feat: Add optional list of policy ARNs for attachment to Karpenter IRSA

[Constantin07]

Description

This PR addresses the issue (feature request) reported in #2535

Motivation and Context

It adds possibility to attach a custom IAM policy ARN (with access to CMK KMS) to Karpenter IRSA.
At the moment this is not possible. The only way is to add a KMS usage policy to the KMS resource which is inconvenient in our case because it's managed by other team.
We would like to attach a custom IAM policy to the principal, i.e. Karpenter IRSA.

Resolves #2535
Resolves #2540

Breaking Changes

No.

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
  Note: I cannot add an existing managed IAM policy ARN for CMK KMS because Amazon doesn't provide one I could simply reference in examples.
• I have tested and validated these changes using one or more of the provided examples/* projects

• I have executed pre-commit run -a on my pull request

Ran the terraform plan referencing my fork branch with one CMK KMS policy ARN:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.karpenter.aws_iam_role_policy_attachment.irsa_additional["0"] will be created
  + resource "aws_iam_role_policy_attachment" "irsa_additional" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::**************:policy/project-eu-west-1-dev1-core-kms-eks-ebs-user"
      + role       = "project-dev1-karpenter-irsa"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

[Constantin07]

Hi @bryantbiggs not sure you are the right person to ask for but could you please review this PR please ?

[bryantbiggs]

Thank you for the addition!

[antonbabenko]

This PR is included in version 19.11.0 🎉

[joshuabaird]

Thanks for the fix! I was just about to start working on this!

[joshuabaird]

@bryantbiggs Is it no longer a recommendation to create one Fargate profile per AZ as noted here?

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.