someword

[ec2-user@ip-10-52-26-160 ~]$ aws sts assume-role --role-arn=arn:aws:iam::XXXXXXXXXXXXX:role/kiam-pod-test-role --role-session-name test9
{
    "AssumedRoleUser": {
        "AssumedRoleId": "XXXXXXXXXXXXXXXXXXXX:test9",
        "Arn": "arn:aws:sts::XXXXXXXXXXXXXXXXXX:assumed-role/kiam-pod-test-role/test9"
    },
    "Credentials": {
        "SecretAccessKey": "XXXXXXXXXXXXXXXXXXXXXXXXXX",
        "SessionToken": "XXXXXXXXXXXXXXXX///////////wEaDMvhdnnYjlHLaROoJSLpAULGH/quc+aOMfHlXFsCxP5O5Uyqlb1dN4zi/IOCwS/AB9n6QJ3mY6y0q5KRrXcooLxRiL4eDi8uYwyQtJuocdamLYgsmStjUH56o5j+8B7HaQ1HPGmOkXIaAMm+TvBX7IB1zQ21wLrshujrMxEaIohkoeHk+uyeSMxNVZdh+rswzcxsH/YQbopNFJjj83LCVyCVJy+DVJ6pSg+ScS/ZCGWU0AzsvKlbrJj7ymietwtfj+UEmgBCpv4ZLqdGJIQMuuEw8XDjipKyHtoVJHfywNYFrjbhpLTkCwzJAFc4G0mySFhOBSCKUKpZKL3qy9wF",
        "Expiration": "2018-09-07T23:01:33Z",

someword

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: node-drain
rules:
  - apiGroups:
      - extensions
    resources:
      - daemonsets

someword

package authorization

import data.k8s.matches

deny[{
	"id": "user-kube-system",
	"resource": {
		"namespace": namespace,
	},
	"resolution": {"message": "Permission denied"},