AWS kube-up: Authorize route53 in the IAM policy

Federation needs this now (on the nodes), and I suspect ingress controllers will shortly want this also. Given we're going to authorize it on the nodes, we should authorize it on the master also (the master is much more trusted). Fix #27467

AWS kube-up: Authorize route53 in the IAM policy
f3cc5f50 · Justin Santa Barbara · ee87a39f · f3cc5f50 · f3cc5f50
Commit f3cc5f50 authored Jun 21, 2016 by Justin Santa Barbara
Showing with 10 additions and 0 deletions

kubernetes-master-policy.json cluster/aws/templates/iam/kubernetes-master-policy.json +5 -0

kubernetes-minion-policy.json cluster/aws/templates/iam/kubernetes-minion-policy.json +5 -0

No files found.
--- a/cluster/aws/templates/iam/kubernetes-master-policy.json
+++ b/cluster/aws/templates/iam/kubernetes-master-policy.json
@@ -13,6 +13,11 @@
    },
    {
      "Effect": "Allow",
+      "Action": ["route53:*"],
+      "Resource": ["*"]
+    },
+    {
+      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::kubernetes-*"

--- a/cluster/aws/templates/iam/kubernetes-minion-policy.json
+++ b/cluster/aws/templates/iam/kubernetes-minion-policy.json
@@ -25,6 +25,11 @@
    },
    {
      "Effect": "Allow",
+      "Action": ["route53:*"],
+      "Resource": ["*"]
+    },
+    {
+      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",