Updated iam role docs to cover kiam/kube2iam
## Prerequisites
-To be able to specify the IAM role that the management components should run as your cluster must be set up with [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
+To be able to specify the IAM role that the management components should run as your cluster must be set up with the ability to assume IAM roles using one of the following solutions:
+
+* [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)
+* [Kiam](https://github.com/uswitch/kiam)
+* [Kube2iam](https://github.com/jtblin/kube2iam)
## Setting IAM Role
@@ -18,6 +22,8 @@ clusterctl init --infrastructure=aws
## IAM Role Trust Policy
+### IAM Roles for Service Accounts
+
When creating the IAM role the following trust policy will need to be used with the `AWS_ACCOUNT_ID`, `AWS_REGION` and `OIDC_PROVIDER_ID` environment variables replaced.
```json
@@ -45,3 +51,31 @@ When creating the IAM role the following trust policy will need to be used with
]
}
```
+
+### Kiam / kube2iam
+
+When creating the IAM role the you will need to give apply the `kubernetes.io/cluster/${CLUSTER_NAME}/role": "enabled"` tag to the role and use the following trust policy with the `AWS_ACCOUNT_ID` and `CLUSTER_NAME` environment variables correctly replaced.
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "",
+ "Effect": "Allow",
+ "Principal": {
+ "Service": "ec2.amazonaws.com"
+ },
+ "Action": "sts:AssumeRole"
+ },
+ {
+ "Sid": "",
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/${CLUSTER_NAME}.worker-node-role"
+ },
+ "Action": "sts:AssumeRole"
+ }
+ ]
+}
+```
