permissions related to AWS ECR

Question

I just created a cluster on AWS using kops and my nodes already have those permissions that were needed.

$ kops version
Version 1.8.0 (git-5099bc5)

$ kubectl version    
Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.1", GitCommit:"f38e43b221d08850172a9a4ea785a86a3ffa3b3a", GitTreeState:"clean", BuildDate:"2017-10-11T23:27:35Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.4", GitCommit:"9befc2b8928a9426501d3bf

Is this normal?

Answer 1

if you add allowContainerRegistry: true, kops will add those permissions to the automatically created IAM Role.