Grant ec2:DescribeSecurityGroups to the IPv6 VPC CNI role (#8837)

fix: Grant ec2:DescribeSecurityGroups to the IPv6 VPC CNI role

Subnet discovery in the VPC CNI needs two EC2 permissions, not one.
52148b4 granted ec2:DescribeSubnets; this grants the other half.

Reported in #8768, where an IPv6 cluster hit both denials in sequence.
The first surfaced as a MissingIAMPermissions pod event:

    Unauthorized operation: failed to call ec2:DescribeSubnets due to
    missing permissions.

Once that was granted the CNI got further and failed on the second,
which appears only in /var/log/aws-routed-eni/ipamd.log because the
container writes nothing about it to stdout:

    Initialization failure: unable to describe security groups:
    operation error EC2: DescribeSecurityGroups, StatusCode: 403,
    api error UnauthorizedOperation: ... no identity-based policy
    allows the ec2:DescribeSecurityGroups action

The upstream CNI documents both as required for subnet discovery since
v1.22.1, and subnet discovery is on by default:
aws/amazon-vpc-cni-k8s#3709

Only IPv6 clusters are affected. The IPv4 path attaches the AWS-managed
AmazonEKS_CNI_Policy, whose current version (v6) already grants both
ec2:DescribeSubnets and ec2:DescribeSecurityGroups. The IPv6 path uses
this hand-written inline policy instead, so each action has to be granted
explicitly.

Both callers of makeIPv6VPCCNIPolicyDocument are affected: the IRSA path
via addon.AttachPolicy, and the pod identity path via
PodIdentityAssociation.PermissionPolicy. The existing pod identity test
only asserted the document was non-empty, so it would not have caught a
missing action; it now asserts both subnet discovery permissions, as the
IRSA test already did for ec2:DescribeSubnets.

With this change the IPv6 policy matches the upstream IPv6 policy exactly,
with no missing and no extra actions.

Author: gustavodiaz7722

pkg/actions/addon/create.go

@@ -490,12 +490,15 @@ func makeIPv6VPCCNIPolicyDocument(partition string) map[string]interface{} {
 					"ec2:DescribeTags",
 					"ec2:DescribeNetworkInterfaces",
 					"ec2:DescribeInstanceTypes",
-					// Required by the VPC CNI's subnet discovery, which is enabled
-					// by default. Without it ipamd fails to initialise, aws-node
-					// crash-loops and nodes never become ready. The IPv4 path gets
-					// this from the AWS-managed AmazonEKS_CNI_Policy; the IPv6
-					// path uses this inline policy, so it must be granted here.
+					// Both of these are required by the VPC CNI's subnet discovery,
+					// which is enabled by default since VPC CNI v1.22.1. Without
+					// them ipamd fails to initialise, aws-node crash-loops and nodes
+					// never become ready. The IPv4 path gets them from the
+					// AWS-managed AmazonEKS_CNI_Policy; the IPv6 path uses this
+					// inline policy, so they must be granted here. See
+					// https://github.com/aws/amazon-vpc-cni-k8s/blob/master/docs/iam-policy.md
 					"ec2:DescribeSubnets",
+					"ec2:DescribeSecurityGroups",
 				},
 				"Resource": "*",
 			},

pkg/actions/addon/create_test.go

@@ -3,6 +3,7 @@ package addon_test
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
 	"time"
@@ -988,6 +989,12 @@ var _ = Describe("Create", func() {
 						Expect(args[1]).To(BeAssignableToTypeOf(&api.PodIdentityAssociation{}))
 						Expect(args[1].(*api.PodIdentityAssociation).ServiceAccountName).To(Equal("aws-node"))
 						Expect(args[1].(*api.PodIdentityAssociation).PermissionPolicy).NotTo(BeEmpty())
+						// The pod identity path shares the IPv6 CNI policy document with
+						// the IRSA path; subnet discovery permissions must reach both.
+						policy, err := json.Marshal(args[1].(*api.PodIdentityAssociation).PermissionPolicy)
+						Expect(err).NotTo(HaveOccurred())
+						Expect(string(policy)).To(ContainSubstring("ec2:DescribeSubnets"))
+						Expect(string(policy)).To(ContainSubstring("ec2:DescribeSecurityGroups"))
 					}).
 					Return("arn:aws:iam::111122223333:role/aws-node", nil).
 					Once()
@@ -1168,9 +1175,10 @@ var _ = Describe("Create", func() {
 					Expect(err).NotTo(HaveOccurred())
 					Expect(string(output)).To(ContainSubstring("AssignIpv6Addresses"))
 					// Subnet discovery is on by default in the VPC CNI; without
-					// this permission ipamd fails to initialise and nodes never
+					// these permissions ipamd fails to initialise and nodes never
 					// become ready.
 					Expect(string(output)).To(ContainSubstring("DescribeSubnets"))
+					Expect(string(output)).To(ContainSubstring("DescribeSecurityGroups"))
 					rsr.(*builder.IAMRoleResourceSet).OutputRole = "arn:aws:iam::111122223333:role/role-name-1"
 					return nil
 				}