util

func AddOrUpdateBucketPermissions ¶

func AddOrUpdateBucketPermissions(ctx context.Context, cfg aws.Config, permissionName string, s3Actions []string, s3ResourcePrefix string, kmsActions []string, bucketName, bucketRegion, bucketEndpoint string, allowedPrincipals []string) error

AddOrUpdateBucketPermissions AWS s3 utiltity functions to update S3 bucket policy statement with a statement block without impacting other statements this helps in adding tenant specific permission to a management plane bucket Important !!! Pass a unique permissionName to ensure that a specific permission will not impact any other existing permission permissionName should be compliant with AWS StatementId (Sid) field without special characters or spaces

example kmsActions for general s3 Get and Put include following

"kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey"

Example s3Actions for read include following ¶

s3:GetObject* s3:ListBucket

Example s3ResourcePrefix can be * to allow all resources in bucket or can be a tenant specific prefix (e.g. using unique infra id) to restrict access

func AddOrUpdateCrossAccountSecretReadPermissions ¶

func AddOrUpdateCrossAccountSecretReadPermissions(ctx context.Context, cfg aws.Config, secretName string, permissionName, allowedPrincipals []string) error

add or update a secret permissions for list of cross account principals Important !!! pass a unique permissionName to avoid updates to other kms key policy (e.g. add a tenant id in the permissionName) note this function updates both secret permissions as well as associated kms key arn permissions Also, note that it will fully update/overwrite the secret resource permissions for cross account access using the list of allowedPrincipals with read access The kms key associated with the secret is updated such that it retains any other permissions present in the key policy, i.e. kms key could be a shared key

func ApplyManifests ¶

func ApplyManifests(ctx context.Context, kubeClient *RetryableClient, manifestYamlsCombined string) (d diag.Diagnostics)

func DescribeKubeCluster ¶

func DescribeKubeCluster(ctx context.Context, dp awsconfig.AWSDataplane, cfg aws.Config) (cluster *types.Cluster, err error)

func GetARNForCPService ¶

func GetARNForCPService(ctx context.Context, cfg aws.Config, cc awsconfig.ClusterConfiguration, service string) string

func GetARNForService ¶

func GetARNForService(ctx context.Context, cfg aws.Config, cc awsconfig.ClusterConfiguration, service string) string

func GetAwsConfig ¶

func GetAwsConfig(ctx context.Context, dp awsconfig.AWSDataplane) (cfg aws.Config, d diag.Diagnostics)

func GetKubeClientSets ¶ added in v1.6.2

func GetKubeClientSets(ctx context.Context, cfg aws.Config, dp awsconfig.AWSDataplane) (clientSet *kubernetes.Clientset, err error)

func GetKubeClusterName ¶

func GetKubeClusterName(ctx context.Context, dp awsconfig.AWSDataplane) (name string, err error)

func GetKubeConfig ¶

func GetKubeConfig(ctx context.Context, dp awsconfig.AWSDataplane, cfg aws.Config) (kubeConfig []byte, err error)

func LogError ¶

func LogError(ctx context.Context, d diag.Diagnostics, summary string, err error) diag.Diagnostics

func RemoveBucketPermissions ¶

func RemoveBucketPermissions(ctx context.Context, cfg aws.Config, permissionName, bucketName, bucketRegion, bucketEndpoint string, removePrincipals []string) error

func RemoveKmsKeyPermission ¶

func RemoveKmsKeyPermission(ctx context.Context, cfg aws.Config, permissionName, kmsKeyArn string, removePrincipals []string) error

func RenderAndApplyTemplate ¶

func RenderAndApplyTemplate(ctx context.Context, kubeClient *RetryableClient, name string, templateData []byte, data map[string]string) (d diag.Diagnostics)

func ResetKubeClientCache ¶ added in v1.7.2

func ResetKubeClientCache()

ResetKubeClientCache resets the kube client cache to force creation of new clients with fresh tokens

func UpdateCrossAccountEcrReadPermissions ¶

func UpdateCrossAccountEcrReadPermissions(ctx context.Context, cfg aws.Config, repositoryName, permissionName string, ecrActions []string, kmsKeyArn string, allowedPrincipals []string) error

func UpdateEmptyOIDCRoleTrustPolicy ¶

func UpdateEmptyOIDCRoleTrustPolicy(ctx context.Context, cfg aws.Config, issuerID, roleName string) error

Update EMPTYOIDC IRSA role cluster issuer ids: When we bootstrap a dataplane within account/iamroles we do not have EKS OIDC available (as eks is not yet provisioned). as a workaround if eks is not available when applying account role (i.e. first time) the terraform set assume role policy document to EMPTYOIDC. The account layer can be re-applied after applying eks layer to udpate IRSA OIDC, but to avoid re-apply step, we can also scan for IRSA specific roles to see if EMPTYOIDC is present in policy and update these to the EKS OIDC the update is done only if EMPTYOIDC is detected and needs a replacement

func UpdateKmsKeyPermission ¶

func UpdateKmsKeyPermission(ctx context.Context, cfg aws.Config, permissionName string, kmsActions []string, kmsKeyArn string, allowedPrincipals []string) error