anchor.diff:  
   To govern what roles a pod can assume, you can use the `iam.amazonaws.com/allowed-roles` namespace annotation.  For example, the following will only allow pods to assume our MyPodRole:
   
  -----
  -apiVersion: v1
  -kind: Namespace
  -metadata:
  -  annotations:
  -    iam.amazonaws.com/allowed-roles: |
  -      ["arn:aws:iam::123456789012:role/MyPodRole"]
  -  name: default
  -----+  apiVersion: v1
  +  kind: Namespace
  +  metadata:
  +    annotations:
  +      iam.amazonaws.com/allowed-roles: |
  +        ["arn:aws:iam::<account-id>:role/MyPodRole"]
  +    name: default
  
positive.code:           "Resource": ["*"]
          }
        ]
  ----
  
  
  == IAM Container Roles
  
  https://github.com/jtblin/kube2iam[kube2iam], once configured, will provide the opportunity of configuring a role per pod.
  
  Kube2iam works by intercepting traffic from the containers to the EC2 Metadata API, calling the AWS STS API to obtain temporary credentials using the pod configured role, then using these temporary credentials to perform the original request.
  
  === Install kube2iam
  
  The following steps describe how to configure kube2iam:
  
  Edit your cluster via `kops edit cluster ${CLUSTER_NAME}` and add the following to the spec to allow STS to assume roles:
  
  ----
    additionalPolicies:
      node: |
        [
  
negative.code:           "Resource": ["*"]
          }
        ]
  
  Update the cluster for changes to take effect:
  
    kops update cluster ${CLUSTER_NAME} --yes
  
  In a similar fashion, policies may be applied to all masters by setting the `additionalPolicies.master` property as below:
  
    additionalPolicies:
      master: |
        [
  