Add permission to delete kubernetes.io/cluster/* tag from subnets on HCP

openshift · Nov 22, 2024 · bd92bea · bd92bea
1 parent f2c6f75
commit bd92bea
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 0 deletions.
diff --git a/resources/sts/4.16/hypershift/sts_hcp_installer_permission_policy.json b/resources/sts/4.16/hypershift/sts_hcp_installer_permission_policy.json
@@ -322,6 +322,23 @@
                 }
             }
         },
+        {
+            "Sid": "DeleteTagsK8sSubnet",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DeleteTags"
+            ],
+            "Resource": [
+                "arn:aws:ec2:*:*:subnet/*"
+            ],
+            "Condition": {
+                "ForAllValues:StringLike": {
+                    "aws:TagKeys": [
+                        "kubernetes.io/cluster/*"
+                    ]
+                }
+            }
+        },
         {
             "Sid": "ListPoliciesAttachedToRoles",
             "Effect": "Allow",

diff --git a/resources/sts/4.17/hypershift/sts_hcp_installer_permission_policy.json b/resources/sts/4.17/hypershift/sts_hcp_installer_permission_policy.json
@@ -322,6 +322,23 @@
                 }
             }
         },
+        {
+            "Sid": "DeleteTagsK8sSubnet",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DeleteTags"
+            ],
+            "Resource": [
+                "arn:aws:ec2:*:*:subnet/*"
+            ],
+            "Condition": {
+                "ForAllValues:StringLike": {
+                    "aws:TagKeys": [
+                        "kubernetes.io/cluster/*"
+                    ]
+                }
+            }
+        },
         {
             "Sid": "ListPoliciesAttachedToRoles",
             "Effect": "Allow",