Add iam identityMappings to config file

[errordeveloper]

We have commands for managing IAM identity mapping now, and config file can be used as input, but we don't yet support definitions of the identity mappings in the config file itself.

I thing this would be the most suitable way to expose it:

iam:
  identityMapping: ...

At the I'm not sure about how the array/map itself should look like.

We would probably want to keen nodegroups out of the picture for now, i.e. what we do automatically at the moment, can remain invisible at the level of config file. Users who want to manage node IAM roles along with --update-auth-configmap=false, should be able to do it and use config file to set authenticate their nodegroup roles.

[martina-if]

Should it be a map? or perhaps an array of mappings?

[errordeveloper]

@martina-if yes, good point - I've updated the description to reflect what is currently understood about this :)

[andreamaruccia]

how is this related to #841 ?

[neelakansha85]

+1 to this feature.

This will make it a lot easier instead of having separate aws-auth.yaml config file and applying it to the cluster after cluster creation to having all config in declarative form.

[jvosantos]

upvote upvote upvote

[pierresteiner]

Upvote as well!

[martina-if]

see also #967

[muram]

+1, any update on when this feature might be considered for implementation?

[aclevername]

@muram this is currently being worked on, feedback/thoughts are welcome 😄 #3097

[aclevername]

Closing. We are expecting an new API from AWS to handle cluster permissions, so we could implement this feature but it would likely be replaced very soon by this new API. I think it makes sense to halt any new development on iamidentitymappings functionality

[adammw]

the iamidentitymappings is the eksctl feature exposing the identity mapping used by aws-iam-authenticator, no? therefore the feature to add it to the config file should remain even if the underlying implementation would need to change...

I also note that aws-iam-authenticator now supports configuration via a IAMIdentityMappings CRD which should free up some of the use cases suggested..