Add utils command to migrate iamidentitymappings to EKS access entries

[punkwalker]

Description

Adds command eksctl utils migrate-to-access-entry which allows to migrate Non-Managed IAMIdentitymappings to Access Entries. #7700

The command will perform following actions:

• Switch Authentication Mode to API_AND_CONFIG_MAP which will trigger Access Entry creation for EKS Managed IAMIdentitymappings such as Managed Node Group, Fargate, Cluster Creator.
• After successful Authentication Mode update, identify new access entries to create by comparing the current IAMIdentitymappings and existing Access Entries
• Create Access Entries for identified entries
• If all the IAMIdentitymappings are migrated to Access Entries successfully, Switch the Authentication Mode to API if target-authentication-mode=API
• After successful Authentication Mode update to API, delete aws-auth configMap as it is not required.

Running the command without the --approve flag will only output a plan consisting of a set of tasks reflecting the steps above, e.g.

[!]  at least one group name associated with arn:aws:iam::1234567891111:role/Admin starts with "system", can not create access entry with such group name, skipping
[ℹ]  4 new access entries will be created
[!]  one or more identitymapping could not be migrated to access entry, will not update authentication mode to API
[ℹ]  (plan) 
2 sequential tasks: { update authentication mode to API_AND_CONFIG_MAP, 
    4 parallel sub-tasks: { 
        create access entry for principal ARN arn:aws:iam::1234567891111:role/eksctl-linux-windows-nodegroup-ng-NodeInstanceRole-ZCGJHSOH8FNK,
        create access entry for principal ARN arn:aws:iam::1234567891111:role/stack-NodeInstanceRole-KVRKIFKTZ2GQ,
        create access entry for principal ARN arn:aws:iam::1234567891111:role/aws-service-role/batch.amazonaws.com/AWSServiceRoleForBatch,
        create access entry for principal ARN arn:aws:iam::1234567891111:role/nodeGroupRole,
    } 
}
[ℹ]  all tasks were skipped
[!]  no changes were applied, run again with '--approve' to apply the changes

Additionally, command performs following check before creating Access Entries. If any one of the check fails, it will not update Authentication mode to API. (Applicable only when: --target-authentication-mode API)

• There is no Account IAMIdentitymapping
• No Role/User has kubernetes name which begins with system:
• No IAMIdentitymapping for Service Linked Role

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the userdocs directory)
• Manually tested
• Made sure the title of the PR is a good description that can go into the release notes
• (Core team) Added labels for change area (e.g. area/nodegroup) and kind (e.g. kind/improvement)

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

• Backfilled missing tests for code in same general area 🎉
• Refactored something and made the world a better place 🌟

[github-actions]

Hello punkwalker 👋 Thank you for opening a Pull Request in eksctl project. The team will review the Pull Request and aim to respond within 1-10 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website

[cPu1]

This is very thorough! I have left some comments for minor changes but otherwise it mostly LGTM.

Thanks for the great contribution 🎉 .

[cPu1]

One of the access entry tests is failing on the latest commit:

• [PANICKED] [0.001 seconds]
Migrate Access Entry Migrate [It] [API Error] Authentication mode update fails
/home/runner/work/eksctl/eksctl/pkg/actions/accessentry/migrator_test.go:106

  [PANICKED] Test Panicked
  In [It] at: /home/runner/go/pkg/mod/github.com/stretchr/testify@v1.9.0/mock/mock.go:335 @ 04/22/24 13:42:49.468

  
  assert: mock: I don't know what to return because the method call was unexpected.
  	Either do Mock.On("ListAccessEntries").Return(...) first, or remove the ListAccessEntries() call.
  	This method was unexpected:
  		ListAccessEntries(context.backgroundCtx,*eks.ListAccessEntriesInput)
  		0: context.backgroundCtx{emptyCtx:context.emptyCtx{}}
  		1: &eks.ListAccessEntriesInput{ClusterName:(*string)(0xc000679860), AssociatedPolicyArn:(*string)(nil), MaxResults:(*int32)(nil), NextToken:(*string)(nil), noSmithyDocumentSerde:document.NoSerde{}}
  	at: [/home/runner/work/eksctl/eksctl/pkg/eks/mocksv2/EKS.go:1210 /home/runner/work/eksctl/eksctl/pkg/actions/accessentry/getter.go:36 /home/runner/work/eksctl/eksctl/pkg/actions/accessentry/migrator.go:167 /home/runner/work/eksctl/eksctl/pkg/actions/accessentry/migrator.go:90 /home/runner/work/eksctl/eksctl/pkg/actions/accessentry/migrator_test.go:94 /opt/hostedtoolcache/go/1.21.9/x64/src/reflect/value.go:596 /opt/hostedtoolcache/go/1.21.9/x64/src/reflect/value.go:380 /home/runner/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.17.1/table_dsl.go:335 /home/runner/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.17.1/table_dsl.go:299 /home/runner/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.17.1/internal/node.go:472 /home/runner/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.17.1/internal/suite.go:889 /opt/hostedtoolcache/go/1.21.9/x64/src/runtime/asm_amd64.s:1650]

The EKS mock needs to have ListAccessEntries defined.

[joebowbeer]

Thoughts re. #7930 ?