Skip to content

Adding New IAM Policy for Cluster Autoscaler #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

olamide005
Copy link
Contributor

@olamide005 olamide005 commented Mar 6, 2023

The Autoscaler's version was updated to the penultimate chart here:
#407

The worker running the cluster autoscaler needs access to certain resources and actions for new versions and its configuration as suggested here: https://github.com/kubernetes/autoscaler/tree/master/charts/cluster-autoscaler#additional-configuration

The up-to-date IAM permissions required, is gotten from the cluster autoscaler's AWS Cloudprovider Readme (selecting the tag of the cluster autoscaler image in use): https://github.com/kubernetes/autoscaler/blob/cluster-autoscaler-chart-9.24.0/cluster-autoscaler/cloudprovider/aws/README.md

Terragrunt Apply

Terraform will perform the following actions:

  # aws_iam_policy.cluster_autoscaler will be updated in-place
  ~ resource "aws_iam_policy" "cluster_autoscaler" {
        id          = "arn:aws:iam::***:policy/cluster-autoscaler-ops20230106164844398400000001"
        name        = "cluster-autoscaler-ops20230106164844398400000001"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                            "ec2:DescribeLaunchTemplateVersions",
                          + "ec2:DescribeInstanceTypes",
                            "autoscaling:DescribeTags",
                          + "autoscaling:DescribeScalingActivities",
                            "autoscaling:DescribeLaunchConfigurations",
                            # (2 unchanged elements hidden)
                        ]
                        # (3 unchanged elements hidden)
                    },
                  ~ {
                      ~ Action    = [
                          + "eks:DescribeNodegroup",
                          + "ec2:GetInstanceTypesFromInstanceRequirements",
                          + "ec2:DescribeImages",
                            "autoscaling:UpdateAutoScalingGroup",
                            # (2 unchanged elements hidden)
                        ]
                        # (4 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        tags        = {}
        # (6 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
aws_iam_policy.cluster_autoscaler: Modifying... [id=arn:aws:iam::***:policy/cluster-autoscaler-ops2023010[61](https://github.com/exact-payments/gruntwork-infrastructure-live/actions/runs/4407376954/jobs/7720963363?pr=1524#step:16:62)[64](https://github.com/exact-payments/gruntwork-infrastructure-live/actions/runs/4407376954/jobs/7720963363?pr=1524#step:16:65)[84](https://github.com/exact-payments/gruntwork-infrastructure-live/actions/runs/4407376954/jobs/7720963363?pr=1524#step:16:85)4398400000001]
aws_iam_policy.cluster_autoscaler: Modifications complete after 0s [id=arn:aws:iam::***:policy/cluster-autoscaler-ops20230106164844398400000001]
Releasing state lock. This may take a few moments...

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant