Don't add control-plane DNS permissions with UseServiceAccountIAM

[justinsb]

Should not be needed; dns-controller should run on the control-plane
node so there should not be a bootstrapping problem with the nodes.

Reverts #10529

[justinsb]

cc @rifelpet

I'm not quite sure what happened before; dns-controller should have had permissions to set up the DNS names, and it should run on the control-plane.

[justinsb]

/assign @rifelpet

I think you have the best context here!

[rifelpet]

I'm wondering if this would cause issues when enabling UseServiceAccountIAM on an existing cluster. kops update cluster --yes would immediately revoke the IAM permissions that dns-controller relies on, and then eventually dns-controller gets redeployed with the service account and the AWS_WEB_IDENTITY_TOKEN_FILE env var. During the time between those, DNS records won't be getting updated and this would likely be during cluster maintenance in which control plane instances are getting replaced and records need changing.

Do you think this is significant enough of an issue to warrant addressing?

[olemarkus]

I made the same change as part of #11088

If you run single-node CP and you roll the CP node, dns-controller is gone anyway.
If you run three-node CP and you roll a CP node, channels on one of the remaining nodes will update dns-controller long before the new node has booted. So I think this fairly safe.

[rifelpet]

Makes sense 👍🏻

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment