Enable IRSA by default for AWS users (kubeflow#1328)

surajkota · Jun 26, 2020 · 240e6de · 240e6de
1 parent 2ae115d
commit 240e6de
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 8 deletions.
diff --git a/kfdef/kfctl_aws.yaml b/kfdef/kfctl_aws.yaml
@@ -429,8 +429,10 @@ spec:
           password: 12341234
           username: admin@kubeflow.org
       region: us-west-2
-      roles:
-      - eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxxxx
+      enablePodIamPolicy: true
+      # If you don't use IAM Role for Service Account, you can still use node instance roles.
+      #roles:
+      #- eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxxxx
   repos:
   - name: manifests
     uri: https://github.com/kubeflow/manifests/archive/master.tar.gz

diff --git a/kfdef/kfctl_aws_cognito.yaml b/kfdef/kfctl_aws_cognito.yaml
@@ -412,8 +412,10 @@ spec:
           cognitoUserPoolArn: arn:aws:cognito-idp:us-west-2:xxxxx:userpool/us-west-2_xxxxxx
           cognitoUserPoolDomain: your-user-pool
       region: us-west-2
-      roles:
-      - eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxx
+      enablePodIamPolicy: true
+      # If you don't use IAM Role for Service Account, you can still use node instance roles.
+      #roles:
+      #- eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxxxx
   repos:
   - name: manifests
     uri: https://github.com/kubeflow/manifests/archive/master.tar.gz

diff --git a/kfdef/source/master/kfctl_aws.yaml b/kfdef/source/master/kfctl_aws.yaml
@@ -429,8 +429,10 @@ spec:
           password: 12341234
           username: admin@kubeflow.org
       region: us-west-2
-      roles:
-      - eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxxxx
+      enablePodIamPolicy: true
+      # If you don't use IAM Role for Service Account, you can still use node instance roles.
+      #roles:
+      #- eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxxxx
   repos:
   - name: manifests
     uri: https://github.com/kubeflow/manifests/archive/master.tar.gz

diff --git a/kfdef/source/master/kfctl_aws_cognito.yaml b/kfdef/source/master/kfctl_aws_cognito.yaml
@@ -412,8 +412,10 @@ spec:
           cognitoUserPoolArn: arn:aws:cognito-idp:us-west-2:xxxxx:userpool/us-west-2_xxxxxx
           cognitoUserPoolDomain: your-user-pool
       region: us-west-2
-      roles:
-      - eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxx
+      enablePodIamPolicy: true
+      # If you don't use IAM Role for Service Account, you can still use node instance roles.
+      #roles:
+      #- eksctl-kubeflow-aws-nodegroup-ng-a2-NodeInstanceRole-xxxxxxx
   repos:
   - name: manifests
     uri: https://github.com/kubeflow/manifests/archive/master.tar.gz