Skip to content

Commit f885d92

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5526 from alexander-demicev/iamv2
🌱 Migrate iam to aws sdk v2
2 parents 427f450 + 1bdefb1 commit f885d92

28 files changed

+348
-9213
lines changed

‎controlplane/eks/controllers/awsmanagedcontrolplane_controller_test.go‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,12 @@ import (
2828
"github.com/aws/aws-sdk-go-v2/aws"
2929
"github.com/aws/aws-sdk-go-v2/service/eks"
3030
ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
31-
"github.com/aws/aws-sdk-go/aws/awserr"
31+
"github.com/aws/aws-sdk-go-v2/service/iam"
32+
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
3233
stsrequest "github.com/aws/aws-sdk-go/aws/request"
3334
"github.com/aws/aws-sdk-go/service/ec2"
34-
"github.com/aws/aws-sdk-go/service/iam"
3535
"github.com/aws/aws-sdk-go/service/sts"
36+
"github.com/aws/smithy-go"
3637
"github.com/golang/mock/gomock"
3738
. "github.com/onsi/gomega"
3839
corev1 "k8s.io/api/core/v1"
@@ -797,37 +798,37 @@ func mockedDescribeInstanceCall(ec2Rec *mocks.MockEC2APIMockRecorder) {
797798
}
798799

799800
func mockedEKSControlPlaneIAMRole(g *WithT, iamRec *mock_iamauth.MockIAMAPIMockRecorder) {
800-
getRoleCall := iamRec.GetRole(&iam.GetRoleInput{
801+
getRoleCall := iamRec.GetRole(gomock.Any(), &iam.GetRoleInput{
801802
RoleName: aws.String("test-cluster-iam-service-role"),
802-
}).Return(nil, awserr.New(iam.ErrCodeNoSuchEntityException, "", nil))
803+
}).Return(nil, &smithy.GenericAPIError{Code: "NoSuchEntity", Message: ""})
803804

804-
createRoleCall := iamRec.CreateRole(gomock.Any()).After(getRoleCall).DoAndReturn(func(input *iam.CreateRoleInput) (*iam.CreateRoleOutput, error) {
805+
createRoleCall := iamRec.CreateRole(gomock.Any(), gomock.Any()).After(getRoleCall).DoAndReturn(func(ctx context.Context, input *iam.CreateRoleInput, optFns ...func(*iam.Options)) (*iam.CreateRoleOutput, error) {
805806
g.Expect(input.RoleName).To(BeComparableTo(aws.String("test-cluster-iam-service-role")))
806807
return &iam.CreateRoleOutput{
807-
Role: &iam.Role{
808+
Role: &iamtypes.Role{
808809
RoleName: aws.String("test-cluster-iam-service-role"),
809810
Arn: aws.String("arn:aws:iam::123456789012:role/test-cluster-iam-service-role"),
810811
Tags: input.Tags,
811812
},
812813
}, nil
813814
})
814815

815-
iamRec.ListAttachedRolePolicies(&iam.ListAttachedRolePoliciesInput{
816+
iamRec.ListAttachedRolePolicies(gomock.Any(), &iam.ListAttachedRolePoliciesInput{
816817
RoleName: aws.String("test-cluster-iam-service-role"),
817818
}).After(createRoleCall).Return(&iam.ListAttachedRolePoliciesOutput{
818-
AttachedPolicies: []*iam.AttachedPolicy{},
819+
AttachedPolicies: []iamtypes.AttachedPolicy{},
819820
}, nil)
820821

821-
getPolicyCall := iamRec.GetPolicy(&iam.GetPolicyInput{
822+
getPolicyCall := iamRec.GetPolicy(gomock.Any(), &iam.GetPolicyInput{
822823
PolicyArn: aws.String("arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"),
823824
}).Return(&iam.GetPolicyOutput{
824825
// This policy is predefined by AWS
825-
Policy: &iam.Policy{
826+
Policy: &iamtypes.Policy{
826827
// Fields are not used. Our code only checks for existence of the policy.
827828
},
828829
}, nil)
829830

830-
iamRec.AttachRolePolicy(&iam.AttachRolePolicyInput{
831+
iamRec.AttachRolePolicy(gomock.Any(), &iam.AttachRolePolicyInput{
831832
PolicyArn: aws.String("arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"),
832833
RoleName: aws.String("test-cluster-iam-service-role"),
833834
}).After(getPolicyCall).Return(&iam.AttachRolePolicyOutput{}, nil)
@@ -840,10 +841,10 @@ func mockedEKSCluster(ctx context.Context, g *WithT, eksRec *mock_eksiface.MockE
840841
Message: aws.String("cluster not found"),
841842
})
842843

843-
getRoleCall := iamRec.GetRole(&iam.GetRoleInput{
844+
getRoleCall := iamRec.GetRole(gomock.Any(), &iam.GetRoleInput{
844845
RoleName: aws.String("test-cluster-iam-service-role"),
845846
}).After(describeClusterCall).Return(&iam.GetRoleOutput{
846-
Role: &iam.Role{
847+
Role: &iamtypes.Role{
847848
RoleName: aws.String("test-cluster-iam-service-role"),
848849
Arn: aws.String("arn:aws:iam::123456789012:role/test-cluster-iam-service-role"),
849850
},

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ require (
4040
github.com/spf13/pflag v1.0.6
4141
github.com/zgalor/weberr v0.8.2
4242
golang.org/x/crypto v0.36.0
43+
golang.org/x/net v0.38.0
4344
golang.org/x/text v0.23.0
4445
gopkg.in/yaml.v2 v2.4.0
4546
k8s.io/api v0.32.3
@@ -210,7 +211,6 @@ require (
210211
go.uber.org/multierr v1.11.0 // indirect
211212
go.uber.org/zap v1.27.0 // indirect
212213
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
213-
golang.org/x/net v0.38.0 // indirect
214214
golang.org/x/oauth2 v0.28.0 // indirect
215215
golang.org/x/sync v0.12.0 // indirect
216216
golang.org/x/sys v0.31.0 // indirect

‎pkg/cloud/converters/tags.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ import (
2121
"strings"
2222

2323
autoscalingtypes "github.com/aws/aws-sdk-go-v2/service/autoscaling/types"
24+
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
2425
"github.com/aws/aws-sdk-go/aws"
2526
"github.com/aws/aws-sdk-go/service/ec2"
2627
"github.com/aws/aws-sdk-go/service/elb"
2728
"github.com/aws/aws-sdk-go/service/elbv2"
28-
"github.com/aws/aws-sdk-go/service/iam"
2929
"github.com/aws/aws-sdk-go/service/secretsmanager"
3030
"github.com/aws/aws-sdk-go/service/ssm"
3131

@@ -174,11 +174,11 @@ func MapToSSMTags(src infrav1.Tags) []*ssm.Tag {
174174
}
175175

176176
// MapToIAMTags converts a infrav1.Tags to a []*iam.Tag.
177-
func MapToIAMTags(src infrav1.Tags) []*iam.Tag {
178-
tags := make([]*iam.Tag, 0, len(src))
177+
func MapToIAMTags(src infrav1.Tags) []iamtypes.Tag {
178+
tags := make([]iamtypes.Tag, 0, len(src))
179179

180180
for k, v := range src {
181-
tag := &iam.Tag{
181+
tag := iamtypes.Tag{
182182
Key: aws.String(k),
183183
Value: aws.String(v),
184184
}

‎pkg/cloud/scope/clients.go‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package scope
1919
import (
2020
"github.com/aws/aws-sdk-go-v2/service/autoscaling"
2121
"github.com/aws/aws-sdk-go-v2/service/eks"
22+
"github.com/aws/aws-sdk-go-v2/service/iam"
2223
"github.com/aws/aws-sdk-go-v2/service/s3"
2324
"github.com/aws/aws-sdk-go/aws"
2425
"github.com/aws/aws-sdk-go/aws/awserr"
@@ -31,8 +32,6 @@ import (
3132
"github.com/aws/aws-sdk-go/service/elbv2/elbv2iface"
3233
"github.com/aws/aws-sdk-go/service/eventbridge"
3334
"github.com/aws/aws-sdk-go/service/eventbridge/eventbridgeiface"
34-
"github.com/aws/aws-sdk-go/service/iam"
35-
"github.com/aws/aws-sdk-go/service/iam/iamiface"
3635
"github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
3736
"github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi/resourcegroupstaggingapiiface"
3837
"github.com/aws/aws-sdk-go/service/secretsmanager"
@@ -185,13 +184,21 @@ func NewEKSClient(scopeUser cloud.ScopeUsage, session cloud.Session, logger logg
185184
}
186185

187186
// NewIAMClient creates a new IAM API client for a given session.
188-
func NewIAMClient(scopeUser cloud.ScopeUsage, session cloud.Session, logger logger.Wrapper, target runtime.Object) iamiface.IAMAPI {
189-
iamClient := iam.New(session.Session(), aws.NewConfig().WithLogLevel(awslogs.GetAWSLogLevel(logger.GetLogger())).WithLogger(awslogs.NewWrapLogr(logger.GetLogger())))
190-
iamClient.Handlers.Build.PushFrontNamed(getUserAgentHandler())
191-
iamClient.Handlers.CompleteAttempt.PushFront(awsmetrics.CaptureRequestMetrics(scopeUser.ControllerName()))
192-
iamClient.Handlers.Complete.PushBack(recordAWSPermissionsIssue(target))
187+
func NewIAMClient(scopeUser cloud.ScopeUsage, session cloud.Session, logger logger.Wrapper, target runtime.Object) *iam.Client {
188+
cfg := session.SessionV2()
189+
190+
iamOpts := []func(*iam.Options){
191+
func(o *iam.Options) {
192+
o.Logger = logger.GetAWSLogger()
193+
o.ClientLogMode = awslogs.GetAWSLogLevelV2(logger.GetLogger())
194+
},
195+
iam.WithAPIOptions(
196+
awsmetricsv2.WithMiddlewares(scopeUser.ControllerName(), target),
197+
awsmetricsv2.WithCAPAUserAgentMiddleware(),
198+
),
199+
}
193200

194-
return iamClient
201+
return iam.NewFromConfig(cfg, iamOpts...)
195202
}
196203

197204
// NewSTSClient creates a new STS API client for a given session.

‎pkg/cloud/services/eks/cluster.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -445,7 +445,7 @@ func (s *Service) createCluster(ctx context.Context, eksClusterName string) (*ek
445445
tags[k] = tagValue
446446
}
447447

448-
role, err := s.GetIAMRole(*s.scope.ControlPlane.Spec.RoleName)
448+
role, err := s.GetIAMRole(ctx, *s.scope.ControlPlane.Spec.RoleName)
449449
if err != nil {
450450
return nil, errors.Wrapf(err, "error getting control plane iam role: %s", *s.scope.ControlPlane.Spec.RoleName)
451451
}

‎pkg/cloud/services/eks/cluster_test.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ import (
2323
"github.com/aws/aws-sdk-go-v2/aws"
2424
"github.com/aws/aws-sdk-go-v2/service/eks"
2525
ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
26-
"github.com/aws/aws-sdk-go/service/iam"
26+
"github.com/aws/aws-sdk-go-v2/service/iam"
27+
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
2728
"github.com/golang/mock/gomock"
2829
. "github.com/onsi/gomega"
2930
"github.com/pkg/errors"
@@ -544,8 +545,8 @@ func TestCreateCluster(t *testing.T) {
544545
}
545546

546547
if !tc.expectError {
547-
roleOutput := iam.GetRoleOutput{Role: &iam.Role{Arn: tc.role}}
548-
iamMock.EXPECT().GetRole(gomock.Any()).Return(&roleOutput, nil)
548+
roleOutput := iam.GetRoleOutput{Role: &iamtypes.Role{Arn: tc.role}}
549+
iamMock.EXPECT().GetRole(gomock.Any(), gomock.Any()).Return(&roleOutput, nil)
549550
eksMock.EXPECT().CreateCluster(context.TODO(), &eks.CreateClusterInput{
550551
Name: aws.String(clusterName),
551552
EncryptionConfig: []ekstypes.EncryptionConfig{},
@@ -771,11 +772,11 @@ func TestCreateIPv6Cluster(t *testing.T) {
771772
},
772773
BootstrapSelfManagedAddons: aws.Bool(false),
773774
}).Return(&eks.CreateClusterOutput{}, nil)
774-
iamMock.EXPECT().GetRole(&iam.GetRoleInput{
775+
iamMock.EXPECT().GetRole(gomock.Any(), &iam.GetRoleInput{
775776
RoleName: aws.String("arn-role"),
776777
}).Return(&iam.GetRoleOutput{
777-
Role: &iam.Role{
778-
RoleName: ptr.To[string]("arn-role"),
778+
Role: &iamtypes.Role{
779+
RoleName: aws.String("arn-role"),
779780
},
780781
}, nil)
781782

‎pkg/cloud/services/eks/eks.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ func (s *Service) ReconcileControlPlane(ctx context.Context) error {
3636
s.scope.Debug("Reconciling EKS control plane", "cluster", klog.KRef(s.scope.Cluster.Namespace, s.scope.Cluster.Name))
3737

3838
// Control Plane IAM Role
39-
if err := s.reconcileControlPlaneIAMRole(); err != nil {
39+
if err := s.reconcileControlPlaneIAMRole(ctx); err != nil {
4040
conditions.MarkFalse(s.scope.ControlPlane, ekscontrolplanev1.IAMControlPlaneRolesReadyCondition, ekscontrolplanev1.IAMControlPlaneRolesReconciliationFailedReason, clusterv1.ConditionSeverityError, "%s", err.Error())
4141
return err
4242
}
@@ -77,12 +77,12 @@ func (s *Service) DeleteControlPlane(ctx context.Context) (err error) {
7777
}
7878

7979
// Control Plane IAM role
80-
if err := s.deleteControlPlaneIAMRole(); err != nil {
80+
if err := s.deleteControlPlaneIAMRole(ctx); err != nil {
8181
return err
8282
}
8383

8484
// OIDC Provider
85-
if err := s.deleteOIDCProvider(); err != nil {
85+
if err := s.deleteOIDCProvider(ctx); err != nil {
8686
return err
8787
}
8888

@@ -94,7 +94,7 @@ func (s *Service) DeleteControlPlane(ctx context.Context) (err error) {
9494
func (s *NodegroupService) ReconcilePool(ctx context.Context) error {
9595
s.scope.Debug("Reconciling EKS nodegroup")
9696

97-
if err := s.reconcileNodegroupIAMRole(); err != nil {
97+
if err := s.reconcileNodegroupIAMRole(ctx); err != nil {
9898
conditions.MarkFalse(
9999
s.scope.ManagedMachinePool,
100100
expinfrav1.IAMNodegroupRolesReadyCondition,
@@ -146,7 +146,7 @@ func (s *NodegroupService) ReconcilePoolDelete(ctx context.Context) error {
146146
return errors.Wrap(err, "failed to delete nodegroup")
147147
}
148148

149-
if err := s.deleteNodegroupIAMRole(); err != nil {
149+
if err := s.deleteNodegroupIAMRole(ctx); err != nil {
150150
return errors.Wrap(err, "failed to delete nodegroup IAM role")
151151
}
152152

‎pkg/cloud/services/eks/fargate.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ import (
2424
"github.com/aws/aws-sdk-go-v2/aws"
2525
"github.com/aws/aws-sdk-go-v2/service/eks"
2626
ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
27-
"github.com/aws/aws-sdk-go/service/iam"
27+
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
2828
"github.com/pkg/errors"
2929
"sigs.k8s.io/controller-runtime/pkg/reconcile"
3030

@@ -48,7 +48,7 @@ func requeueRoleUpdating() reconcile.Result {
4848
func (s *FargateService) Reconcile(ctx context.Context) (reconcile.Result, error) {
4949
s.scope.Debug("Reconciling EKS fargate profile")
5050

51-
requeue, err := s.reconcileFargateIAMRole()
51+
requeue, err := s.reconcileFargateIAMRole(ctx)
5252
if err != nil {
5353
conditions.MarkFalse(
5454
s.scope.FargateProfile,
@@ -182,7 +182,7 @@ func (s *FargateService) ReconcileDelete(ctx context.Context) (reconcile.Result,
182182
return requeueProfileUpdating(), nil
183183
}
184184

185-
err = s.deleteFargateIAMRole()
185+
err = s.deleteFargateIAMRole(ctx)
186186
if err != nil {
187187
conditions.MarkFalse(
188188
s.scope.FargateProfile,
@@ -223,7 +223,7 @@ func (s *FargateService) createFargateProfile(ctx context.Context) (*ekstypes.Fa
223223

224224
additionalTags := s.scope.AdditionalTags()
225225

226-
roleArn, err := s.roleArn()
226+
roleArn, err := s.roleArn(ctx)
227227
if err != nil {
228228
return nil, err
229229
}
@@ -302,11 +302,11 @@ func (s *FargateService) deleteFargateProfile(ctx context.Context) (requeue bool
302302
return s.handleStatus(profile), nil
303303
}
304304

305-
func (s *FargateService) roleArn() (*string, error) {
306-
var role *iam.Role
305+
func (s *FargateService) roleArn(ctx context.Context) (*string, error) {
306+
var role *iamtypes.Role
307307
if s.scope.RoleName() != "" {
308308
var err error
309-
role, err = s.GetIAMRole(s.scope.RoleName())
309+
role, err = s.GetIAMRole(ctx, s.scope.RoleName())
310310
if err != nil {
311311
return nil, errors.Wrapf(err, "error getting fargate profile IAM role: %s", s.scope.RoleName())
312312
}

0 commit comments

Comments
 (0)