From 39abbbb19e1b8af884dffcd00fb76884646cc2e9 Mon Sep 17 00:00:00 2001
From: Brad Ison <brad.ison@redhat.com>
Date: Mon, 17 Sep 2018 13:05:37 -0400
Subject: [PATCH 1/2] modules/aws: Add IAM module

This adds an IAM Terraform module to provide a place for IAM resources
that don't fit elsewhere.  The immediate need is to create the IAM
role and profile for worker nodes now that the larger worker module
has been removed: https://github.com/openshift/installer/pull/119
---
 modules/aws/iam/main.tf      | 80 ++++++++++++++++++++++++++++++++++++
 modules/aws/iam/variables.tf |  9 ++++
 steps/infra/aws/main.tf      |  7 ++++
 3 files changed, 96 insertions(+)
 create mode 100644 modules/aws/iam/main.tf
 create mode 100644 modules/aws/iam/variables.tf

diff --git a/modules/aws/iam/main.tf b/modules/aws/iam/main.tf
new file mode 100644
index 00000000000..e825f331afd
--- /dev/null
+++ b/modules/aws/iam/main.tf
@@ -0,0 +1,80 @@
+locals {
+  arn = "aws"
+}
+
+resource "aws_iam_instance_profile" "worker" {
+  name = "${var.cluster_name}-worker-profile"
+
+  role = "${var.worker_iam_role == "" ?
+    join("|", aws_iam_role.worker_role.*.name) :
+    join("|", data.aws_iam_role.worker_role.*.name)
+  }"
+}
+
+data "aws_iam_role" "worker_role" {
+  count = "${var.worker_iam_role == "" ? 0 : 1}"
+  name  = "${var.worker_iam_role}"
+}
+
+resource "aws_iam_role" "worker_role" {
+  count = "${var.worker_iam_role == "" ? 1 : 0}"
+  name  = "${var.cluster_name}-worker-role"
+  path  = "/"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "ec2.amazonaws.com"
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "worker_policy" {
+  count = "${var.worker_iam_role == "" ? 1 : 0}"
+  name  = "${var.cluster_name}_worker_policy"
+  role  = "${aws_iam_role.worker_role.id}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "ec2:Describe*",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:AttachVolume",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:DetachVolume",
+      "Resource": "*"
+    },
+    {
+      "Action": "elasticloadbalancing:*",
+      "Resource": "*",
+      "Effect": "Allow"
+    },
+    {
+      "Action" : [
+        "s3:GetObject"
+      ],
+      "Resource": "arn:${local.arn}:s3:::*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}
diff --git a/modules/aws/iam/variables.tf b/modules/aws/iam/variables.tf
new file mode 100644
index 00000000000..2e99ae8d362
--- /dev/null
+++ b/modules/aws/iam/variables.tf
@@ -0,0 +1,9 @@
+variable "cluster_name" {
+  type = "string"
+}
+
+variable "worker_iam_role" {
+  type        = "string"
+  default     = ""
+  description = "IAM role to use for the instance profiles of worker nodes."
+}
diff --git a/steps/infra/aws/main.tf b/steps/infra/aws/main.tf
index 7dfa160ad9a..7e19a84f2d0 100644
--- a/steps/infra/aws/main.tf
+++ b/steps/infra/aws/main.tf
@@ -41,6 +41,13 @@ module "masters" {
   user_data_igns      = "${var.tectonic_ignition_masters}"
 }
 
+module "iam" {
+  source = "../../../modules/aws/iam"
+
+  cluster_name     = "${var.tectonic_cluster_name}"
+  worker_iam_role  = "${var.tectonic_aws_worker_iam_role_name}"
+}
+
 module "dns" {
   source = "../../../modules/dns/route53"
 

From 0dfb351b76678f3270ad999ced23589104a5ad7b Mon Sep 17 00:00:00 2001
From: Brad Ison <brad.ison@redhat.com>
Date: Mon, 17 Sep 2018 14:52:31 -0400
Subject: [PATCH 2/2] modules/bootkube: Bump machine-api-operator image to
 latest

Bumping to latest machine-api-operator image to include the fix to the
worker IAM profile naming:

  https://github.com/openshift/machine-api-operator/pull/57
---
 modules/bootkube/resources/manifests/machine-api-operator.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/bootkube/resources/manifests/machine-api-operator.yaml b/modules/bootkube/resources/manifests/machine-api-operator.yaml
index 177a60294d1..125b870bc3d 100644
--- a/modules/bootkube/resources/manifests/machine-api-operator.yaml
+++ b/modules/bootkube/resources/manifests/machine-api-operator.yaml
@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
       - name: machine-api-operator
-        image: quay.io/coreos/machine-api-operator:225ff56
+        image: quay.io/coreos/machine-api-operator:b6a04c2
         command:
         - "/machine-api-operator"
         resources: