Merge branch 'main' into fix/addpoliciesoncreate

Author: rushmash91

OWNERS_ALIASES

@@ -5,10 +5,10 @@ aliases:
     - a-hilaly
     - jlbutler
     - michaelhtm
-    - TiberiuGC
     - rushmash91
     - knottnt
   # emeritus-core-ack-team:
+  #   - TiberiuGC
   #   - jaypipes
   #   - jljaco
   #   - mhausenblas

apis/v1alpha1/ack-generate-metadata.yaml

@@ -1,8 +1,8 @@
 ack_generate_info:
-  build_date: "2025-05-08T19:50:19Z"
-  build_hash: a82538df1333319f8ec1d603f6cf293aefc46e1b
-  go_version: go1.24.1
-  version: v0.45.0-3-ga82538d
+  build_date: "2025-05-14T20:54:45Z"
+  build_hash: 016d4c53082b4b78942ec154e4bf4bf36c4db11d
+  go_version: go1.24.3
+  version: v0.46.2-2-g016d4c5
 api_directory_checksum: 7e1c19231d3275a1147157f6943a7391953f7001
 api_version: v1alpha1
 aws_sdk_go_version: v1.32.6

config/controller/kustomization.yaml

@@ -6,4 +6,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: public.ecr.aws/aws-controllers-k8s/iam-controller
-  newTag: 1.3.20
+  newTag: 1.3.21

go.mod

@@ -5,7 +5,7 @@ go 1.24.0
 toolchain go1.24.1
 
 require (
-	github.com/aws-controllers-k8s/runtime v0.45.0
+	github.com/aws-controllers-k8s/runtime v0.46.1
 	github.com/aws/aws-sdk-go v1.49.0
 	github.com/aws/aws-sdk-go-v2 v1.34.0
 	github.com/aws/aws-sdk-go-v2/service/iam v1.38.8

go.sum

@@ -1,7 +1,7 @@
 github.com/a-hilaly/aws-iam-policy v0.0.0-20231121054900-2c56e839ca53 h1:2uNM0nR2WUDN88EYFxjEaroH+PZJ6k/h9kl+KO0dWVc=
 github.com/a-hilaly/aws-iam-policy v0.0.0-20231121054900-2c56e839ca53/go.mod h1:Ojgst9ZFn+VEEJpqtuw/LxVGqEf2+hwWBlkYWvF/XWM=
-github.com/aws-controllers-k8s/runtime v0.45.0 h1:b0xCqIE1SNve/jcJPW/QkCGkDmjxWtWTDFHKZpHJcFQ=
-github.com/aws-controllers-k8s/runtime v0.45.0/go.mod h1:G2UMBKA7qgXG4JV16NTIUp715uqvUEvWaa7TG1I527U=
+github.com/aws-controllers-k8s/runtime v0.46.1 h1:61RU6uYiFSp0cDhv52vAmaPzrebzoudtsp1fGkk6iLk=
+github.com/aws-controllers-k8s/runtime v0.46.1/go.mod h1:G2UMBKA7qgXG4JV16NTIUp715uqvUEvWaa7TG1I527U=
 github.com/aws/aws-sdk-go v1.49.0 h1:g9BkW1fo9GqKfwg2+zCD+TW/D36Ux+vtfJ8guF4AYmY=
 github.com/aws/aws-sdk-go v1.49.0/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
 github.com/aws/aws-sdk-go-v2 v1.34.0 h1:9iyL+cjifckRGEVpRKZP3eIxVlL06Qk1Tk13vreaVQU=

helm/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
 name: iam-chart
 description: A Helm chart for the ACK service controller for AWS Identity & Access Management (IAM)
-version: 1.3.20
-appVersion: 1.3.20
+version: 1.3.21
+appVersion: 1.3.21
 home: https://github.com/aws-controllers-k8s/iam-controller
 icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png
 sources:

helm/templates/NOTES.txt

@@ -1,5 +1,5 @@
 {{ .Chart.Name }} has been installed.
-This chart deploys "public.ecr.aws/aws-controllers-k8s/iam-controller:1.3.20".
+This chart deploys "public.ecr.aws/aws-controllers-k8s/iam-controller:1.3.21".
 
 Check its status by running:
   kubectl --namespace {{ .Release.Namespace }} get pods -l "app.kubernetes.io/instance={{ .Release.Name }}"

helm/values.yaml

@@ -4,7 +4,7 @@
 
 image:
   repository: public.ecr.aws/aws-controllers-k8s/iam-controller
-  tag: 1.3.20
+  tag: 1.3.21
   pullPolicy: IfNotPresent
   pullSecrets: []
 
@@ -142,12 +142,12 @@ reconcile:
   # If empty, all resources will be reconciled.
   # If specified, only the listed resource kinds will be reconciled.
   resources:
-    - Groups
-    - Instanceprofiles
-    - Openidconnectproviders
-    - Policies
-    - Roles
-    - Users
+    - Group
+    - InstanceProfile
+    - OpenIDConnectProvider
+    - Policy
+    - Role
+    - User
 
 serviceAccount:
   # Specifies whether a service account should be created

pkg/resource/role/hooks.go

@@ -31,6 +31,25 @@ import (
 	commonutil "github.com/aws-controllers-k8s/iam-controller/pkg/util"
 )
 
+func (rm *resourceManager) attachPolicies(ctx context.Context, r *resource) (err error) {
+	rlog := ackrtlog.FromContext(ctx)
+	exit := rlog.Trace("rm.attachPolicies")
+	defer func() { exit(err) }()
+	for _, p := range r.ko.Spec.Policies {
+		err := rm.addManagedPolicy(ctx, r, p)
+		if err != nil {
+			return err
+		}
+	}
+	for n, p := range r.ko.Spec.InlinePolicies {
+		err := rm.addInlinePolicy(ctx, r, n, p)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // putRolePermissionsBoundary calls the IAM API to set a given role
 // permission boundary.
 func (rm *resourceManager) putRolePermissionsBoundary(