From 21de5f1f58d956286cf967b6aa37139be48800a1 Mon Sep 17 00:00:00 2001 From: yiannistri <8741709+yiannistri@users.noreply.github.com> Date: Mon, 9 Dec 2024 10:47:45 +0000 Subject: [PATCH 1/3] docs: Move `eks:DescribeAddon` permission to minimum set of required permissions --- .../set-up-clusters-from-hosted-kubernetes-providers/eks.md | 4 ++-- .../set-up-clusters-from-hosted-kubernetes-providers/eks.md | 4 ++-- .../set-up-clusters-from-hosted-kubernetes-providers/eks.md | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index ab493afeb47..53310547493 100644 --- a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -178,7 +178,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "iam:ListInstanceProfiles", "iam:ListRoles", "iam:ListRoleTags", - "iam:PassRole" + "iam:PassRole", "iam:TagRole" ], "Resource": "*" @@ -199,6 +199,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "eks:DeleteCluster", "eks:DeleteFargateProfile", "eks:DeleteNodegroup", + "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", @@ -336,7 +337,6 @@ The following are the required permissions for installing the Amazon EBS CSI Dri "eks:AssociateIdentityProviderConfig", "eks:CreateAddon", "eks:DeleteAddon", - "eks:DescribeAddon", "eks:DescribeAddonConfiguration", "eks:DescribeAddonVersions", "eks:DescribeCluster", diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index ab493afeb47..53310547493 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -178,7 +178,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "iam:ListInstanceProfiles", "iam:ListRoles", "iam:ListRoleTags", - "iam:PassRole" + "iam:PassRole", "iam:TagRole" ], "Resource": "*" @@ -199,6 +199,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "eks:DeleteCluster", "eks:DeleteFargateProfile", "eks:DeleteNodegroup", + "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", @@ -336,7 +337,6 @@ The following are the required permissions for installing the Amazon EBS CSI Dri "eks:AssociateIdentityProviderConfig", "eks:CreateAddon", "eks:DeleteAddon", - "eks:DescribeAddon", "eks:DescribeAddonConfiguration", "eks:DescribeAddonVersions", "eks:DescribeCluster", diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index ab493afeb47..53310547493 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -178,7 +178,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "iam:ListInstanceProfiles", "iam:ListRoles", "iam:ListRoleTags", - "iam:PassRole" + "iam:PassRole", "iam:TagRole" ], "Resource": "*" @@ -199,6 +199,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "eks:DeleteCluster", "eks:DeleteFargateProfile", "eks:DeleteNodegroup", + "eks:DescribeAddon", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", @@ -336,7 +337,6 @@ The following are the required permissions for installing the Amazon EBS CSI Dri "eks:AssociateIdentityProviderConfig", "eks:CreateAddon", "eks:DeleteAddon", - "eks:DescribeAddon", "eks:DescribeAddonConfiguration", "eks:DescribeAddonVersions", "eks:DescribeCluster", From 690a8ceab643eb9e1dba10740cd8f1ebfc320f5d Mon Sep 17 00:00:00 2001 From: yiannistri <8741709+yiannistri@users.noreply.github.com> Date: Mon, 9 Dec 2024 15:29:23 +0000 Subject: [PATCH 2/3] docs: Consolidate Service Role and VPC permissions into minimum EKS permissions. --- .../eks.md | 108 +++++------------- .../eks.md | 108 +++++------------- .../eks.md | 108 +++++------------- 3 files changed, 93 insertions(+), 231 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index 53310547493..b8b76e9880d 100644 --- a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -93,7 +93,7 @@ This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-ra ## Minimum EKS Permissions -These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources **before** you create the cluster, they'll be available when you configure the cluster. +These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary. :::note In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volumes. You need [specific permissions](#ebs-csi-driver-addon-permissions) to enable this add-on. @@ -101,8 +101,6 @@ In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volu Resource | Description ---------|------------ -Service Role | Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following [Service Role Permissions](#service-role-permissions). -VPC | Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following [VPC Permissions](#vpc-permissions). EBS CSI Driver add-on | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following [EBS CSI Driver addon Permissions](#ebs-csi-driver-addon-permissions). @@ -167,18 +165,23 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "Sid": "IAMPermissions", "Effect": "Allow", "Action": [ + "iam:AddRoleToInstanceProfile", "iam:AttachRolePolicy", + "iam:CreateInstanceProfile", "iam:CreateRole", - "iam:DetachRolePolicy", + "iam:CreateServiceLinkedRole", + "iam:DeleteInstanceProfile", "iam:DeleteRole", - "iam:GetRole", + "iam:DetachRolePolicy", "iam:GetInstanceProfile", + "iam:GetRole", "iam:ListAttachedRolePolicies", - "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfiles", + "iam:ListInstanceProfilesForRole", "iam:ListRoles", "iam:ListRoleTags", "iam:PassRole", + "iam:RemoveRoleFromInstanceProfile", "iam:TagRole" ], "Resource": "*" @@ -217,41 +220,31 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "eks:UpdateNodegroupVersion" ], "Resource": "*" - } - ] -} -``` - -### Service Role Permissions - -These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf. - -```json -{ - "Version": "2012-10-17", - "Statement": [ + }, { - "Sid": "IAMPermissions", + "Sid": "VPCPermissions", "Effect": "Allow", "Action": [ - "iam:AddRoleToInstanceProfile", - "iam:AttachRolePolicy", - "iam:CreateInstanceProfile", - "iam:CreateRole", - "iam:CreateServiceLinkedRole", - "iam:DeleteInstanceProfile", - "iam:DeleteRole", - "iam:DetachRolePolicy", - "iam:GetInstanceProfile", - "iam:GetRole", - "iam:ListAttachedRolePolicies", - "iam:ListInstanceProfiles", - "iam:ListInstanceProfilesForRole", - "iam:ListRoles", - "iam:ListRoleTags", - "iam:PassRole", - "iam:RemoveRoleFromInstanceProfile", - "iam:TagRole" + "ec2:AssociateRouteTable", + "ec2:AttachInternetGateway", + "ec2:CreateInternetGateway", + "ec2:CreateRoute", + "ec2:CreateRouteTable", + "ec2:CreateSecurityGroup", + "ec2:CreateSubnet", + "ec2:CreateVpc", + "ec2:DeleteInternetGateway", + "ec2:DeleteRoute", + "ec2:DeleteRouteTable", + "ec2:DeleteSubnet", + "ec2:DeleteTags", + "ec2:DeleteVpc", + "ec2:DescribeVpcs", + "ec2:DetachInternetGateway", + "ec2:DisassociateRouteTable", + "ec2:ModifySubnetAttribute", + "ec2:ModifyVpcAttribute", + "ec2:ReplaceRoute" ], "Resource": "*" } @@ -284,45 +277,6 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy arn:aws:iam::aws:policy/AmazonEKSServicePolicy ``` -### VPC Permissions - -These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources. - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "VPCPermissions", - "Effect": "Allow", - "Action": [ - "ec2:AssociateRouteTable", - "ec2:AttachInternetGateway", - "ec2:CreateInternetGateway", - "ec2:CreateRoute", - "ec2:CreateRouteTable", - "ec2:CreateSecurityGroup", - "ec2:CreateSubnet", - "ec2:CreateVpc", - "ec2:DeleteInternetGateway", - "ec2:DeleteRoute", - "ec2:DeleteRouteTable", - "ec2:DeleteSubnet", - "ec2:DeleteTags", - "ec2:DeleteVpc", - "ec2:DescribeVpcs", - "ec2:DetachInternetGateway", - "ec2:DisassociateRouteTable", - "ec2:ModifySubnetAttribute", - "ec2:ModifyVpcAttribute", - "ec2:ReplaceRoute" - ], - "Resource": "*" - } - ] -} -``` - ### EBS CSI Driver addon Permissions The following are the required permissions for installing the Amazon EBS CSI Driver add-on. diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index 53310547493..b8b76e9880d 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -93,7 +93,7 @@ This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-ra ## Minimum EKS Permissions -These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources **before** you create the cluster, they'll be available when you configure the cluster. +These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary. :::note In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volumes. You need [specific permissions](#ebs-csi-driver-addon-permissions) to enable this add-on. @@ -101,8 +101,6 @@ In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volu Resource | Description ---------|------------ -Service Role | Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following [Service Role Permissions](#service-role-permissions). -VPC | Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following [VPC Permissions](#vpc-permissions). EBS CSI Driver add-on | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following [EBS CSI Driver addon Permissions](#ebs-csi-driver-addon-permissions). @@ -167,18 +165,23 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "Sid": "IAMPermissions", "Effect": "Allow", "Action": [ + "iam:AddRoleToInstanceProfile", "iam:AttachRolePolicy", + "iam:CreateInstanceProfile", "iam:CreateRole", - "iam:DetachRolePolicy", + "iam:CreateServiceLinkedRole", + "iam:DeleteInstanceProfile", "iam:DeleteRole", - "iam:GetRole", + "iam:DetachRolePolicy", "iam:GetInstanceProfile", + "iam:GetRole", "iam:ListAttachedRolePolicies", - "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfiles", + "iam:ListInstanceProfilesForRole", "iam:ListRoles", "iam:ListRoleTags", "iam:PassRole", + "iam:RemoveRoleFromInstanceProfile", "iam:TagRole" ], "Resource": "*" @@ -217,41 +220,31 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "eks:UpdateNodegroupVersion" ], "Resource": "*" - } - ] -} -``` - -### Service Role Permissions - -These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf. - -```json -{ - "Version": "2012-10-17", - "Statement": [ + }, { - "Sid": "IAMPermissions", + "Sid": "VPCPermissions", "Effect": "Allow", "Action": [ - "iam:AddRoleToInstanceProfile", - "iam:AttachRolePolicy", - "iam:CreateInstanceProfile", - "iam:CreateRole", - "iam:CreateServiceLinkedRole", - "iam:DeleteInstanceProfile", - "iam:DeleteRole", - "iam:DetachRolePolicy", - "iam:GetInstanceProfile", - "iam:GetRole", - "iam:ListAttachedRolePolicies", - "iam:ListInstanceProfiles", - "iam:ListInstanceProfilesForRole", - "iam:ListRoles", - "iam:ListRoleTags", - "iam:PassRole", - "iam:RemoveRoleFromInstanceProfile", - "iam:TagRole" + "ec2:AssociateRouteTable", + "ec2:AttachInternetGateway", + "ec2:CreateInternetGateway", + "ec2:CreateRoute", + "ec2:CreateRouteTable", + "ec2:CreateSecurityGroup", + "ec2:CreateSubnet", + "ec2:CreateVpc", + "ec2:DeleteInternetGateway", + "ec2:DeleteRoute", + "ec2:DeleteRouteTable", + "ec2:DeleteSubnet", + "ec2:DeleteTags", + "ec2:DeleteVpc", + "ec2:DescribeVpcs", + "ec2:DetachInternetGateway", + "ec2:DisassociateRouteTable", + "ec2:ModifySubnetAttribute", + "ec2:ModifyVpcAttribute", + "ec2:ReplaceRoute" ], "Resource": "*" } @@ -284,45 +277,6 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy arn:aws:iam::aws:policy/AmazonEKSServicePolicy ``` -### VPC Permissions - -These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources. - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "VPCPermissions", - "Effect": "Allow", - "Action": [ - "ec2:AssociateRouteTable", - "ec2:AttachInternetGateway", - "ec2:CreateInternetGateway", - "ec2:CreateRoute", - "ec2:CreateRouteTable", - "ec2:CreateSecurityGroup", - "ec2:CreateSubnet", - "ec2:CreateVpc", - "ec2:DeleteInternetGateway", - "ec2:DeleteRoute", - "ec2:DeleteRouteTable", - "ec2:DeleteSubnet", - "ec2:DeleteTags", - "ec2:DeleteVpc", - "ec2:DescribeVpcs", - "ec2:DetachInternetGateway", - "ec2:DisassociateRouteTable", - "ec2:ModifySubnetAttribute", - "ec2:ModifyVpcAttribute", - "ec2:ReplaceRoute" - ], - "Resource": "*" - } - ] -} -``` - ### EBS