Create periodic job for infra-viewer access sync (kubeflow#883)

Create periodic job for infra-viewer access sync
Linchin · Jan 30, 2021 · 3d7a6cf · 3d7a6cf
1 parent 781dcb0
commit 3d7a6cf
Show file tree

Hide file tree

Showing 3 changed files with 43 additions and 0 deletions.
diff --git a/aws/Access/assume-role-access/infra-viewer/trust-policy.json b/aws/Access/assume-role-access/infra-viewer/trust-policy.json
@@ -0,0 +1,13 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::068661676837:root"
+      },
+      "Action": "sts:AssumeRole",
+      "Condition": {}
+    }
+  ]
+}
diff --git a/aws/GitOps/clusters/optional-test-infra-daily-worker/namespaces/prow/config.yaml b/aws/GitOps/clusters/optional-test-infra-daily-worker/namespaces/prow/config.yaml
@@ -90,6 +90,21 @@ data:
             value: https://raw.githubusercontent.com/kubeflow/testing/master/aws/Access/assume-role-access/infra-editor/trust-policy.json
           - name: ROLE_NAME
             value: infra-editor
+
+    - interval: 1h
+      agent: kubernetes
+      name: infra-viewer-sync
+      labels:
+        preset-aws-cred: "true"
+      spec:
+        containers:
+        - image: public.ecr.aws/j1r0q0g6/daily-worker:latest
+          command: ["/usr/local/bin/update-iam-assume-role-policy.sh"]
+          env:
+          - name: TRUST_POLICY
+            value: https://raw.githubusercontent.com/kubeflow/testing/master/aws/Access/assume-role-access/infra-viewer/trust-policy.json
+          - name: ROLE_NAME
+            value: infra-viewer
 kind: ConfigMap
 metadata:
   creationTimestamp: null

diff --git a/aws/User/clusters/optional-test-infra-daily-worker/namespaces/prow/configmap/config.yaml b/aws/User/clusters/optional-test-infra-daily-worker/namespaces/prow/configmap/config.yaml
@@ -87,3 +87,18 @@ periodics:
         value: https://raw.githubusercontent.com/kubeflow/testing/master/aws/Access/assume-role-access/infra-editor/trust-policy.json
       - name: ROLE_NAME
         value: infra-editor
+
+- interval: 1h
+  agent: kubernetes
+  name: infra-viewer-sync
+  labels:
+    preset-aws-cred: "true"
+  spec:
+    containers:
+    - image: public.ecr.aws/j1r0q0g6/daily-worker:latest
+      command: ["/usr/local/bin/update-iam-assume-role-policy.sh"]
+      env:
+      - name: TRUST_POLICY
+        value: https://raw.githubusercontent.com/kubeflow/testing/master/aws/Access/assume-role-access/infra-viewer/trust-policy.json
+      - name: ROLE_NAME
+        value: infra-viewer