svcop: Support for IAM Roles for EKS Service Accounts

[Krenair]

Creates Principal objects for ServiceAccounts labelled with the access group label, and updates the ServiceAccount with the appropriate annotation.

[chrisfarms]

can we get some squashing + nicer commit messages please if this is ready for review 🙏 😄

[Krenair]

Is it possible I was supposed to update config/rbac/role-not-patch.yaml instead of add that kubebuilder:rbac comment earlier?

[chrisfarms]

I am unable to run the full integration tests (hack/test_integration) since it looks like the RDS security group is invalid.

I suspect this is because we have assumed it more static than it really is... I'm testing with fetching it by name now. we may want to tweak it as per following diff to make it more stable...

diff --git a/components/service-operator/hack/test_integration.sh b/components/service-operator/hack/test_integration.sh
index 33072475..545d637d 100755
--- a/components/service-operator/hack/test_integration.sh
+++ b/components/service-operator/hack/test_integration.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
 AWS_ACCOUNT_ID="$(aws sts get-caller-identity | jq -r .Account)"
+AWS_RDS_SECURITY_GROUP_ID=$(aws ec2 describe-security-groups | jq -r '.SecurityGroups[] | select(.GroupName == "sandbox_rds_from_worker") | .GroupId')
 
 docker build \
 	--network host \
@@ -8,7 +9,7 @@ docker build \
 	--build-arg AWS_ACCESS_KEY_ID \
 	--build-arg AWS_SECRET_ACCESS_KEY \
 	--build-arg AWS_SESSION_TOKEN \
-	--build-arg AWS_RDS_SECURITY_GROUP_ID=sg-04521d05ba3d9edb5 \
+	--build-arg AWS_RDS_SECURITY_GROUP_ID=$AWS_RDS_SECURITY_GROUP_ID \
 	--build-arg AWS_RDS_SUBNET_GROUP_NAME=sandbox-private \
 	--build-arg AWS_PRINCIPAL_PERMISSIONS_BOUNDARY_ARN=arn:aws:iam::${AWS_ACCOUNT_ID}:policy/sandbox-service-operator-managed-role-permissions-boundary \
 	--build-arg AWS_PRINCIPAL_SERVER_ROLE_ARN=arn:aws:iam::${AWS_ACCOUNT_ID}:role/sandbox_kiam_server \

[Krenair]

Sounds like we should make a PR to fix hack/test_integration @chrisfarms ?

[chrisfarms]

Sounds like we should make a PR to fix hack/test_integration @chrisfarms ?

yes, I'll make it after this is merged (since I already have the fix stashed)