Add support for pod identity associations accross accounts

[naclonts]

Description

Add support for setting up cross-account resource access with pod identity.

Manual testing

Set up the roles and policies in the blog post.

Then create the cluster with eksctl:

# Use the example template from eksctl docs. Adjust clusterName, region, and account IDs.
% cat << EOF > cluster.yaml 
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: my-cluster
  region: us-west-2
  version: "1.32"

addons:
  - name: vpc-cni
  - name: coredns
  - name: kube-proxy
  - name: eks-pod-identity-agent

iam:
  podIdentityAssociations:
  - namespace: default
    serviceAccountName: demo-app-sa
    createServiceAccount: true
    roleARN: arn:aws:iam::1111111111:role/account-a-role
    targetRoleARN: arn:aws:iam::2222222222:role/account-b-role
    disableSessionTags: false

managedNodeGroups:
  - name: my-cluster
    instanceType: m6a.large
    privateNetworking: true
    minSize: 2
    desiredCapacity: 2
    maxSize: 3
EOF

# Create the cluster
% ./eksctl create cluster -f cluster.yaml

And check access:

% kubectl run awscli \
  --image=amazon/aws-cli:latest \
  --restart=Never \
  --command \
  --overrides='{ "spec": { "serviceAccountName": "demo-app-sa" }}' \
  -- sleep infinity

% kubectl exec awscli -- /bin/bash -c "aws sts get-caller-identity"
{
    "UserId": "...",
    "Account": "1111111111",
    "Arn": "arn:aws:sts::2222222222:assumed-role/account-b-role/my-cluster..."
}

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the userdocs directory)
• Manually tested
• Made sure the title of the PR is a good description that can go into the release notes
• (Core team) Added labels for change area (e.g. area/nodegroup) and kind (e.g. kind/improvement)

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

• Backfilled missing tests for code in same general area 🎉
• Refactored something and made the world a better place 🌟