fix alb role trust policy to match wildcard names (#296)

giantswarm · Apr 26, 2024 · 0a6e51d · 0a6e51d
1 parent 5572db8
commit 0a6e51d
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Changed service account matching `StringLike` to accommodate wildcard full names. 
+
 ## [0.22.0] - 2024-04-15
 
 ### Changed

diff --git a/controllers/common_test.go b/controllers/common_test.go
@@ -120,7 +120,7 @@ var ALBControllerRoleInfo = RoleInfo{
       },
       "Action": "sts:AssumeRoleWithWebIdentity",
       "Condition": {
-        "StringEquals": {
+        "StringLike": {
           "irsa.test.gaws.gigantic.io:sub": "system:serviceaccount:*:aws-load-balancer-controller"
         }
       }

diff --git a/pkg/iam/route53_template.go b/pkg/iam/route53_template.go
@@ -42,7 +42,7 @@ const albControllerTrustIdentityPolicyIRSA = `{
       },
       "Action": "sts:AssumeRoleWithWebIdentity",
       "Condition": {
-        "StringEquals": {
+        "StringLike": {
           "{{.CloudFrontDomain}}:sub": "system:serviceaccount:*:{{.ServiceAccount}}"
         }
       }
@@ -54,7 +54,7 @@ const albControllerTrustIdentityPolicyIRSA = `{
       },
       "Action": "sts:AssumeRoleWithWebIdentity",
       "Condition": {
-        "StringEquals": {
+        "StringLike": {
           "{{.AdditionalCloudFrontDomain}}:sub": "system:serviceaccount:*:{{.ServiceAccount}}"
         }
       }