloudFormationPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"cloudformation:ListStacks", "cloudformation:CreateStack",
"cloudformation:ListStackResources", "cloudformation:CreateStackSet",
"cloudformation:DescribeStacks", "cloudformation:DeleteStack",
"cloudformation:DescribeStackResources", "cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources",
"cloudformation:DeleteStack", "cloudformation:DescribeStacks",
"cloudformation:CreateStackSet", "cloudformation:ListStackResources",
"cloudformation:CreateStack" "cloudformation:ListStacks"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "IAMPermissions", "Sid": "IAMPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:PassRole", "iam:AttachRolePolicy",
"iam:ListRoles", "iam:CreateRole",
"iam:ListRoleTags", "iam:DetachRolePolicy",
"iam:ListInstanceProfilesForRole", "iam:DeleteRole",
"iam:ListInstanceProfiles", "iam:GetRole",
"iam:ListAttachedRolePolicies", "iam:GetInstanceProfile",
"iam:GetRole", "iam:ListAttachedRolePolicies",
"iam:GetInstanceProfile", "iam:ListInstanceProfilesForRole",
"iam:DetachRolePolicy", "iam:ListInstanceProfiles",
"iam:DeleteRole", "iam:ListRoles",
"iam:CreateRole", "iam:ListRoleTags",
"iam:AttachRolePolicy" "iam:PassRole"
], "iam:TagRole"
"Resource": "*" ],
}, "Resource": "*"
{ },
"Sid": "KMSPermissions", {
"Effect": "Allow", "Sid": "KMSPermissions",
"Action": "kms:ListKeys", "Effect": "Allow",
"Resource": "*" "Action": "kms:ListKeys",
}, "Resource": "*"
{ },
"Sid": "EKSPermissions", {
"Effect": "Allow", "Sid": "EKSPermissions",
"Action": [ "Effect": "Allow",
"eks:UpdateNodegroupVersion", "Action": [
"eks:UpdateNodegroupConfig", "eks:CreateCluster",
"eks:UpdateClusterVersion", "eks:CreateFargateProfile",
"eks:UpdateClusterConfig", "eks:CreateNodegroup",
"eks:UntagResource", "eks:DeleteCluster",
"eks:TagResource", "eks:DeleteFargateProfile",
"eks:ListUpdates", "eks:DeleteNodegroup",
"eks:ListTagsForResource", "eks:DescribeCluster",
"eks:ListNodegroups", "eks:DescribeFargateProfile",
"eks:ListFargateProfiles", "eks:DescribeNodegroup",
"eks:ListClusters", "eks:DescribeUpdate",
"eks:DescribeUpdate", "eks:ListClusters",
"eks:DescribeNodegroup", "eks:ListFargateProfiles",
"eks:DescribeFargateProfile", "eks:ListNodegroups",
"eks:DescribeCluster", "eks:ListTagsForResource",
"eks:DeleteNodegroup", "eks:ListUpdates",
"eks:DeleteFargateProfile", "eks:TagResource",
"eks:DeleteCluster", "eks:UntagResource",
"eks:CreateNodegroup", "eks:UpdateClusterConfig",
"eks:CreateFargateProfile", "eks:UpdateClusterVersion",
"eks:CreateCluster" "eks:UpdateNodegroupConfig",
], "eks:UpdateNodegroupVersion"
"Resource": "*" ],
} "Resource": "*"
] }
]
} }
``` ```
@@ -248,7 +249,8 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
"iam:ListRoles", "iam:ListRoles",
"iam:ListRoleTags", "iam:ListRoleTags",
"iam:PassRole", "iam:PassRole",
"iam:RemoveRoleFromInstanceProfile" "iam:RemoveRoleFromInstanceProfile",
"iam:TagRole"
], ],
"Resource": "*" "Resource": "*"
} }
@@ -293,26 +295,26 @@ These are permissions that are needed by Rancher to create a Virtual Private Clo
"Sid": "VPCPermissions", "Sid": "VPCPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:ReplaceRoute", "ec2:AssociateRouteTable",
"ec2:ModifyVpcAttribute",
"ec2:ModifySubnetAttribute",
"ec2:DisassociateRouteTable",
"ec2:DetachInternetGateway",
"ec2:DescribeVpcs",
"ec2:DeleteVpc",
"ec2:DeleteTags",
"ec2:DeleteSubnet",
"ec2:DeleteRouteTable",
"ec2:DeleteRoute",
"ec2:DeleteInternetGateway",
"ec2:CreateVpc",
"ec2:CreateSubnet",
"ec2:CreateSecurityGroup",
"ec2:CreateRouteTable",
"ec2:CreateRoute",
"ec2:CreateInternetGateway",
"ec2:AttachInternetGateway", "ec2:AttachInternetGateway",
"ec2:AssociateRouteTable" "ec2:CreateInternetGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:DeleteInternetGateway",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DeleteVpc",
"ec2:DescribeVpcs",
"ec2:DetachInternetGateway",
"ec2:DisassociateRouteTable",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVpcAttribute",
"ec2:ReplaceRoute"
], ],
"Resource": "*" "Resource": "*"
} }
@@ -326,34 +328,35 @@ The following are the required permissions for installing the Amazon EBS CSI Dri
```json ```json
{ {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:GetRole", "eks:AssociateIdentityProviderConfig",
"eks:DescribeAddonConfiguration", "eks:CreateAddon",
"eks:UpdateAddon", "eks:DeleteAddon",
"eks:ListAddons", "eks:DescribeAddon",
"iam:CreateRole", "eks:DescribeAddonConfiguration",
"iam:AttachRolePolicy", "eks:DescribeAddonVersions",
"eks:DescribeAddon", "eks:DescribeCluster",
"iam:CreateOpenIDConnectProvider", "eks:DescribeIdentityProviderConfig",
"iam:PassRole", "eks:ListAddons",
"eks:DescribeIdentityProviderConfig", "eks:ListIdentityProviderConfigs",
"eks:DeleteAddon", "eks:UpdateAddon",
"iam:ListOpenIDConnectProviders", "iam:AttachRolePolicy",
"iam:ListAttachedRolePolicies", "iam:CreateOpenIDConnectProvider",
"eks:CreateAddon", "iam:CreateRole",
"eks:DescribeCluster", "iam:GetRole",
"eks:DescribeAddonVersions", "iam:ListAttachedRolePolicies",
"sts:AssumeRoleWithWebIdentity", "iam:ListOpenIDConnectProviders",
"eks:AssociateIdentityProviderConfig", "iam:PassRole",
"eks:ListIdentityProviderConfigs" "iam:TagRole",
], "sts:AssumeRoleWithWebIdentity"
"Resource": "*" ],
} "Resource": "*"
] }
]
} }
``` ```
versioned_docs/version-2.8/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md
+129 -127
View File
@@ -105,113 +105,114 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
```json ```json
{ {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Sid": "EC2Permissions", "Sid": "EC2Permissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:RunInstances", "ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress", "ec2:CreateKeyPair",
"ec2:DescribeInstanceTypes", "ec2:CreateLaunchTemplate",
"ec2:DescribeRegions", "ec2:CreateLaunchTemplateVersion",
"ec2:DescribeVpcs", "ec2:CreateSecurityGroup",
"ec2:DescribeTags", "ec2:CreateTags",
"ec2:DescribeSubnets", "ec2:DeleteKeyPair",
"ec2:DescribeSecurityGroups", "ec2:DeleteLaunchTemplate",
"ec2:DescribeRouteTables", "ec2:DeleteLaunchTemplateVersions",
"ec2:DescribeLaunchTemplateVersions", "ec2:DeleteSecurityGroup",
"ec2:DescribeLaunchTemplates", "ec2:DeleteTags",
"ec2:DescribeKeyPairs", "ec2:DescribeAccountAttributes",
"ec2:DescribeInternetGateways", "ec2:DescribeAvailabilityZones",
"ec2:DescribeImages", "ec2:DescribeImages",
"ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways",
"ec2:DescribeAccountAttributes", "ec2:DescribeInstanceTypes",
"ec2:DeleteTags", "ec2:DescribeKeyPairs",
"ec2:DeleteLaunchTemplateVersions", "ec2:DescribeLaunchTemplateVersions",
"ec2:DeleteLaunchTemplate", "ec2:DescribeLaunchTemplates",
"ec2:DeleteSecurityGroup", "ec2:DescribeRegions",
"ec2:DeleteKeyPair", "ec2:DescribeRouteTables",
"ec2:CreateTags", "ec2:DescribeSecurityGroups",
"ec2:CreateSecurityGroup", "ec2:DescribeSubnets",
"ec2:CreateLaunchTemplateVersion", "ec2:DescribeTags",
"ec2:CreateLaunchTemplate", "ec2:DescribeVpcs",
"ec2:CreateKeyPair", "ec2:RevokeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress" "ec2:RunInstances"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "CloudFormationPermissions", "Sid": "CloudFormationPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"cloudformation:ListStacks", "cloudformation:CreateStack",
"cloudformation:ListStackResources", "cloudformation:CreateStackSet",
"cloudformation:DescribeStacks", "cloudformation:DeleteStack",
"cloudformation:DescribeStackResources", "cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources",
"cloudformation:DeleteStack", "cloudformation:DescribeStacks",
"cloudformation:CreateStackSet", "cloudformation:ListStackResources",
"cloudformation:CreateStack" "cloudformation:ListStacks"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "IAMPermissions", "Sid": "IAMPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:PassRole", "iam:AttachRolePolicy",
"iam:ListRoles", "iam:CreateRole",
"iam:ListRoleTags", "iam:DetachRolePolicy",
"iam:ListInstanceProfilesForRole", "iam:DeleteRole",
"iam:ListInstanceProfiles", "iam:GetRole",
"iam:ListAttachedRolePolicies", "iam:GetInstanceProfile",
"iam:GetRole", "iam:ListAttachedRolePolicies",
"iam:GetInstanceProfile", "iam:ListInstanceProfilesForRole",
"iam:DetachRolePolicy", "iam:ListInstanceProfiles",
"iam:DeleteRole", "iam:ListRoles",
"iam:CreateRole", "iam:ListRoleTags",
"iam:AttachRolePolicy" "iam:PassRole"
], "iam:TagRole"
"Resource": "*" ],
}, "Resource": "*"
{ },
"Sid": "KMSPermissions", {
"Effect": "Allow", "Sid": "KMSPermissions",
"Action": "kms:ListKeys", "Effect": "Allow",
"Resource": "*" "Action": "kms:ListKeys",
}, "Resource": "*"
{ },
"Sid": "EKSPermissions", {
"Effect": "Allow", "Sid": "EKSPermissions",
"Action": [ "Effect": "Allow",
"eks:UpdateNodegroupVersion", "Action": [
"eks:UpdateNodegroupConfig", "eks:CreateCluster",
"eks:UpdateClusterVersion", "eks:CreateFargateProfile",
"eks:UpdateClusterConfig", "eks:CreateNodegroup",
"eks:UntagResource", "eks:DeleteCluster",
"eks:TagResource", "eks:DeleteFargateProfile",
"eks:ListUpdates", "eks:DeleteNodegroup",
"eks:ListTagsForResource", "eks:DescribeCluster",
"eks:ListNodegroups", "eks:DescribeFargateProfile",
"eks:ListFargateProfiles", "eks:DescribeNodegroup",
"eks:ListClusters", "eks:DescribeUpdate",
"eks:DescribeUpdate", "eks:ListClusters",
"eks:DescribeNodegroup", "eks:ListFargateProfiles",
"eks:DescribeFargateProfile", "eks:ListNodegroups",
"eks:DescribeCluster", "eks:ListTagsForResource",
"eks:DeleteNodegroup", "eks:ListUpdates",
"eks:DeleteFargateProfile", "eks:TagResource",
"eks:DeleteCluster", "eks:UntagResource",
"eks:CreateNodegroup", "eks:UpdateClusterConfig",
"eks:CreateFargateProfile", "eks:UpdateClusterVersion",
"eks:CreateCluster" "eks:UpdateNodegroupConfig",
], "eks:UpdateNodegroupVersion"
"Resource": "*" ],
} "Resource": "*"
] }
]
} }
``` ```
@@ -243,7 +244,8 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
"iam:ListRoles", "iam:ListRoles",
"iam:ListRoleTags", "iam:ListRoleTags",
"iam:PassRole", "iam:PassRole",
"iam:RemoveRoleFromInstanceProfile" "iam:RemoveRoleFromInstanceProfile",
"iam:TagRole"
], ],
"Resource": "*" "Resource": "*"
} }
@@ -288,26 +290,26 @@ These are permissions that are needed by Rancher to create a Virtual Private Clo
"Sid": "VPCPermissions", "Sid": "VPCPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:ReplaceRoute", "ec2:AssociateRouteTable",
"ec2:ModifyVpcAttribute",
"ec2:ModifySubnetAttribute",
"ec2:DisassociateRouteTable",
"ec2:DetachInternetGateway",
"ec2:DescribeVpcs",
"ec2:DeleteVpc",
"ec2:DeleteTags",
"ec2:DeleteSubnet",
"ec2:DeleteRouteTable",
"ec2:DeleteRoute",
"ec2:DeleteInternetGateway",
"ec2:CreateVpc",
"ec2:CreateSubnet",
"ec2:CreateSecurityGroup",
"ec2:CreateRouteTable",
"ec2:CreateRoute",
"ec2:CreateInternetGateway",
"ec2:AttachInternetGateway", "ec2:AttachInternetGateway",
"ec2:AssociateRouteTable" "ec2:CreateInternetGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:DeleteInternetGateway",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DeleteVpc",
"ec2:DescribeVpcs",
"ec2:DetachInternetGateway",
"ec2:DisassociateRouteTable",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVpcAttribute",
"ec2:ReplaceRoute"
], ],
"Resource": "*" "Resource": "*"
} }
versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md
+159 -155
View File
@@ -105,117 +105,119 @@ Service Role | Provides permissions that allow Kubernetes to manage resources on
VPC | Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following [VPC Permissions](#vpc-permissions). VPC | Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following [VPC Permissions](#vpc-permissions).
EBS CSI Driver add-on | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following [EBS CSI Driver addon Permissions](#ebs-csi-driver-addon-permissions). EBS CSI Driver add-on | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following [EBS CSI Driver addon Permissions](#ebs-csi-driver-addon-permissions).
Resource targeting uses `*` as the ARN of many of the resources created cannot be known before creating the EKS cluster in Rancher. Resource targeting uses `*` as the ARN of many of the resources created cannot be known before creating the EKS cluster in Rancher.
