anchor.diff:        }
     }
   
  +=== Configure IAM Role on a Pod
  +
   `iam.amazonaws.com/role` annotation on the pod is used to assign an IAM role to a pod. Let's set this annotation on our pod. The `templates/aws-cli-po.yaml` file looks like:
   
     apiVersion: v1
  
positive.code: +
  Note that the `kube2iam-ds.yaml` is assuming that your network configuration is based on `kubenet`, which is also the default kops configuration. If you have changed this as part of another exercise (e.g. switched to Calico) you will need to change the value of the `--host-interface` arg in the configuration file. For example, set to `cal+` if using Calico.
  
  === Configure IAM Role on a Pod
  
  We need the IAM Role ARN assigned to the worker nodes.  We will need this as part of creating pod roles.  We can obtain this by running the following command:
  
  
negative.code: 
  These policies may be augmented via kops.  For example, to allow all nodes ElasticSearch access, perform the following steps:
  
  Edit your cluster using the command:
  
    kops edit cluster cluster.k8s.local
  
  Add the following to the `spec`:
  
    additionalPolicies:
      node: |
  