fixed iam permissions for karpenter

Signed-off-by: Sienna Satterwhite <sienna.satterwhite@jamf.com>
eksctl-io · Jul 4, 2024 · df81750 · df81750
1 parent 3fdd538
commit df81750
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 3 deletions.
diff --git a/pkg/cfn/builder/karpenter.go b/pkg/cfn/builder/karpenter.go
@@ -49,9 +49,15 @@ const (
 	ec2DescribeImages                = "ec2:DescribeImages"
 	ec2DescribeSpotPriceHistory      = "ec2:DescribeSpotPriceHistory"
 	// IAM
-	iamPassRole                = "iam:PassRole"
-	iamCreateServiceLinkedRole = "iam:CreateServiceLinkedRole"
-	ssmGetParameter            = "ssm:GetParameter"
+	iamPassRole                 = "iam:PassRole"
+	iamCreateServiceLinkedRole  = "iam:CreateServiceLinkedRole"
+	iamGetInstanceProfile       = "iam:GetInstanceProfile"
+	iamCreateInstanceProfile    = "iam:CreateInstanceProfile"
+	iamDeleteInstanceProfile    = "iam:DeleteInstanceProfile"
+	iamTagInstanceProfile       = "iam:TagInstanceProfile"
+	iamAddRoleToInstanceProfile = "iam:AddRoleToInstanceProfile"
+	// SSM
+	ssmGetParameter = "ssm:GetParameter"
 	// Pricing
 	pricingGetProducts = "pricing:GetProducts"
 	// SQS
@@ -165,6 +171,11 @@ func (k *KarpenterResourceSet) addResourcesForKarpenter() error {
 				ec2DescribeSpotPriceHistory,
 				iamPassRole,
 				iamCreateServiceLinkedRole,
+				iamGetInstanceProfile,
+				iamCreateInstanceProfile,
+				iamDeleteInstanceProfile,
+				iamTagInstanceProfile,
+				iamAddRoleToInstanceProfile,
 				ssmGetParameter,
 				pricingGetProducts,
 			},

diff --git a/pkg/cfn/builder/karpenter_test.go b/pkg/cfn/builder/karpenter_test.go
@@ -125,6 +125,11 @@ var expectedTemplate = `{
                 "ec2:DescribeSpotPriceHistory",
                 "iam:PassRole",
                 "iam:CreateServiceLinkedRole",
+                "iam:GetInstanceProfile",
+                "iam:CreateInstanceProfile",
+                "iam:DeleteInstanceProfile",
+                "iam:TagInstanceProfile",
+                "iam:AddRoleToInstanceProfile",
                 "ssm:GetParameter",
                 "pricing:GetProducts"
               ],
@@ -262,6 +267,11 @@ var expectedTemplateWithPermissionBoundary = `{
                 "ec2:DescribeSpotPriceHistory",
                 "iam:PassRole",
                 "iam:CreateServiceLinkedRole",
+                "iam:GetInstanceProfile",
+                "iam:CreateInstanceProfile",
+                "iam:DeleteInstanceProfile",
+                "iam:TagInstanceProfile",
+                "iam:AddRoleToInstanceProfile",
                 "ssm:GetParameter",
                 "pricing:GetProducts"
               ],
@@ -424,6 +434,11 @@ var expectedTemplateWithSpotInterruptionQueue = `{
                 "ec2:DescribeSpotPriceHistory",
                 "iam:PassRole",
                 "iam:CreateServiceLinkedRole",
+                "iam:GetInstanceProfile",
+                "iam:CreateInstanceProfile",
+                "iam:DeleteInstanceProfile",
+                "iam:TagInstanceProfile",
+                "iam:AddRoleToInstanceProfile",
                 "ssm:GetParameter",
                 "pricing:GetProducts"
               ],