Skip to content

Commit

Permalink
Update kube-setup-s3-csi-driver.sh
Browse files Browse the repository at this point in the history
Add all oidc_url's to the trust plicy
  • Loading branch information
ajoaugustine authored Aug 14, 2024
1 parent a6c3029 commit 8d5f42d
Showing 1 changed file with 14 additions and 3 deletions.
17 changes: 14 additions & 3 deletions gen3/bin/kube-setup-s3-csi-driver.sh
Original file line number Diff line number Diff line change
Expand Up @@ -74,11 +74,16 @@ EOF

# Create the trust policy for Mountpoint for Amazon S3 CSI driver
create_s3_csi_trust_policy() {
oidc_url=$(aws eks describe-cluster --name $eks_cluster --query 'cluster.identity.oidc.issuer' --output text | sed -e 's/^https:\/\///')
cat <<EOF > /tmp/aws-s3-csi-driver-trust-policy-$$.json
oidc_providers=$(for cluster in $(aws eks list-clusters --query "clusters[]" --output text); do aws eks describe-cluster --name $cluster --query 'cluster.identity.oidc.issuer' --output text | sed -e 's/^https:\/\///'; done)
trust_policy_file="/tmp/aws-s3-csi-driver-trust-policy-$$.json"
cat <<EOF > ${trust_policy_file}
{
"Version": "2012-10-17",
"Statement": [
EOF

for oidc_url in ${oidc_providers}; do
cat <<EOF >> ${trust_policy_file}
{
"Effect": "Allow",
"Principal": {
Expand All @@ -91,7 +96,13 @@ create_s3_csi_trust_policy() {
"${oidc_url}:sub": "system:serviceaccount:*:s3-csi-*"
}
}
}
},
EOF
done

# Remove the last comma and close the JSON
sed -i '$ s/,$//' ${trust_policy_file}
cat <<EOF >> ${trust_policy_file}
]
}
EOF
Expand Down

0 comments on commit 8d5f42d

Please sign in to comment.