kube-aws: add ECR policies to IAMRoleWorker

coreos · May 22, 2016 · 592beb5 · 592beb5
1 parent f4f6d3a
commit 592beb5
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/multi-node/aws/pkg/config/templates/stack-template.json b/multi-node/aws/pkg/config/templates/stack-template.json
@@ -222,6 +222,19 @@
                   "Action" : "kms:Decrypt",
                   "Effect" : "Allow",
                   "Resource" : "{{.KMSKeyARN}}"
+                },
+                {
+                  "Action": [
+                    "ecr:GetAuthorizationToken",
+                    "ecr:BatchCheckLayerAvailability",
+                    "ecr:GetDownloadUrlForLayer",
+                    "ecr:GetRepositoryPolicy",
+                    "ecr:DescribeRepositories",
+                    "ecr:ListImages",
+                    "ecr:BatchGetImage"
+                  ],
+                  "Resource": "*",
+                  "Effect": "Allow"
                 }
               ],
               "Version": "2012-10-17"