From de48fd2c178c44c783765f5da0a3ab529b34fe58 Mon Sep 17 00:00:00 2001
From: Stefan Reimer <stefan@zero-downtime.net>
Date: Fri, 18 Sep 2020 16:20:45 +0100
Subject: [PATCH] Add kube-system ns annotate to boot flow

---
 deploy/deploy.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 87bc4125..40e31218 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -62,6 +62,9 @@ EOF
     kubectl wait --for=condition=Ready -n kube-system Issuer/kubezero-local-ca-issuer
   fi
 
+  # Make sure kube-system is allowed to kiam
+  kubectl annotate --overwrite namespace kube-system 'iam.amazonaws.com/permitted=.*'
+
   # Now that we have the cert-manager webhook, get the kiam certs in place but do NOT deploy kiam yet
   helm template $DEPLOY_DIR -f values.yaml -f cloudbender.yaml -f $DEPLOY_DIR/values-step-3.yaml > generated-values.yaml
   helm upgrade -n argocd kubezero kubezero/kubezero-argo-cd -f generated-values.yaml