Adds permissions for ELB and NLB req'd by 1.9

[geojaz]

Adds appropriate IAM permissions to Masters (in restrictive mode) for ELB and NLB.

Closes #3883

[aledbf]

@geojaz please addd the missing permissions

{
    "Sid": "kopsK8sNLBMasterPermsRestrictive",
    "Effect": "Allow",
    "Action": [
        "elasticloadbalancing:CreateListener",
        "elasticloadbalancing:DeleteListener",
        "elasticloadbalancing:ModifyListener",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:CreateTargetGroup",
        "elasticloadbalancing:DeleteTargetGroup",
        "elasticloadbalancing:ModifyTargetGroup",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:RegisterTargets",
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticloadbalancing:AddTags",
        "ec2:DescribeVpcs"
    ],
    "Resource": [
        "*"
    ]
}

[geojaz]

I mostly just rearranged the NLB permissions so they would be in alphabetical order, but it looks like you have some additional permissions that we didn't have previously.

I can add the missing pieces- is there some place that I can see the complete list that an ELB or NLB needs?

[aledbf]

I can add the missing pieces- is there some place that I can see the complete list that an ELB or NLB needs?

No. The new permission are related to update and delete operations (testing the NLB integration)
In this PDF you can get more information http://docs.aws.amazon.com/elasticloadbalancing/latest/network/elb-ng.pdf but I didn't found a table with the required permissions

[geojaz]

Perms updated as per @aledbf

[chrislovecnm]

/assign @aledbf

[aledbf]

/lgtm

[chrislovecnm]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, chrislovecnm

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [chrislovecnm]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue.

[geojaz]

thanks @chrislovecnm and @aledbf :)