Minor flyte role updates (#227)

* move flyteadmin to the dataplane role, clean up a few things * restrict to runs in compute namespace instead of all pods * move flyteadmin back to control plane
dominodatalab · Mar 14, 2024 · 96ac77c · 96ac77c
1 parent c2121d8
commit 96ac77c
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/modules/flyte/iam.tf b/modules/flyte/iam.tf
@@ -13,6 +13,7 @@ resource "aws_iam_role" "flyte_controlplane" {
           StringEquals : {
             "${trimprefix(local.oidc_provider_url, "https://")}:aud" : "sts.amazonaws.com",
             "${trimprefix(local.oidc_provider_url, "https://")}:sub" : [
+              "system:serviceaccount:${var.platform_namespace}:${var.serviceaccount_names.datacatalog}",
               "system:serviceaccount:${var.platform_namespace}:${var.serviceaccount_names.flyteadmin}",
               "system:serviceaccount:${var.platform_namespace}:${var.serviceaccount_names.flytepropeller}",
             ]
@@ -68,15 +69,14 @@ resource "aws_iam_role" "flyte_dataplane" {
           Federated = local.oidc_provider_arn
         }
         Condition : {
-          StringEquals : {
+          StringLike : {
             "${trimprefix(local.oidc_provider_url, "https://")}:aud" : "sts.amazonaws.com",
             "${trimprefix(local.oidc_provider_url, "https://")}:sub" : [
-              "system:serviceaccount:${var.platform_namespace}:${var.serviceaccount_names.datacatalog}",
-              "system:serviceaccount:${var.compute_namespace}:*"
+              "system:serviceaccount:${var.compute_namespace}:run-*"
             ]
           }
         }
-      },
+      }
     ]
   })
 }