anchor.diff: -= Kubernetes Applying IAM Roles
  += IAM Roles with Kubernetes
   :toc:
  -
  -Out of the box, Kubernetes supports 2 types of roles: a master IAM role and a node IAM role.
  +:imagesdir: ../images
  +
  +AWS uses Identity and Access Management (IAM) roles to manage authentication and authorization for AWS Services.  An IAM role is an IAM entity that defines a set of permissions for making AWS service requests. For more information about IAM, please see link:https://aws.amazon.com/iam/details/[here].
  +
  +Out of the box, Kubernetes supports two types of roles: a master IAM role and a node IAM role.
   
   In addition, the 3rd party plugin https://github.com/jtblin/kube2iam[kube2iam] can be configured to apply IAM roles at the pod level.
   
  -This excerise will walk you through configuring both concepts.
  -
  -== Pre-requisites
  -
  -A 3 master nodes and 5 worker nodes cluster as explained at link:../cluster-install#multi-master-multi-node-multi-az-gossip-based-cluster[] is used for this chapter.
  +This exercise will walk you through configuring both concepts.
  +
  +== Prerequisites
  +
  +This chapter uses a cluster with 3 master nodes and 5 worker nodes as described here: link:../cluster-install#multi-master-multi-node-multi-az-gossip-based-cluster[multi-master, multi-node gossip based cluster].
   
   All configuration files for this chapter are in the `roles` directory.
   
  -== IAM Master / Node Roles
  -
  -Out of the box, when deploying Kubernetes on AWS, master nodes require a number of EC2, Elastic Load Balancer (ELB), EC2 Container Registry (ECR), Route53 and KMS policies applied. The worker nodes require a number of EC2, ECR and Route53 policies applied.  If using `kops` to install, these will be auotmatically configured for you (see https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md[here] for a full list).
  -
  -These policies may be augmented via kops.  For example, to allow all nodes ElasticSearch access, perform the following steps:
  +== IAM Master and Node Roles
  +
  +Out of the box, when deploying Kubernetes on AWS, master nodes require a number of EC2, Elastic Load Balancer (ELB), EC2 Container Registry (ECR), Route53, and Key Management Service (KMS) policies applied. The worker nodes require a number of EC2, ECR, and Route53 policies applied.  If using `kops` to install, these will be auotmatically configured for you (see link:https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md[here] for a full list).
  +
  +These policies may be augmented via `kops`.  For example, to allow all nodes ElasticSearch access, perform the following steps:
   
   Edit your cluster using the command:
   
  -  kops edit cluster example.cluster.k8s.local
  +  $ kops edit cluster example.cluster.k8s.local
   
   Add the following to the `spec`:
   
  
positive.code: 
  . Edit your cluster using the command:
  
    kops edit cluster example.cluster.k8s.local
  
  . Update the `spec` to allow STS to assume roles:
  
  
negative.code: 
  We will first create a role with no permissions.  By configuring the Trusted Policy of the role, we are allowing kube2iam (via the worker node IAM Instance Profile Role) to assume the pod role.  Make note of the role ARN from the response:
  
    $ aws iam create-role \
      --role-name MyPodRole \
      --assume-role-policy-document \
      file://templates/pod-role-trust-policy.json
  