CSI Driver addon Permissions The following are the required permissions for installing the Amazon EBS CSI Driver add-on. diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index 53310547493..b8b76e9880d 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -93,7 +93,7 @@ This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-ra ## Minimum EKS Permissions -These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. You'll need additional permissions for Rancher to provision the `Service Role` and `VPC` resources. If you create these resources **before** you create the cluster, they'll be available when you configure the cluster. +These are the minimum set of permissions necessary to access the full functionality of Rancher's EKS driver. These permissions allow Rancher to create the Service Role and Virtual Private Cloud (VPC) resources on the users' behalf, if necessary. :::note In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volumes. You need [specific permissions](#ebs-csi-driver-addon-permissions) to enable this add-on. @@ -101,8 +101,6 @@ In EKS v1.23 and above, you must use the out-of-tree drivers for EBS-backed volu Resource | Description ---------|------------ -Service Role | Provides permissions that allow Kubernetes to manage resources on your behalf. Rancher can create the service role with the following [Service Role Permissions](#service-role-permissions). -VPC | Provides isolated network resources utilised by EKS and worker nodes. Rancher can create the VPC resources with the following [VPC Permissions](#vpc-permissions). EBS CSI Driver add-on | Provides permissions that allow Kubernetes to interact with EBS and configure the cluster to enable the add-on (required for EKS v1.23 and above). Rancher can install the add-on with the following [EBS CSI Driver addon Permissions](#ebs-csi-driver-addon-permissions). @@ -167,18 +165,23 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "Sid": "IAMPermissions", "Effect": "Allow", "Action": [ + "iam:AddRoleToInstanceProfile", "iam:AttachRolePolicy", + "iam:CreateInstanceProfile", "iam:CreateRole", - "iam:DetachRolePolicy", + "iam:CreateServiceLinkedRole", + "iam:DeleteInstanceProfile", "iam:DeleteRole", - "iam:GetRole", + "iam:DetachRolePolicy", "iam:GetInstanceProfile", + "iam:GetRole", "iam:ListAttachedRolePolicies", - "iam:ListInstanceProfilesForRole", "iam:ListInstanceProfiles", + "iam:ListInstanceProfilesForRole", "iam:ListRoles", "iam:ListRoleTags", "iam:PassRole", + "iam:RemoveRoleFromInstanceProfile", "iam:TagRole" ], "Resource": "*" @@ -217,41 +220,31 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b "eks:UpdateNodegroupVersion" ], "Resource": "*" - } - ] -} -``` - -### Service Role Permissions - -These are permissions that are needed during EKS cluster creation, so Rancher can create a service role on the users' behalf. - -```json -{ - "Version": "2012-10-17", - "Statement": [ + }, { - "Sid": "IAMPermissions", + "Sid": "VPCPermissions", "Effect": "Allow", "Action": [ - "iam:AddRoleToInstanceProfile", - "iam:AttachRolePolicy", - "iam:CreateInstanceProfile", - "iam:CreateRole", - "iam:CreateServiceLinkedRole", - "iam:DeleteInstanceProfile", - "iam:DeleteRole", - "iam:DetachRolePolicy", - "iam:GetInstanceProfile", - "iam:GetRole", - "iam:ListAttachedRolePolicies", - "iam:ListInstanceProfiles", - "iam:ListInstanceProfilesForRole", - "iam:ListRoles", - "iam:ListRoleTags", - "iam:PassRole", - "iam:RemoveRoleFromInstanceProfile", - "iam:TagRole" + "ec2:AssociateRouteTable", + "ec2:AttachInternetGateway", + "ec2:CreateInternetGateway", + "ec2:CreateRoute", + "ec2:CreateRouteTable", + "ec2:CreateSecurityGroup", + "ec2:CreateSubnet", + "ec2:CreateVpc", + "ec2:DeleteInternetGateway", + "ec2:DeleteRoute", + "ec2:DeleteRouteTable", + "ec2:DeleteSubnet", + "ec2:DeleteTags", + "ec2:DeleteVpc", + "ec2:DescribeVpcs", + "ec2:DetachInternetGateway", + "ec2:DisassociateRouteTable", + "ec2:ModifySubnetAttribute", + "ec2:ModifyVpcAttribute", + "ec2:ReplaceRoute" ], "Resource": "*" } @@ -284,45 +277,6 @@ arn:aws:iam::aws:policy/AmazonEKSClusterPolicy arn:aws:iam::aws:policy/AmazonEKSServicePolicy ``` -### VPC Permissions - -These are permissions that are needed by Rancher to create a Virtual Private Cloud (VPC) and associated resources. - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "VPCPermissions", - "Effect": "Allow", - "Action": [ - "ec2:AssociateRouteTable", - "ec2:AttachInternetGateway", - "ec2:CreateInternetGateway", - "ec2:CreateRoute", - "ec2:CreateRouteTable", - "ec2:CreateSecurityGroup", - "ec2:CreateSubnet", - "ec2:CreateVpc", - "ec2:DeleteInternetGateway", - "ec2:DeleteRoute", - "ec2:DeleteRouteTable", - "ec2:DeleteSubnet", - "ec2:DeleteTags", - "ec2:DeleteVpc", - "ec2:DescribeVpcs", - "ec2:DetachInternetGateway", - "ec2:DisassociateRouteTable", - "ec2:ModifySubnetAttribute", - "ec2:ModifyVpcAttribute", - "ec2:ReplaceRoute" - ], - "Resource": "*" - } - ] -} -``` - ### EBS CSI Driver addon Permissions The following are the required permissions for installing the Amazon EBS CSI Driver add-on. From f0ae84ea56970521643f20493316e11bd50fef4d Mon Sep 17 00:00:00 2001 From: yiannistri <8741709+yiannistri@users.noreply.github.com> Date: Mon, 9 Dec 2024 16:12:50 +0000 Subject: [PATCH 3/3] docs: Remove duplicate entries from CSI EBS addon permissions --- .../eks.md | 7 ------- .../eks.md | 7 ------- .../eks.md | 7 ------- 3 files changed, 21 deletions(-) diff --git a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index b8b76e9880d..59a6efe3c1a 100644 --- a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -293,19 +293,12 @@ The following are the required permissions for installing the Amazon EBS CSI Dri "eks:DeleteAddon", "eks:DescribeAddonConfiguration", "eks:DescribeAddonVersions", - "eks:DescribeCluster", "eks:DescribeIdentityProviderConfig", "eks:ListAddons", "eks:ListIdentityProviderConfigs", "eks:UpdateAddon", - "iam:AttachRolePolicy", "iam:CreateOpenIDConnectProvider", - "iam:CreateRole", - "iam:GetRole", - "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviders", - "iam:PassRole", - "iam:TagRole", "sts:AssumeRoleWithWebIdentity" ], "Resource": "*" diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index b8b76e9880d..59a6efe3c1a 100644 --- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -293,19 +293,12 @@ The following are the required permissions for installing the Amazon EBS CSI Dri "eks:DeleteAddon", "eks:DescribeAddonConfiguration", "eks:DescribeAddonVersions", - "eks:DescribeCluster", "eks:DescribeIdentityProviderConfig", "eks:ListAddons", "eks:ListIdentityProviderConfigs", "eks:UpdateAddon", - "iam:AttachRolePolicy", "iam:CreateOpenIDConnectProvider", - "iam:CreateRole", - "iam:GetRole", - "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviders", - "iam:PassRole", - "iam:TagRole", "sts:AssumeRoleWithWebIdentity" ], "Resource": "*" diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md index b8b76e9880d..59a6efe3c1a 100644 --- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md +++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/eks.md @@ -293,19 +293,12 @@ The following are the required permissions for installing the Amazon EBS CSI Dri "eks:DeleteAddon", "eks:DescribeAddonConfiguration", "eks:DescribeAddonVersions", - "eks:DescribeCluster", "eks:DescribeIdentityProviderConfig", "eks:ListAddons", "eks:ListIdentityProviderConfigs", "eks:UpdateAddon", - "iam:AttachRolePolicy", "iam:CreateOpenIDConnectProvider", - "iam:CreateRole", - "iam:GetRole", - "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviders", - "iam:PassRole", - "iam:TagRole", "sts:AssumeRoleWithWebIdentity" ], "Resource": "*"