node drain

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: node-drain
rules:
  - apiGroups:
      - extensions
    resources:
      - daemonsets
    verbs:
      - get
      - list
  - apiGroups:
      - apps
    resources:
      - daemonsets
    verbs:
      - get
      - list
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes/status
    verbs:
      - patch


---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: node-drain
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: node-drain
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: node-drain

Update config map like

mapRoles: |
- rolearn: {{.NodeRoleArn}}
username: system:node:{{{{EC2PrivateDNSName}}}}
groups:
- system:bootstrappers
- system:nodes
- node-drain