anchor.diff:  +
   Note that the `kube2iam-ds.yaml` is assuming that your network configuration is based on `kubenet`, which is also the default kops configuration. If you have changed this as part of another exercise (e.g. switched to Calico) you will need to change the value of the `--host-interface` arg in the configuration file. For example, set to `cal+` if using Calico.
   
  -=== IAM Roles for Worker Nodes
  +=== IAM Roles for worker nodes
   
   It is necessary to create an IAM role which can assume other roles and assign it to each kubernetes worker.
   
  
positive.code: 
  AWS uses Identity and Access Management (IAM) roles to manage authentication and authorization for AWS Services.  An IAM role is an IAM entity that defines a set of permissions for making AWS service requests. For more information about IAM, please see link:https://aws.amazon.com/iam/details/[here].
  
  Out of the box, Kubernetes supports two types of roles: a master IAM role and a node IAM role.
  
  In addition, the 3rd party plugin https://github.com/jtblin/kube2iam[kube2iam] can be configured to apply IAM roles at the pod level.
  
  This exercise will walk you through configuring both concepts.
  
  == Prerequisites
  
  
negative.code:     namespace "default" configured
  
  From now on, pods in the default namespace will only be able to optain the `MyPodRole`.
  
  