Skip to content

Commit e22a0d0

Browse files
naclontsnaclonts
authored
Fix get iamserviceaccount returning error for unrelated CloudFormation Stack (#8350)
1 parent a710a1b commit e22a0d0

File tree

12 files changed

+478
-184
lines changed

12 files changed

+478
-184
lines changed

‎go.mod‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,17 @@ require (
1313
github.com/aws/aws-sdk-go-v2/credentials v1.17.65
1414
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.3
1515
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.2
16-
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.3
16+
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.4
1717
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.3
1818
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.51.3
1919
github.com/aws/aws-sdk-go-v2/service/ec2 v1.210.1
2020
github.com/aws/aws-sdk-go-v2/service/eks v1.64.0
21-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.2
22-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.1
21+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.3
22+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.2
2323
github.com/aws/aws-sdk-go-v2/service/iam v1.41.1
2424
github.com/aws/aws-sdk-go-v2/service/kms v1.38.1
2525
github.com/aws/aws-sdk-go-v2/service/outposts v1.50.1
26-
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.1
26+
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.2
2727
github.com/aws/aws-sdk-go-v2/service/sts v1.33.17
2828
github.com/aws/smithy-go v1.22.3
2929
github.com/awslabs/amazon-eks-ami/nodeadm v0.0.0-20250219002025-c3b5cd3d2fd9

‎go.sum‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,8 @@ github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.3 h1:QsKdBxtC8csnKt5BbV7D
128128
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.3/go.mod h1:CDqMoc3KRdZJ8qziW96J35lKH01Wq3B2aihtHj2JbRs=
129129
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.2 h1:o9cuZdZlI9VWMqsNa2mnf2IRsFAROHnaYA1BW3lHGuY=
130130
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.2/go.mod h1:penaZKzGmqHGZId4EUCBIW/f9l4Y7hQ5NKd45yoCYuI=
131-
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.3 h1:nTKHvvDTsS6SqAqu/fDhpmbNmDz+0ONh8niPoCkhPtM=
132-
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.3/go.mod h1:/BibEr5ksr34abqBTQN213GrNG6GCKCB6WG7CH4zH2w=
131+
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.4 h1:pQpinmWv9jEisDR6/DccOf2cXdAf/CAwQ39nfJfJDlE=
132+
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.4/go.mod h1:/BibEr5ksr34abqBTQN213GrNG6GCKCB6WG7CH4zH2w=
133133
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.3 h1:3y0jkGtsaZLCg+n73BoSXOAkLFtgmD/+4prXW1pzovc=
134134
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.3/go.mod h1:uo14VBn5cNk/BPGTPz3kyLBxgpgOObgO8lmz+H7Z4Ck=
135135
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.51.3 h1:4U9dpQZTvJ0Mi1qn8L1hRJ4igFCQYEjwUuOmYkWM5tE=
@@ -138,10 +138,10 @@ github.com/aws/aws-sdk-go-v2/service/ec2 v1.210.1 h1:+4A9SDduLZFlDeXWRmfQ6r8kyEJ
138138
github.com/aws/aws-sdk-go-v2/service/ec2 v1.210.1/go.mod h1:ouvGEfHbLaIlWwpDpOVWPWR+YwO0HDv3vm5tYLq8ImY=
139139
github.com/aws/aws-sdk-go-v2/service/eks v1.64.0 h1:EYeOThTRysemFtC6J6h6b7dNg3jN03QuO5cg92ojIQE=
140140
github.com/aws/aws-sdk-go-v2/service/eks v1.64.0/go.mod h1:v1xXy6ea0PHtWkjFUvAUh6B/5wv7UF909Nru0dOIJDk=
141-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.2 h1:Zlfmpg4QsduBeiK0vTc8WjnHZoYVGe64FcwuCsipjWE=
142-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.2/go.mod h1:H232HdqVlSUoqy0cMJYW1TKjcxvGFGFZ20xQG8fOAPw=
143-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.1 h1:USXR7nfl+bu7HnR/M3KtnPD3wjlCXM72kYX+2PaIgEI=
144-
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.1/go.mod h1:xnCC3vFBfOKpU6PcsCKL2ktgBTZfOwTGxj6V8/X3IS4=
141+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.3 h1:DpyV8LeDf0y7iDaGZ3h1Y+Nh5IaBOR+xj44vVgEEegY=
142+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.3/go.mod h1:H232HdqVlSUoqy0cMJYW1TKjcxvGFGFZ20xQG8fOAPw=
143+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.2 h1:vX70Z4lNSr7XsioU0uJq5yvxgI50sB66MvD+V/3buS4=
144+
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.2/go.mod h1:xnCC3vFBfOKpU6PcsCKL2ktgBTZfOwTGxj6V8/X3IS4=
145145
github.com/aws/aws-sdk-go-v2/service/eventbridge v1.36.12 h1:uH6GOnGSvVN9MCk6o3+HvZFpdqL7AzJKNOTM/6l+3/s=
146146
github.com/aws/aws-sdk-go-v2/service/eventbridge v1.36.12/go.mod h1:6qtp53AQg7KEeYrsp430PNlmVVO9qK0Xw8nddE1y+ow=
147147
github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 h1:Kq3R+K49y23CGC5UQF3Vpw5oZEQk5gF/nn+MekPD0ZY=
@@ -166,8 +166,8 @@ github.com/aws/aws-sdk-go-v2/service/s3 v1.77.1 h1:5bI9tJL2Z0FGFtp/LPDv0eyliFBHC
166166
github.com/aws/aws-sdk-go-v2/service/s3 v1.77.1/go.mod h1:njj3tSJONkfdLt4y6X8pyqeM6sJLNZxmzctKKV+n1GM=
167167
github.com/aws/aws-sdk-go-v2/service/sqs v1.37.15 h1:KRXf9/NWjoRgj2WJbX13GNjBPQ1SxUYLnIfXTz08mWs=
168168
github.com/aws/aws-sdk-go-v2/service/sqs v1.37.15/go.mod h1:1CY54O4jz8BzgH2d6KyrzKWr2bAoqKsqUv2YZUGwMLE=
169-
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.1 h1:GLyAQEth2SljkC2DP5iK2GMkzgrGvURD+NEBVgQer3I=
170-
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.1/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
169+
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.2 h1:uXy3QGAw3xv0RS+OlbeMEAnOA3vFFsf7yvjUswV6N/k=
170+
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.2/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
171171
github.com/aws/aws-sdk-go-v2/service/sso v1.25.2 h1:pdgODsAhGo4dvzC3JAG5Ce0PX8kWXrTZGx+jxADD+5E=
172172
github.com/aws/aws-sdk-go-v2/service/sso v1.25.2/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
173173
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.0 h1:90uX0veLKcdHVfvxhkWUQSCi5VabtwMLFutYiRke4oo=

‎pkg/actions/irsa/get.go‎

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -14,38 +14,9 @@ type GetOptions struct {
1414
}
1515

1616
func (m *Manager) Get(ctx context.Context, options GetOptions) ([]*api.ClusterIAMServiceAccount, error) {
17-
remoteServiceAccounts, err := m.stackManager.GetIAMServiceAccounts(ctx)
17+
remoteServiceAccounts, err := m.stackManager.GetIAMServiceAccounts(ctx, options.Name, options.Namespace)
1818
if err != nil {
1919
return nil, fmt.Errorf("getting iamserviceaccounts: %w", err)
2020
}
21-
22-
if options.Namespace != "" {
23-
remoteServiceAccounts = filterByNamespace(remoteServiceAccounts, options.Namespace)
24-
}
25-
26-
if options.Name != "" {
27-
remoteServiceAccounts = filterByName(remoteServiceAccounts, options.Name)
28-
}
29-
3021
return remoteServiceAccounts, nil
3122
}
32-
33-
func filterByNamespace(serviceAccounts []*api.ClusterIAMServiceAccount, namespace string) []*api.ClusterIAMServiceAccount {
34-
var serviceAccountsMatching []*api.ClusterIAMServiceAccount
35-
for _, sa := range serviceAccounts {
36-
if sa.Namespace == namespace {
37-
serviceAccountsMatching = append(serviceAccountsMatching, sa)
38-
}
39-
}
40-
return serviceAccountsMatching
41-
}
42-
43-
func filterByName(serviceAccounts []*api.ClusterIAMServiceAccount, name string) []*api.ClusterIAMServiceAccount {
44-
var serviceAccountsMatching []*api.ClusterIAMServiceAccount
45-
for _, sa := range serviceAccounts {
46-
if sa.Name == name {
47-
serviceAccountsMatching = append(serviceAccountsMatching, sa)
48-
}
49-
}
50-
return serviceAccountsMatching
51-
}

‎pkg/actions/irsa/get_test.go‎

Lines changed: 2 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ var _ = Describe("Get", func() {
2424
irsaManager = irsa.New("my-cluster", fakeStackManager, nil, nil)
2525
})
2626

27-
When("no options are specified", func() {
28-
It("returns all service accounts", func() {
27+
When("no error occurs", func() {
28+
It("returns service accounts from GetIAMServiceAccounts", func() {
2929
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
3030
{
3131
ClusterIAMMeta: api.ClusterIAMMeta{
@@ -65,109 +65,4 @@ var _ = Describe("Get", func() {
6565
}))
6666
})
6767
})
68-
69-
When("name option is specified", func() {
70-
It("returns only the service account matching the name", func() {
71-
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
72-
{
73-
ClusterIAMMeta: api.ClusterIAMMeta{
74-
Name: "test-sa",
75-
Namespace: "default",
76-
},
77-
AttachPolicyARNs: []string{"arn-123"},
78-
},
79-
{
80-
ClusterIAMMeta: api.ClusterIAMMeta{
81-
Name: "test-sa-2",
82-
Namespace: "not-default",
83-
},
84-
AttachPolicyARNs: []string{"arn-123"},
85-
},
86-
}, nil)
87-
88-
serviceAccounts, err := irsaManager.Get(context.Background(), irsa.GetOptions{Name: "test-sa"})
89-
Expect(err).NotTo(HaveOccurred())
90-
91-
Expect(fakeStackManager.GetIAMServiceAccountsCallCount()).To(Equal(1))
92-
Expect(serviceAccounts).To(Equal([]*api.ClusterIAMServiceAccount{
93-
{
94-
ClusterIAMMeta: api.ClusterIAMMeta{
95-
Name: "test-sa",
96-
Namespace: "default",
97-
},
98-
AttachPolicyARNs: []string{"arn-123"},
99-
},
100-
}))
101-
})
102-
})
103-
104-
When("namespace option is specified", func() {
105-
It("returns only the service account matching the name", func() {
106-
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
107-
{
108-
ClusterIAMMeta: api.ClusterIAMMeta{
109-
Name: "test-sa",
110-
Namespace: "default",
111-
},
112-
AttachPolicyARNs: []string{"arn-123"},
113-
},
114-
{
115-
ClusterIAMMeta: api.ClusterIAMMeta{
116-
Name: "test-sa-2",
117-
Namespace: "not-default",
118-
},
119-
AttachPolicyARNs: []string{"arn-123"},
120-
},
121-
}, nil)
122-
123-
serviceAccounts, err := irsaManager.Get(context.Background(), irsa.GetOptions{Namespace: "not-default"})
124-
Expect(err).NotTo(HaveOccurred())
125-
126-
Expect(fakeStackManager.GetIAMServiceAccountsCallCount()).To(Equal(1))
127-
Expect(serviceAccounts).To(Equal([]*api.ClusterIAMServiceAccount{
128-
{
129-
ClusterIAMMeta: api.ClusterIAMMeta{
130-
Name: "test-sa-2",
131-
Namespace: "not-default",
132-
},
133-
AttachPolicyARNs: []string{"arn-123"},
134-
},
135-
}))
136-
})
137-
})
138-
139-
When("name and namespace option is specified", func() {
140-
It("returns only the service account matching the name", func() {
141-
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
142-
{
143-
ClusterIAMMeta: api.ClusterIAMMeta{
144-
Name: "test-sa",
145-
Namespace: "default",
146-
},
147-
AttachPolicyARNs: []string{"arn-123"},
148-
},
149-
{
150-
ClusterIAMMeta: api.ClusterIAMMeta{
151-
Name: "some-other-sa",
152-
Namespace: "default",
153-
},
154-
AttachPolicyARNs: []string{"arn-123"},
155-
},
156-
}, nil)
157-
158-
serviceAccounts, err := irsaManager.Get(context.Background(), irsa.GetOptions{Namespace: "default", Name: "test-sa"})
159-
Expect(err).NotTo(HaveOccurred())
160-
161-
Expect(fakeStackManager.GetIAMServiceAccountsCallCount()).To(Equal(1))
162-
Expect(serviceAccounts).To(Equal([]*api.ClusterIAMServiceAccount{
163-
{
164-
ClusterIAMMeta: api.ClusterIAMMeta{
165-
Name: "test-sa",
166-
Namespace: "default",
167-
},
168-
AttachPolicyARNs: []string{"arn-123"},
169-
},
170-
}))
171-
})
172-
})
17368
})

‎pkg/actions/podidentityassociation/deleter.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ type StackLister interface {
2525
ListPodIdentityStackNames(ctx context.Context) ([]string, error)
2626
DescribeStack(ctx context.Context, stack *manager.Stack) (*manager.Stack, error)
2727
GetStackTemplate(ctx context.Context, stackName string) (string, error)
28-
GetIAMServiceAccounts(ctx context.Context) ([]*api.ClusterIAMServiceAccount, error)
28+
GetIAMServiceAccounts(ctx context.Context, name string, namespace string) ([]*api.ClusterIAMServiceAccount, error)
2929
}
3030

3131
// A StackDeleter lists and deletes CloudFormation stacks.

‎pkg/actions/podidentityassociation/fakes/fake_stack_updater.go‎

Lines changed: 12 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/actions/podidentityassociation/migrator.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func (m *Migrator) MigrateToPodIdentity(ctx context.Context, options PodIdentity
8686
*/
8787
resolver := IRSAv1StackNameResolver{}
8888
if err := resolver.Populate(func() ([]*api.ClusterIAMServiceAccount, error) {
89-
return m.stackUpdater.GetIAMServiceAccounts(ctx)
89+
return m.stackUpdater.GetIAMServiceAccounts(ctx, "", "")
9090
}); err != nil {
9191
return err
9292
}

‎pkg/actions/podidentityassociation/mocks/StackDeleter.go‎

Lines changed: 16 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)