SREP-3817: Allow day-2 CreateTags on existing EBS volumes and snapshots

[dustman9000]

Summary

• Add a new IAM policy statement (CreateTagsExistingVolumes) to the HCP EBS CSI driver policy allowing ec2:CreateTags on existing volumes and snapshots that have the red-hat-managed: true tag
• Add a Sid to the existing creation-time statement (CreateTagsOnCreate) for clarity
• Follows the same pattern already used by the CAPA Controller Manager policy for day-2 tag reconciliation

Problem

The EBS CSI driver's EBSVolumeTagsController (introduced in OCP 4.19 via CFE-1131 / PR #297) calls ec2:CreateTags on existing EBS volumes to reconcile infrastructure resource tags. The current policy restricts CreateTags with an ec2:CreateAction condition that only allows tagging during CreateVolume/CreateSnapshot, causing AccessDenied on all day-2 tag operations.

This affects all ROSA HCP clusters on OCP 4.19+. Classic STS clusters are not impacted (they have unrestricted ec2:CreateTags).

Support case: 04362496

Fix

Add a second CreateTags statement that allows tagging existing resources scoped to aws:ResourceTag/red-hat-managed: true. This is the same approach used by the CAPA Controller Manager policy (CreateTagsCAPAControllerReconcileVolume).

Test plan

• Validate JSON syntax
• Deploy to integration environment and verify EBS CSI driver day-2 tag reconciliation succeeds
• Verify volume creation still works with tags applied at creation time
• Check CloudTrail for absence of AccessDenied on CreateTags from the CSI driver role

Jira: https://issues.redhat.com/browse/SREP-3817

[openshift-ci-robot]

@dustman9000: This pull request references SREP-3817 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

• Add a new IAM policy statement (CreateTagsExistingVolumes) to the HCP EBS CSI driver policy allowing ec2:CreateTags on existing volumes and snapshots that have the red-hat-managed: true tag
• Add a Sid to the existing creation-time statement (CreateTagsOnCreate) for clarity
• Follows the same pattern already used by the CAPA Controller Manager policy for day-2 tag reconciliation

Problem

The EBS CSI driver's EBSVolumeTagsController (introduced in OCP 4.19 via CFE-1131 / PR #297) calls ec2:CreateTags on existing EBS volumes to reconcile infrastructure resource tags. The current policy restricts CreateTags with an ec2:CreateAction condition that only allows tagging during CreateVolume/CreateSnapshot, causing AccessDenied on all day-2 tag operations.

This affects all ROSA HCP clusters on OCP 4.19+. Classic STS clusters are not impacted (they have unrestricted ec2:CreateTags).

Support case: 04362496

Fix

Add a second CreateTags statement that allows tagging existing resources scoped to aws:ResourceTag/red-hat-managed: true. This is the same approach used by the CAPA Controller Manager policy (CreateTagsCAPAControllerReconcileVolume).

Test plan

• Validate JSON syntax
• Deploy to integration environment and verify EBS CSI driver day-2 tag reconciliation succeeds
• Verify volume creation still works with tags applied at creation time
• Check CloudTrail for absence of AccessDenied on CreateTags from the CSI driver role

Jira: https://issues.redhat.com/browse/SREP-3817

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dustman9000

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• resources/sts/OWNERS [dustman9000]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment