Skip to content

Commit

Permalink
doc: add requirements for acm tagging
Browse files Browse the repository at this point in the history
doc: add missing documented features to the list

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>
  • Loading branch information
szuecs committed Mar 5, 2024
1 parent 620c43c commit 2989410
Show file tree
Hide file tree
Showing 3 changed files with 16 additions and 0 deletions.
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ This information is used to manage AWS resources for each ingress objects of the
- Support for AWS WAF and WAFv2
- Support for AWS CNI pod direct access
- Support for Kubernetes CRD [RouteGroup](https://opensource.zalando.com/skipper/kubernetes/routegroups/)
- Support for zone aware traffic (enable and disable cross zone traffic `--nlb-cross-zone`)
- Support for explicitly enable certificates by using certificate Tags `--cert-filter-tag=key=value`

## Upgrade

Expand Down
4 changes: 4 additions & 0 deletions deploy/kops.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ kube-ingress-aws-controller, which we will use:
"Effect": "Allow",
"Action": [
"acm:ListCertificates",
"acm:ListTagsForCertificate",
"acm:GetCertificate",
"acm:DescribeCertificate",
"autoscaling:DescribeAutoScalingGroups",
Expand All @@ -77,6 +78,7 @@ kube-ingress-aws-controller, which we will use:
"ec2:DescribeInternetGateways",
"iam:GetServerCertificate",
"iam:ListServerCertificates",
"iam:ListServerCertificateTags",
"iam:CreateServiceLinkedRole"
],
"Resource": [
Expand All @@ -101,6 +103,7 @@ and add this to your node policy:
"Effect": "Allow",
"Action": [
"acm:ListCertificates",
"acm:ListTagsForCertificate",
"acm:GetCertificate",
"acm:DescribeCertificate",
"autoscaling:DescribeAutoScalingGroups",
Expand All @@ -121,6 +124,7 @@ and add this to your node policy:
"ec2:DescribeVpcs",
"iam:GetServerCertificate",
"iam:CreateServiceLinkedRole",
"iam:ListServerCertificateTags",
"iam:ListServerCertificates"
],
"Resource": ["*"]
Expand Down
10 changes: 10 additions & 0 deletions deploy/requirements.md
Original file line number Diff line number Diff line change
Expand Up @@ -256,6 +256,11 @@ Please also note that the worker nodes will need the right permission to describ
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "acm:ListTagsForCertificate",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "acm:DescribeCertificate",
"Resource": "*",
Expand All @@ -266,6 +271,11 @@ Please also note that the worker nodes will need the right permission to describ
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "iam:ListServerCertificateTags",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "iam:GetServerCertificate",
"Resource": "*",
Expand Down

0 comments on commit 2989410

Please sign in to comment.