```json ```json
{ {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Sid": "EC2Permissions", "Sid": "EC2Permissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:RunInstances", "ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress", "ec2:CreateKeyPair",
"ec2:DescribeInstanceTypes", "ec2:CreateLaunchTemplate",
"ec2:DescribeRegions", "ec2:CreateLaunchTemplateVersion",
"ec2:DescribeVpcs", "ec2:CreateSecurityGroup",
"ec2:DescribeTags", "ec2:CreateTags",
"ec2:DescribeSubnets", "ec2:DeleteKeyPair",
"ec2:DescribeSecurityGroups", "ec2:DeleteLaunchTemplate",
"ec2:DescribeRouteTables", "ec2:DeleteLaunchTemplateVersions",
"ec2:DescribeLaunchTemplateVersions", "ec2:DeleteSecurityGroup",
"ec2:DescribeLaunchTemplates", "ec2:DeleteTags",
"ec2:DescribeKeyPairs", "ec2:DescribeAccountAttributes",
"ec2:DescribeInternetGateways", "ec2:DescribeAvailabilityZones",
"ec2:DescribeImages", "ec2:DescribeImages",
"ec2:DescribeAvailabilityZones", "ec2:DescribeInternetGateways",
"ec2:DescribeAccountAttributes", "ec2:DescribeInstanceTypes",
"ec2:DeleteTags", "ec2:DescribeKeyPairs",
"ec2:DeleteLaunchTemplateVersions", "ec2:DescribeLaunchTemplateVersions",
"ec2:DeleteLaunchTemplate", "ec2:DescribeLaunchTemplates",
"ec2:DeleteSecurityGroup", "ec2:DescribeRegions",
"ec2:DeleteKeyPair", "ec2:DescribeRouteTables",
"ec2:CreateTags", "ec2:DescribeSecurityGroups",
"ec2:CreateSecurityGroup", "ec2:DescribeSubnets",
"ec2:CreateLaunchTemplateVersion", "ec2:DescribeTags",
"ec2:CreateLaunchTemplate", "ec2:DescribeVpcs",
"ec2:CreateKeyPair", "ec2:RevokeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress" "ec2:RunInstances"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "CloudFormationPermissions", "Sid": "CloudFormationPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"cloudformation:ListStacks", "cloudformation:CreateStack",
"cloudformation:ListStackResources", "cloudformation:CreateStackSet",
"cloudformation:DescribeStacks", "cloudformation:DeleteStack",
"cloudformation:DescribeStackResources", "cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources",
"cloudformation:DeleteStack", "cloudformation:DescribeStacks",
"cloudformation:CreateStackSet", "cloudformation:ListStackResources",
"cloudformation:CreateStack" "cloudformation:ListStacks"
], ],
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "IAMPermissions", "Sid": "IAMPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:PassRole", "iam:AttachRolePolicy",
"iam:ListRoles", "iam:CreateRole",
"iam:ListRoleTags", "iam:DetachRolePolicy",
"iam:ListInstanceProfilesForRole", "iam:DeleteRole",
"iam:ListInstanceProfiles", "iam:GetRole",
"iam:ListAttachedRolePolicies", "iam:GetInstanceProfile",
"iam:GetRole", "iam:ListAttachedRolePolicies",
"iam:GetInstanceProfile", "iam:ListInstanceProfilesForRole",
"iam:DetachRolePolicy", "iam:ListInstanceProfiles",
"iam:DeleteRole", "iam:ListRoles",
"iam:CreateRole", "iam:ListRoleTags",
"iam:AttachRolePolicy" "iam:PassRole"
], "iam:TagRole"
"Resource": "*" ],
}, "Resource": "*"
{ },
"Sid": "KMSPermissions", {
"Effect": "Allow", "Sid": "KMSPermissions",
"Action": "kms:ListKeys", "Effect": "Allow",
"Resource": "*" "Action": "kms:ListKeys",
}, "Resource": "*"
{ },
"Sid": "EKSPermissions", {
"Effect": "Allow", "Sid": "EKSPermissions",
"Action": [ "Effect": "Allow",
"eks:UpdateNodegroupVersion", "Action": [
"eks:UpdateNodegroupConfig", "eks:CreateCluster",
"eks:UpdateClusterVersion", "eks:CreateFargateProfile",
"eks:UpdateClusterConfig", "eks:CreateNodegroup",
"eks:UntagResource", "eks:DeleteCluster",
"eks:TagResource", "eks:DeleteFargateProfile",
"eks:ListUpdates", "eks:DeleteNodegroup",
"eks:ListTagsForResource", "eks:DescribeCluster",
"eks:ListNodegroups", "eks:DescribeFargateProfile",
"eks:ListFargateProfiles", "eks:DescribeNodegroup",
"eks:ListClusters", "eks:DescribeUpdate",
"eks:DescribeUpdate", "eks:ListClusters",
"eks:DescribeNodegroup", "eks:ListFargateProfiles",
"eks:DescribeFargateProfile", "eks:ListNodegroups",
"eks:DescribeCluster", "eks:ListTagsForResource",
"eks:DeleteNodegroup", "eks:ListUpdates",
"eks:DeleteFargateProfile", "eks:TagResource",
"eks:DeleteCluster", "eks:UntagResource",
"eks:CreateNodegroup", "eks:UpdateClusterConfig",
"eks:CreateFargateProfile", "eks:UpdateClusterVersion",
"eks:CreateCluster" "eks:UpdateNodegroupConfig",
], "eks:UpdateNodegroupVersion"
"Resource": "*" ],
} "Resource": "*"
] }
]
} }
``` ```
@@ -247,7 +249,8 @@ These are permissions that are needed during EKS cluster creation, so Rancher ca
"iam:ListRoles", "iam:ListRoles",
"iam:ListRoleTags", "iam:ListRoleTags",
"iam:PassRole", "iam:PassRole",
"iam:RemoveRoleFromInstanceProfile" "iam:RemoveRoleFromInstanceProfile",
"iam:TagRole"
], ],
"Resource": "*" "Resource": "*"
} }
@@ -292,26 +295,26 @@ These are permissions that are needed by Rancher to create a Virtual Private Clo
"Sid": "VPCPermissions", "Sid": "VPCPermissions",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:ReplaceRoute", "ec2:AssociateRouteTable",
"ec2:ModifyVpcAttribute",
"ec2:ModifySubnetAttribute",
"ec2:DisassociateRouteTable",
"ec2:DetachInternetGateway",
"ec2:DescribeVpcs",
"ec2:DeleteVpc",
"ec2:DeleteTags",
"ec2:DeleteSubnet",
"ec2:DeleteRouteTable",
"ec2:DeleteRoute",
"ec2:DeleteInternetGateway",
"ec2:CreateVpc",
"ec2:CreateSubnet",
"ec2:CreateSecurityGroup",
"ec2:CreateRouteTable",
"ec2:CreateRoute",
"ec2:CreateInternetGateway",
"ec2:AttachInternetGateway", "ec2:AttachInternetGateway",
"ec2:AssociateRouteTable" "ec2:CreateInternetGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:DeleteInternetGateway",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DeleteVpc",
"ec2:DescribeVpcs",
"ec2:DetachInternetGateway",
"ec2:DisassociateRouteTable",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVpcAttribute",
"ec2:ReplaceRoute"
], ],
"Resource": "*" "Resource": "*"
} }
@@ -325,34 +328,35 @@ The following are the required permissions for installing the Amazon EBS CSI Dri
```json ```json
{ {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:GetRole", "eks:AssociateIdentityProviderConfig",
"eks:DescribeAddonConfiguration", "eks:CreateAddon",
"eks:UpdateAddon", "eks:DeleteAddon",
"eks:ListAddons", "eks:DescribeAddon",
"iam:CreateRole", "eks:DescribeAddonConfiguration",
"iam:AttachRolePolicy", "eks:DescribeAddonVersions",
"eks:DescribeAddon", "eks:DescribeCluster",
"iam:CreateOpenIDConnectProvider", "eks:DescribeIdentityProviderConfig",
"iam:PassRole", "eks:ListAddons",
"eks:DescribeIdentityProviderConfig", "eks:ListIdentityProviderConfigs",
"eks:DeleteAddon", "eks:UpdateAddon",
"iam:ListOpenIDConnectProviders", "iam:AttachRolePolicy",
"iam:ListAttachedRolePolicies", "iam:CreateOpenIDConnectProvider",
"eks:CreateAddon", "iam:CreateRole",
"eks:DescribeCluster", "iam:GetRole",
"eks:DescribeAddonVersions", "iam:ListAttachedRolePolicies",
"sts:AssumeRoleWithWebIdentity", "iam:ListOpenIDConnectProviders",
"eks:AssociateIdentityProviderConfig", "iam:PassRole",
"eks:ListIdentityProviderConfigs" "iam:TagRole",
], "sts:AssumeRoleWithWebIdentity"
"Resource": "*" ],
} "Resource": "*"
] }
]
} }
``` ```