Skip to content

Commit ab72dbe

Browse files
wweiwei-liwweiwei-li
committed
Add basic aga controller e2e tests
1 parent 150fe5c commit ab72dbe

17 files changed

+1826
-12
lines changed

‎docs/install/iam_policy_aga.json‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"iam:CreateServiceLinkedRole"
8+
],
9+
"Resource": "*",
10+
"Condition": {
11+
"StringEquals": {
12+
"iam:AWSServiceName": [
13+
"globalaccelerator.amazonaws.com"
14+
]
15+
}
16+
}
17+
},
18+
{
19+
"Effect": "Allow",
20+
"Action": [
21+
"globalaccelerator:DescribeAccelerator",
22+
"globalaccelerator:DescribeEndpointGroup",
23+
"globalaccelerator:DescribeListener",
24+
"globalaccelerator:ListAccelerators",
25+
"globalaccelerator:ListEndpointGroups",
26+
"globalaccelerator:ListListeners",
27+
"globalaccelerator:ListTagsForResource",
28+
"ec2:DescribeRegions"
29+
],
30+
"Resource": "*"
31+
},
32+
{
33+
"Effect": "Allow",
34+
"Action": [
35+
"globalaccelerator:CreateAccelerator"
36+
],
37+
"Resource": "*",
38+
"Condition": {
39+
"Null": {
40+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
41+
},
42+
"StringEquals": {
43+
"aws:RequestTag/aga.k8s.aws/resource": "GlobalAccelerator"
44+
}
45+
}
46+
},
47+
{
48+
"Effect": "Allow",
49+
"Action": [
50+
"globalaccelerator:UpdateAccelerator",
51+
"globalaccelerator:DeleteAccelerator",
52+
"globalaccelerator:CreateListener",
53+
"globalaccelerator:UpdateListener",
54+
"globalaccelerator:DeleteListener",
55+
"globalaccelerator:CreateEndpointGroup",
56+
"globalaccelerator:UpdateEndpointGroup",
57+
"globalaccelerator:DeleteEndpointGroup",
58+
"globalaccelerator:AddEndpoints",
59+
"globalaccelerator:RemoveEndpoints"
60+
],
61+
"Resource": [
62+
"arn:aws:globalaccelerator::*:accelerator/*",
63+
"arn:aws:globalaccelerator::*:accelerator/*/listener/*",
64+
"arn:aws:globalaccelerator::*:accelerator/*/listener/*/endpoint-group/*"
65+
],
66+
"Condition": {
67+
"Null": {
68+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
69+
},
70+
"StringEquals": {
71+
"aws:ResourceTag/aga.k8s.aws/resource": "GlobalAccelerator"
72+
}
73+
}
74+
},
75+
{
76+
"Effect": "Allow",
77+
"Action": [
78+
"globalaccelerator:TagResource",
79+
"globalaccelerator:UntagResource"
80+
],
81+
"Resource": "arn:aws:globalaccelerator::*:accelerator/*",
82+
"Condition": {
83+
"Null": {
84+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
85+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
86+
},
87+
"StringEquals": {
88+
"aws:ResourceTag/aga.k8s.aws/resource": "GlobalAccelerator"
89+
}
90+
}
91+
},
92+
{
93+
"Effect": "Allow",
94+
"Action": [
95+
"globalaccelerator:TagResource"
96+
],
97+
"Resource": "arn:aws:globalaccelerator::*:accelerator/*",
98+
"Condition": {
99+
"Null": {
100+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
101+
},
102+
"StringEquals": {
103+
"aws:RequestTag/aga.k8s.aws/resource": "GlobalAccelerator"
104+
}
105+
}
106+
}
107+
]
108+
}

‎scripts/ci_e2e_test.sh‎

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ CONTROLLER_IAM_POLICY_FILE="$(dirname "${BASH_SOURCE[0]}")/../docs/install/iam_p
2828
CONTROLLER_IAM_POLICY_NAME="lb-controller-e2e-${PULL_NUMBER}-$BUILD_ID"
2929
CONTROLLER_IAM_POLICY_ARN="" # will be fulfilled during setup_controller_iam_sa
3030

31+
# Global Accelerator IAM policy settings
32+
CONTROLLER_AGA_IAM_POLICY_FILE="$(dirname "${BASH_SOURCE[0]}")/../docs/install/iam_policy_aga.json"
33+
CONTROLLER_AGA_IAM_POLICY_NAME="lb-controller-aga-e2e-${PULL_NUMBER}-$BUILD_ID"
34+
CONTROLLER_AGA_IAM_POLICY_ARN="" # will be fulfilled during setup_controller_aga_iam
35+
3136
# Cluster settings
3237
EKSCTL_VERSION="v0.210.0"
3338
CLUSTER_NAME="lb-controller-e2e-${PULL_NUMBER}-$BUILD_ID"
@@ -160,16 +165,63 @@ setup_controller_iam_sa() {
160165
return 0
161166
}
162167

