fix: Insufficient permissions for karpenter policy when not using karpenter discovery tags on security group

[apamildner]

Fixes an issue where the policy was not sufficient if you use security group ids in the Karpenter AWSNodeTemplate instead of relying on discovery tags. Then the security groups weren't tagged, which led to insufficient permissions for Karpenter to launch the node.

Description

Removes the need for the security group to be tagged with the Karpenter discovery tag
for Karpenter to be able to use it when launching an instance.

Motivation and Context

• Resolves Insufficient permissions when using karpenter irsa without discovery tags #295

If we create an AWSNodeTemplate like this:

apiVersion: karpenter.k8s.aws/v1alpha1
kind: AWSNodeTemplate
metadata:
  name: default
spec:
  subnetSelector:
    aws-ids: subnet-abc,subnet-xyz
  securityGroupSelector:
    aws-ids: sg-abc,sg-xyz
  tags:
    karpenter.sh/discovery/foo-cluster: foo-cluster

which is perfectly valid according to Karpenter docs, we will not
be able to use the module policy as is, since the security group we are referring to doesn't have the correct discovery tag (since we don't want to use discovery tags).

The change here changes the policy such that this constraint is relaxed. This makes the security group part of the policy behave like the subnet part, which wasn't dependent on the tag being present.

Breaking Changes

No breaking changes, just a little bit more permissive policy.

How Has This Been Tested?

• I have tested and validated these changes using one or more of the provided examples/* projects
• I have executed pre-commit run -a on my pull request
• I have updated the policy manually and verified in karpenter

[bryantbiggs]

change looks good - we'll get the tflint warnings fixed first #296 and then merge this to keep the CI green

[antonbabenko]

This PR is included in version 5.5.4 🎉

[apamildner]

Thanks for the quick response on mr PR's! Much appreciated 🥳

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.