fix: Remove "autoscaling:UpdateAutoScalingGroup" permission from cluster-autoscaler IRSA
#357
Conversation
| @@ -59,11 +59,8 @@ data "aws_iam_policy_document" "cluster_autoscaler" { | |||
| "autoscaling:DescribeLaunchConfigurations", | |||
| "autoscaling:DescribeScalingActivities", | |||
| "autoscaling:DescribeTags", | |||
| "ec2:DescribeLaunchTemplateVersions", | |||
There was a problem hiding this comment.
we can remove "autoscaling:UpdateAutoScalingGroup" since its not listed in the cluster-autoscaler policy on the project, but the rest of the changes need to be reverted. The statement below has a condition which many of these permissions will fail on
There was a problem hiding this comment.
First thanks you for the quick response. Based on the related documentation it is possible to use it with condition and tags like here: "In this example, only the second block of actions should be updated to restrict the resources/add conditionals:" And also the EC2 instances has the tag from autoscaling group. For "eks:DescribeNodegroup" in the 2nd example is it similar with ARN but not same. Below the example the API use case with "eks:DescribeNodegroup" is described but I could not test so far.
There was a problem hiding this comment.
@bryantbiggs I can adjust the PR, but I wanted to ask if the additional information has it described a little better and impact first feedback?
There was a problem hiding this comment.
I'm sorry but I am not following. from what I can see from the upstream project, we should only be removing autoscaling:UpdateAutoScalingGroup and not modifying anything else in this PR
There was a problem hiding this comment.
@bryantbiggs the PR is update as discussed.
blanchardma
force-pushed
the
fix/cluster-autoscaler-iam-permissions
branch
from
5ae2153 to
2dcf305
Compare
bryantbiggs
changed the title
"autoscaling:UpdateAutoScalingGroup" permission from cluster-autoscaler IRSA
|
This PR has been automatically marked as stale because it has been open 30 days |
blanchardma
force-pushed
the
fix/cluster-autoscaler-iam-permissions
branch
from
61aa65b to
c174907
Compare
blanchardma
force-pushed
the
fix/cluster-autoscaler-iam-permissions
branch
from
c174907 to
91993b8
Compare
### [5.17.1](v5.17.0...v5.17.1) (2023-05-05) ### Bug Fixes * Remove `"autoscaling:UpdateAutoScalingGroup"` permission from cluster-autoscaler IRSA ([#357](#357)) ([aeb5d7f](aeb5d7f))
|
This PR is included in version 5.17.1 🎉 |
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
Description
Remove unnecessary action ("autoscaling:UpdateAutoScalingGroup") from the IAM policy of the Cluster Autoscaler.
Update the order of the IAM actions as in the documentation, so that it is easier for future comparison.
Motivation and Context
Reduces the IAM permissions to the required actions.
Breaking Changes
No.
How Has This Been Tested?
examples/*to demonstrate and validate my change(s)examples/*projectspre-commit run -aon my pull request