168+
#######################################
169+
# Setup Global Accelerator IAM policy for AWS Load Balancer Controller
170+
#
171+
# Globals:
172+
# AWS_REGION
173+
# CLUSTER_NAME
174+
# CONTROLLER_SA_NAMESPACE
175+
# CONTROLLER_SA_NAME
176+
# CONTROLLER_AGA_IAM_POLICY_NAME
177+
# CONTROLLER_AGA_IAM_POLICY_FILE
178+
# CONTROLLER_AGA_IAM_POLICY_ARN
179+
# Arguments:
180+
# None
181+
#######################################
182+
setup_controller_aga_iam() {
183+
if [[ -z "${CONTROLLER_AGA_IAM_POLICY_ARN}" ]]; then
184+
echo "creating Global Accelerator IAM policy for controller"
185+
186+
CONTROLLER_AGA_IAM_POLICY_ARN=$(iam::create_policy "${CONTROLLER_AGA_IAM_POLICY_NAME}" "${CONTROLLER_AGA_IAM_POLICY_FILE}" "${AWS_REGION}")
187+
if [[ $? -ne 0 ]]; then
188+
echo "unable to create Global Accelerator IAM policy for controller" >&2
189+
return 1
190+
fi
191+
192+
echo "created Global Accelerator IAM policy for controller: ${CONTROLLER_AGA_IAM_POLICY_ARN}"
193+
fi
194+
195+
if ! eksctl::attach_policy_to_iamserviceaccount "${CLUSTER_NAME}" "${AWS_REGION}" "${CONTROLLER_SA_NAMESPACE}" "${CONTROLLER_SA_NAME}" "${CONTROLLER_AGA_IAM_POLICY_ARN}"; then
196+
echo "unable to attach Global Accelerator IAM policy to service account" >&2
197+
return 1
198+
fi
199+
200+
return 0
201+
}
202+
163203
#######################################
164204
# Cleanup IAM role and Service Account for AWS Load Balancer Controller
165205
#
166206
# Globals:
167207
# AWS_REGION
168208
# CONTROLLER_IAM_POLICY_ARN
209+
# CONTROLLER_AGA_IAM_POLICY_ARN
169210
# Arguments:
170211
# None
171212
#######################################
172213
cleanup_controller_iam_sa() {
214+
if [[ -n "${CONTROLLER_AGA_IAM_POLICY_ARN}" ]]; then
215+
echo "deleting Global Accelerator IAM policy for controller"
216+
217+
if ! iam::delete_policy "${CONTROLLER_AGA_IAM_POLICY_ARN}" "${AWS_REGION}"; then
218+
echo "unable to delete Global Accelerator IAM policy for controller" >&2
219+
return 1
220+
fi
221+
222+
echo "deleted Global Accelerator IAM policy for controller: ${CONTROLLER_AGA_IAM_POLICY_ARN}"
223+
fi
224+
173225
if [[ -n "${CONTROLLER_IAM_POLICY_ARN}" ]]; then
174226
echo "deleting IAM policy for controller"
175227

@@ -212,7 +264,7 @@ test_controller_image() {
212264
CERTIFICATE_ARNS=${CERTIFICATE_ARNS:-"${CERTIFICATE_ARN_PREFIX}/${CERT_ID1},${CERTIFICATE_ARN_PREFIX}/${CERT_ID2},${CERTIFICATE_ARN_PREFIX}/${CERT_ID3}"}
213265
echo "creating s3 bucket $S3_BUCKET"
214266
aws s3api create-bucket --bucket $S3_BUCKET --region $AWS_REGION --create-bucket-configuration LocationConstraint=$AWS_REGION || true
215-
ginkgo -timeout 3h -v -r test/e2e -- \
267+
ginkgo -timeout 3h -v test/e2e/globalaccelerator -- \
216268
--kubeconfig=${CLUSTER_KUBECONFIG} \
217269
--cluster-name=${CLUSTER_NAME} \
218270
--aws-region=${AWS_REGION} \
@@ -266,6 +318,7 @@ main() {
266318
trap "cleanup" EXIT
267319
setup_cluster
268320
setup_controller_iam_sa
321+
setup_controller_aga_iam
269322
test_controller_image
270323
}
271324

‎scripts/lib/eksctl.sh‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,3 +189,43 @@ eksctl::create_iamserviceaccount() {
189189
echo "created cluster SA ${sa_namespace}/${sa_name}"
190190
return 0
191191
}
192+
193+
#######################################
194+
# Attach IAM policy to existing Service Account
195+
#
196+
# Globals:
197+
# None
198+
# Arguments:
199+
# cluster_name EKS cluster's name
200+
# region aws region
201+
# sa_namespace namespace of service account
202+
# sa_name name of service account
203+
# iam_policy_arn arn of iam policy to attach
204+
#
205+
# sample: eksctl::attach_policy_to_iamserviceaccount awesome-cluster us-west-2 awesome-ns awesome-name arn:aws:iam::xxxxx:policy/xxxxxx
206+
#######################################
207+
eksctl::attach_policy_to_iamserviceaccount() {
208+
declare -r cluster_name="$1" region="$2" sa_namespace="$3" sa_name="$4" iam_policy_arn="$5"
209+
210+
echo "attaching policy to cluster SA ${sa_namespace}/${sa_name}"
211+
212+
# Get the IAM role ARN associated with the service account
213+
local role_arn
214+
role_arn=$(kubectl get sa "${sa_name}" -n "${sa_namespace}" -o jsonpath='{.metadata.annotations.eks\.amazonaws\.com/role-arn}')
215+
if [[ -z "${role_arn}" ]]; then
216+
echo "unable to get IAM role ARN for service account ${sa_namespace}/${sa_name}" >&2
217+
return 1
218+
fi
219+
220+
local role_name
221+
role_name=$(echo "${role_arn}" | awk -F'/' '{print $NF}')
222+
223+
echo "attaching policy ${iam_policy_arn} to role ${role_name}"
224+
if ! aws iam attach-role-policy --region "${region}" --role-name "${role_name}" --policy-arn "${iam_policy_arn}"; then
225+
echo "unable to attach policy to role ${role_name}" >&2
226+
return 1
227+
fi
228+
229+
echo "attached policy to cluster SA ${sa_namespace}/${sa_name}"
230+
return 0
231+
}

0 commit comments

Comments
 (0)