Document how to use IAM roles instead of the credentials CAPA started with

[sedefsavas]

/kind documentation

We need documentation for the steps on how to make CAPA use the instance profiles (IAM roles) attached to a ec2 instance.

A possible scenario for CAPA-managed clusters:

• Init bootstrap cluster with temporary credentials
• Create a workload cluster
• Control plane nodes on the workload cluster will have IAM roles attached which is enough for CAPA to work.
• Want to move the bootstrap cluster to this workload cluster to turn it to a management cluster
• Since only control-plane nodes have the required IAM roles attached, CAPA deployment should have the necessary tolerations for master (control-plane) node and node selector for master. To modify the CAPA deployment before running clusterctl init, check cluster api book.
• Run clusterctl init --infrastructure aws on the workload cluster by setting export AWS_B64ENCODED_CREDENTIALS="Cg==" (equivalent to empty string)
• capa-manager-bootstrap-credentials will be created as using AWS_B64ENCODED_CREDENTIALS which is nil, hence CAPA controllers will fall back to use the attached instance profile.

We should also cover how to do the same in EKS-managed clusters.

More details are in slack thread:

[k8s-ci-robot]

@sedefsavas: This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Ankitasw]

/assign

[Ankitasw]

/lifecycle active