Add eks fis v2 support

Signed-off-by: Mikkel Oscar Lyderik Larsen <[email protected]>

Author: mikkeloscar

cluster/manifests/02-admission-control/config.yaml

@@ -169,6 +169,11 @@ data:
 {{- end}}
 
   pod.pod-security-policy.allow-privilege-escalation: "{{ .Cluster.ConfigItems.teapot_admission_controller_pod_security_policy_privileged_allow_privilege_escalation }}"
+{{- if eq .Cluster.ConfigItems.eks_fis_support_enabled "true" }}
+  pod.aws-fis-experiment-service-account-name: "fis-experiment-executor"
+  pod.aws-fis-experiment-user: "fis-experiment-executor"
+  pod.aws-fis-experiment-privileged-capabilities.NET_ADMIN: ""
+{{- end}}
 
   deployment.default.rolling-update-max-surge: "{{ .Cluster.ConfigItems.teapot_admission_controller_deployment_default_max_surge }}"
   deployment.default.rolling-update-max-unavailable: "{{ .Cluster.ConfigItems.teapot_admission_controller_deployment_default_max_unavailable }}"

cluster/manifests/02-admission-control/deployment.yaml

@@ -33,7 +33,8 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
       - name: admission-controller
-        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-269
+        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/staging_namespace/teapot/admission-controller:pr-318-2
+        # image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-269
         lifecycle:
           preStop:
             sleep:

cluster/manifests/eks-fis/01-rbac.yaml

@@ -1,23 +1,15 @@
 {{- if eq .Cluster.ConfigItems.eks_fis_support_enabled "true" }}
-# {{ range $namespace := split .Cluster.ConfigItems.eks_fis_namespaces "," }}
-kind: ServiceAccount
-apiVersion: v1
-metadata:
-  namespace: "{{ $namespace }}"
-  name: fis-experiment-executor
----
-# {{ end }}
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: fis-experiment-executor
 rules:
 - apiGroups: [""]
   resources: ["configmaps"]
-  verbs: ["get", "create", "patch", "delete"]
+  verbs: [ "get", "create", "patch", "delete"]
 - apiGroups: [""]
   resources: ["pods"]
-  verbs: ["create", "get", "delete", "deletecollection", "list"]
+  verbs: ["create", "list", "get", "delete", "deletecollection"]
 - apiGroups: [""]
   resources: ["pods/ephemeralcontainers"]
   verbs: ["update"]
@@ -33,11 +25,6 @@ kind: ClusterRoleBinding
 metadata:
   name: fis-experiment-executor
 subjects:
-# {{ range $namespace := split .Cluster.ConfigItems.eks_fis_namespaces "," }}
-- kind: ServiceAccount
-  name: fis-experiment-executor
-  namespace: "{{ $namespace }}"
-# {{ end }}
 - apiGroup: rbac.authorization.k8s.io
   kind: User
   name: fis-experiment-executor

cluster/manifests/role-sync-controller/cronjob.yaml

@@ -33,7 +33,8 @@ spec:
           restartPolicy: Never
           containers:
           - name: role-sync-controller
-            image: container-registry.zalando.net/teapot/role-sync-controller:main-13
+            # image: container-registry.zalando.net/teapot/role-sync-controller:main-13
+            image: container-registry-test.zalando.net/teapot/role-sync-controller:pr-23-3
             args:
               - --subject-group=PowerUser
               - --subject-group=Manual
@@ -47,4 +48,7 @@ spec:
               {{- if eq .Cluster.Provider "zalando-eks"}}
               - --subject-serviceaccount=kube-system/deployment-service-controller
               {{- end}}
+              {{- if eq .Cluster.ConfigItems.eks_fis_support_enabled "true" }}
+              - --eks-fis-serviceaccount=fis-experiment-executor
+              {{- end}}
 {{ end }}

cluster/manifests/role-sync-controller/rbac.yaml

@@ -14,6 +14,15 @@ rules:
     - "namespaces"
     verbs:
     - "list"
+  # Allow the controller to manage ServiceAccounts
+  - apiGroups:
+    - ""
+    resources:
+    - serviceaccounts
+    verbs:
+    - "get"
+    - "create"
+    - "update"
   # Allow the controller to manage Roles and Rolebindings
   - apiGroups:
     - rbac.authorization.k8s.io
@@ -41,6 +50,23 @@ rules:
     - "get"
     - "list"
     - "watch"
+  # Allow the controller to manage roles with permissions required by eks-fis
+  # integration.
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "create", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["create", "get", "delete", "deletecollection", "list"]
+  - apiGroups: [""]
+    resources: ["pods/ephemeralcontainers"]
+    verbs: ["update"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding