Merge pull request kubernetes-sigs#2447 from richardcase/eks_encryption

fix: added missing kms permissions required for EKS encryption

Author: k8s-ci-robot

cmd/clusterawsadm/api/bootstrap/v1alpha1/defaults.go

@@ -30,6 +30,8 @@ const (
 	DefaultStackName = "cluster-api-provider-aws-sigs-k8s-io"
 	// DefaultPartitionName is the default security partition for AWS ARNs.
 	DefaultPartitionName = "aws"
+	// DefaultKMSAliasPattern is the default KMS alias.
+	DefaultKMSAliasPattern = "cluster-api-provider-aws-*"
 )
 
 func addDefaultingFuncs(scheme *runtime.Scheme) error {
@@ -85,6 +87,9 @@ func SetDefaults_AWSIAMConfigurationSpec(obj *AWSIAMConfigurationSpec) { //nolin
 			infrav1.SecretBackendSecretsManager,
 		}
 	}
+	if len(obj.EKS.KMSAliasPrefix) == 0 {
+		obj.EKS.KMSAliasPrefix = DefaultKMSAliasPattern
+	}
 }
 
 // SetDefaults_AWSIAMConfiguration is used by defaulter-gen.

cmd/clusterawsadm/api/bootstrap/v1alpha1/types.go

@@ -107,6 +107,10 @@ type EKSConfig struct {
 	// Fargate controls the configuration of the AWS IAM role for
 	// used by EKS managed machine pools.
 	Fargate *AWSIAMRoleSpec `json:"fargate,omitempty"`
+	// KMSAliasPrefix is prefix to use to restrict permission to KMS keys to only those that have an alias
+	// name that is prefixed by this.
+	// Defaults to cluster-api-provider-aws-*
+	KMSAliasPrefix string `json:"kmsAliasPrefix,omitempty"`
 }
 
 // EventBridgeConfig represents configuration for enabling experimental feature to consume

cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go

@@ -379,6 +379,21 @@ func (t Template) ControllersPolicy() *infrav1.PolicyDocument {
 				},
 				Effect: infrav1.EffectAllow,
 			},
+			{
+				Action: infrav1.Actions{
+					"kms:CreateGrant",
+					"kms:DescribeKey",
+				},
+				Resource: infrav1.Resources{
+					"*",
+				},
+				Effect: infrav1.EffectAllow,
+				Condition: infrav1.Conditions{
+					"ForAnyValue:StringLike": map[string]string{
+						"kms:ResourceAliases": fmt.Sprintf("alias/%s", t.Spec.EKS.KMSAliasPrefix),
+					},
+				},
+			},
 		}...)
 	}
 

cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_default_roles.yaml

@@ -330,6 +330,15 @@ Resources:
           Effect: Allow
           Resource:
           - '*'
+        - Action:
+          - kms:CreateGrant
+          - kms:DescribeKey
+          Condition:
+            ForAnyValue:StringLike:
+              kms:ResourceAliases: alias/cluster-api-provider-aws-*
+          Effect: Allow
+          Resource:
+          - '*'
         Version: 2012-10-17
       Roles:
       - Ref: AWSIAMRoleControllers

cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_enable.yaml

@@ -330,6 +330,15 @@ Resources:
           Effect: Allow
           Resource:
           - '*'
+        - Action:
+          - kms:CreateGrant
+          - kms:DescribeKey
+          Condition:
+            ForAnyValue:StringLike:
+              kms:ResourceAliases: alias/cluster-api-provider-aws-*
+          Effect: Allow
+          Resource:
+          - '*'
         Version: 2012-10-17
       Roles:
       - Ref: AWSIAMRoleControllers