AWSManagedCluster should support granting additional IAM roles access to the EKS cluster

[rudoi]

/kind feature

Describe the solution you'd like

By default, only the IAM entity that has access to an EKS cluster is the entity that created it. Additional IAM roles must be added manually using an aws-auth ConfigMap in the kube-system namespace.

It would be great if we could specify additional roles (maybe users, too?) in the spec and have that ConfigMap be set up automatically.

Anything else you would like to add:

Find information about the format of the auth configuration here: https://github.com/kubernetes-sigs/aws-iam-authenticator#full-configuration-format

[richardcase]

/assign
/lifecycle active

[richardcase]

@rudoi - do you think we'd want to also support aws-iam-authenticator on the unmanaged side of the provider?

[rudoi]

Hmmm how do you mean?

[richardcase]

Hmmm how do you mean?

I was thinking for people that install it and use it with an ec2 based cluster instead of eks. Probably best wait for that until someone asks for it. Will just add it to the managed side for now.

[randomvariable]

Yeah, I'd rather not force it, and it's one of the key benefits of the ec2 model is not being forced down the aws-iam-authenticator route and being able to use something like Dex & OIDC instead. It's pretty important for multi-cloud deploys.