{{- if eq .Values.platform "aws" }}
# Controller role for consistency, similar to kubeadm admin.conf
apiVersion: iamauthenticator.k8s.aws/v1alpha1
kind: IAMIdentityMapping
metadata:
  name: kubezero-worker-nodes
spec:
  arn: {{ .Values.workerNodeRole }}
  username: system:node:{{ "{{" }}EC2PrivateDNSName{{ "}}" }}
  groups:
  # For now use masters, define properly with 1.20
  - system:masters
  - system:nodes
  - system:bootstrappers
---
# Admin Role for remote access
apiVersion: iamauthenticator.k8s.aws/v1alpha1
kind: IAMIdentityMapping
metadata:
  name: kubernetes-admin
spec:
  arn: {{ .Values.kubeAdminRole }}
  username: kubernetes-admin
  groups:
  - system:masters
{{- end }}