<p>I have RBAC enabled kubernetes cluster created using 
kops version <strong>1.8.0-beta.1</strong>, I am trying to run a nginx pod which should attach pre-created EBS volume and pod should start. But getting issue as not authorized even though i am a <strong>admin</strong> user. Any help would be highly appreciated. </p>

<pre><code>kubectl version Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.3", GitCommit:"f0efb3cb883751c5ffdbe6d515f3cb4fbe7b7acd", GitTreeState:"clean", BuildDate:"2017-11-09T07:27:47Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.3", GitCommit:"f0efb3cb883751c5ffdbe6d515f3cb4fbe7b7acd", GitTreeState:"clean", BuildDate:"2017-11-08T18:27:48Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

namespace:default
</code></pre>

<p>cat test-ebs.yml    </p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-ebs
spec:
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /test-ebs
      name: test-volume
  volumes:
  - name: test-volume
    awsElasticBlockStore:
      volumeID: &lt;vol-IDhere&gt;
      fsType: ext4
</code></pre>

<p>I am getting the below error: </p>

<pre><code>Warning  FailedMount            8m               attachdetach                                        AttachVolume.Attach failed for volume "test-volume" : Error attaching EBS volume "&lt;vol-ID&gt;" to instance "&lt;i-instanceID&gt;": "UnauthorizedOperation: You are not authorized to perform this operation
</code></pre>

<p>In kops 1.8.0-beta.1, master node requires you to tag the AWS volume with:</p>

<p><code>KubernetesCluster: &lt;clustername-here&gt;</code></p>

<p>If you have created the k8s cluster using kops like so:</p>

<p><code>kops create cluster --name=k8s.yourdomain.com [other-args-here]</code></p>

<p>your tag on the EBS volume needs to be </p>

<p><code>KubernetesCluster: k8s.yourdomain.com</code> </p>

<p>And the policy on master would contain a block which would contain:
</p>

<pre><code>{
  "Sid": "kopsK8sEC2MasterPermsTaggedResources",
  "Effect": "Allow",
  "Action": [
    "ec2:AttachVolume",
    "ec2:AuthorizeSecurityGroupIngress",
    "ec2:DeleteRoute",
    "ec2:DeleteSecurityGroup",
    "ec2:DeleteVolume",
    "ec2:DetachVolume",
    "ec2:RevokeSecurityGroupIngress"
  ],
  "Resource": [
    "*"
  ],
  "Condition": {
    "StringEquals": {
      "ec2:ResourceTag/KubernetesCluster": "k8s.yourdomain.com"
    }
  }
}
</code></pre>

<p>The condition indicates that master-policy has privilege to only attach volumes which contain the right tag.</p>
