public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 13:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3102 from alexarnoldy/aarnoldy-eks-service-role-vpc

Browse Source 
aarnoldy-eks-service-role-vpc
This commit is contained in:
Billy Tat
2022-01-13 16:21:55 -08:00
committed by GitHub
parent 1ac1490202 b505968a93
commit a8cd34bc62
2 changed files with 110 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md
+55 -50
View File
@@ -123,31 +123,6 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
### Service Role Permissions ### Service Role Permissions
Rancher will create a service role with the following trust policy:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "eks.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
```
This role will also have two role policy attachments with the following policies ARNs:
```
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
```
Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process. Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process.
```json ```json
@@ -182,36 +157,66 @@ Permissions required for Rancher to create service role on users behalf during t
} }
``` ```
When an EKS cluster is created, Rancher will create a service role with the following trust policy:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "eks.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
```
This role will also have two role policy attachments with the following policies ARNs:
```
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
```
### VPC Permissions ### VPC Permissions
Permissions required for Rancher to create VPC and associated resources. Permissions required for Rancher to create VPC and associated resources.
```json ```json
{ {
"Sid": "VPCPermissions", "Version": "2012-10-17",
"Effect": "Allow", "Statement": [
"Action": [ {
"ec2:ReplaceRoute", "Sid": "VPCPermissions",
"ec2:ModifyVpcAttribute", "Effect": "Allow",
"ec2:ModifySubnetAttribute", "Action": [
"ec2:DisassociateRouteTable", "ec2:ReplaceRoute",
"ec2:DetachInternetGateway", "ec2:ModifyVpcAttribute",
"ec2:DescribeVpcs", "ec2:ModifySubnetAttribute",
"ec2:DeleteVpc", "ec2:DisassociateRouteTable",
"ec2:DeleteTags", "ec2:DetachInternetGateway",
"ec2:DeleteSubnet", "ec2:DescribeVpcs",
"ec2:DeleteRouteTable", "ec2:DeleteVpc",
"ec2:DeleteRoute", "ec2:DeleteTags",
"ec2:DeleteInternetGateway", "ec2:DeleteSubnet",
"ec2:CreateVpc", "ec2:DeleteRouteTable",
"ec2:CreateSubnet", "ec2:DeleteRoute",
"ec2:CreateSecurityGroup", "ec2:DeleteInternetGateway",
"ec2:CreateRouteTable", "ec2:CreateVpc",
"ec2:CreateRoute", "ec2:CreateSubnet",
"ec2:CreateInternetGateway", "ec2:CreateSecurityGroup",
"ec2:AttachInternetGateway", "ec2:CreateRouteTable",
"ec2:AssociateRouteTable" "ec2:CreateRoute",
], "ec2:CreateInternetGateway",
"Resource": "*" "ec2:AttachInternetGateway",
"ec2:AssociateRouteTable"
],
"Resource": "*"
}
]
} }
``` ```
content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md
+55 -50
View File
@@ -123,31 +123,6 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
### Service Role Permissions ### Service Role Permissions
Rancher will create a service role with the following trust policy:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "eks.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
```
This role will also have two role policy attachments with the following policies ARNs:
```
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
```
Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process. Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process.
```json ```json
@@ -182,36 +157,66 @@ Permissions required for Rancher to create service role on users behalf during t
} }
``` ```
When an EKS cluster is created, Rancher will create a service role with the following trust policy:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "eks.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
```
This role will also have two role policy attachments with the following policies ARNs:
```
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
```
### VPC Permissions ### VPC Permissions
Permissions required for Rancher to create VPC and associated resources. Permissions required for Rancher to create VPC and associated resources.
```json ```json
{ {
"Sid": "VPCPermissions", "Version": "2012-10-17",
"Effect": "Allow", "Statement": [
"Action": [ {
"ec2:ReplaceRoute", "Sid": "VPCPermissions",
"ec2:ModifyVpcAttribute", "Effect": "Allow",
"ec2:ModifySubnetAttribute", "Action": [
"ec2:DisassociateRouteTable", "ec2:ReplaceRoute",
"ec2:DetachInternetGateway", "ec2:ModifyVpcAttribute",
"ec2:DescribeVpcs", "ec2:ModifySubnetAttribute",
"ec2:DeleteVpc", "ec2:DisassociateRouteTable",
"ec2:DeleteTags", "ec2:DetachInternetGateway",
"ec2:DeleteSubnet", "ec2:DescribeVpcs",
"ec2:DeleteRouteTable", "ec2:DeleteVpc",
"ec2:DeleteRoute", "ec2:DeleteTags",
"ec2:DeleteInternetGateway", "ec2:DeleteSubnet",
"ec2:CreateVpc", "ec2:DeleteRouteTable",
"ec2:CreateSubnet", "ec2:DeleteRoute",
"ec2:CreateSecurityGroup", "ec2:DeleteInternetGateway",
"ec2:CreateRouteTable", "ec2:CreateVpc",
"ec2:CreateRoute", "ec2:CreateSubnet",
"ec2:CreateInternetGateway", "ec2:CreateSecurityGroup",
"ec2:AttachInternetGateway", "ec2:CreateRouteTable",
"ec2:AssociateRouteTable" "ec2:CreateRoute",
], "ec2:CreateInternetGateway",
"Resource": "*" "ec2:AttachInternetGateway",
"ec2:AssociateRouteTable"
],
"Resource": "*"
}
]
} }
``` ```