OCPBUGS-98763: patch AWS master IAM role in 4.21/4.22→5.0 upgrade jobs

ci-operator/step-registry/openshift/upgrade/aws/heterogeneous/openshift-upgrade-aws-heterogeneous-workflow.yaml

@@ -5,6 +5,7 @@ workflow:
     pre:
     - chain: ipi-aws-pre-stableinitial
     - ref: ipi-install-heterogeneous
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: openshift-e2e-test
     post:

ci-operator/step-registry/openshift/upgrade/aws/openshift-upgrade-aws-workflow.yaml

@@ -4,6 +4,7 @@ workflow:
     allow_best_effort_post_steps: true
     pre:
     - chain: ipi-aws-pre-stableinitial
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: openshift-e2e-test
     post:

ci-operator/step-registry/openshift/upgrade/aws/ovn/openshift-upgrade-aws-ovn-workflow.yaml

@@ -6,6 +6,7 @@ workflow:
     - chain: ipi-conf-aws
     - ref: ovn-conf
     - chain: ipi-install-stableinitial
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: openshift-e2e-test
     post:

ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/OWNERS

@@ -0,0 +1,5 @@
+approvers:
+- mtulio
+- mfbonfigli
+- tthvo
+- patrickdillon

ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-commands.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+set -euo pipefail
+
+if test -f "${SHARED_DIR}/proxy-conf.sh"; then
+    # shellcheck disable=SC1091
+    source "${SHARED_DIR}/proxy-conf.sh"
+fi
+
+export KUBECONFIG="${SHARED_DIR}/kubeconfig"
+
+SOURCE_VERSION=$(oc get clusterversion version -o jsonpath='{.status.desired.version}')
+SOURCE_MAJOR=$(echo "${SOURCE_VERSION}" | cut -d. -f1)
+
+TARGET_VERSION=$(oc adm release info "${OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE:-}" \
+    --output=json 2>/dev/null | jq -r '.metadata.version') || {
+    echo "WARNING: could not determine target version, skipping patch."
+    exit 0
+}
+TARGET_MAJOR=$(echo "${TARGET_VERSION}" | cut -d. -f1)
+
+if [[ "${SOURCE_MAJOR}" != "4" || "${TARGET_MAJOR}" != "5" ]]; then
+    echo "Not a 4.x to 5.x upgrade (${SOURCE_VERSION} to ${TARGET_VERSION}), skipping."
+    exit 0
+fi
+
+echo "Detected 4.x to 5.x upgrade (${SOURCE_VERSION} to ${TARGET_VERSION}), patching master IAM role."
+
+export AWS_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/.awscred"
+REGION="${LEASED_RESOURCE}"
+INFRA_ID=$(jq -r '.infraID' "${SHARED_DIR}/metadata.json")
+MASTER_ROLE="${INFRA_ID}-master-role"
+POLICY_NAME="${INFRA_ID}-master-upgrade-policy"
+
+echo "Adding inline policy ${POLICY_NAME} to role: ${MASTER_ROLE}"
+
+aws --region "${REGION}" iam put-role-policy \
+  --role-name "${MASTER_ROLE}" \
+  --policy-name "${POLICY_NAME}" \
+  --policy-document '{
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Action": [
+          "elasticloadbalancing:SetSecurityGroups"
+        ],
+        "Resource": "*"
+      }
+    ]
+  }'
+
+echo "Successfully added inline policy ${POLICY_NAME} to ${MASTER_ROLE}"

ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.metadata.json

@@ -0,0 +1,11 @@
+{
+	"path": "openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.yaml",
+	"owners": {
+		"approvers": [
+			"mtulio",
+			"mfbonfigli",
+			"tthvo",
+			"patrickdillon"
+		]
+	}
+}

ci-operator/step-registry/openshift/upgrade/aws/patch-master-iam/openshift-upgrade-aws-patch-master-iam-ref.yaml

@@ -0,0 +1,17 @@
+ref:
+  as: openshift-upgrade-aws-patch-master-iam
+  from_image:
+    namespace: ocp
+    name: "5.0"
+    tag: upi-installer
+  commands: openshift-upgrade-aws-patch-master-iam-commands.sh
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+  dependencies:
+  - name: "release:latest"
+    env: OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE
+  documentation: |-
+    Patches the AWS master IAM role to add permissions introduced after the
+    initial install version.

ci-operator/step-registry/openshift/upgrade/aws/pausedworkers/openshift-upgrade-aws-pausedworkers-workflow.yaml

@@ -4,6 +4,7 @@ workflow:
     allow_best_effort_post_steps: true
     pre:
     - chain: ipi-aws-pre-stableinitial
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: openshift-e2e-test
     post:

ci-operator/step-registry/openshift/upgrade/aws/runc/openshift-upgrade-aws-runc-workflow.yaml

@@ -7,6 +7,7 @@ workflow:
     - ref: openshift-manifests-runc
     - ref: ovn-conf
     - chain: ipi-install-stableinitial
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: openshift-e2e-test
     post:

ci-operator/step-registry/openshift/upgrade/aws/single-node/openshift-upgrade-aws-single-node-workflow.yaml

@@ -6,6 +6,7 @@ workflow:
     - chain: ipi-conf-aws
     - ref: single-node-conf-aws
     - chain: ipi-install-stableinitial
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: single-node-e2e-test
     post:

ci-operator/step-registry/openshift/upgrade/aws/single-node/realtime/openshift-upgrade-aws-single-node-realtime-workflow.yaml

@@ -8,6 +8,7 @@ workflow:
     - ref: single-node-conf-aws
     - chain: ipi-install-stableinitial
     - ref: single-node-conf-realtime
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: single-node-e2e-test
     post:

ci-operator/step-registry/openshift/upgrade/aws/storage-symlinks/openshift-upgrade-aws-storage-symlinks-workflow.yaml

@@ -4,6 +4,7 @@ workflow:
     allow_best_effort_post_steps: true
     pre:
     - chain: ipi-aws-pre-stableinitial
+    - ref: openshift-upgrade-aws-patch-master-iam
     test:
     - ref: storage-disk-symlinks-save
     - ref: openshift-e2e-test