Add support for EKS pod identities

[flostadler]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

EKS pod identities simplify assigning IAM permissions to Kubernetes workloads. Previously users had to create OIDC providers and use IRSA (IAM Roles for Service Accounts) to map an IAM principal to a kubernetes workload. This requires crafting rather complex assume role permissions (see).

EKS pod identities simplify this and additionally allow using a single role across multiple clusters & regions.

To add support for pod identities we need to ensure the instance role has permissions for the agent to do the AssumeRoleForPodIdentity action in the EKS Auth API and then deploy the eks-pod-identity-agent addon if the user configures it (e.g. enablePodIdentities).

Affected area/feature

• EKS Cluster
• Authentication