feat: configurable AWS Load Balancer Controller IRSA namespace/SA subjects

[obezpalko]

User description

What

Adds aws_load_balancer_controller_namespace_service_accounts (list of <ns>:<sa> OIDC subjects) to the ALB controller IRSA role, defaulting to the current ["kube-system:aws-load-balancer-controller"] (backward-compatible). Replaces the previously hardcoded subject in modules/comet_eks/main.tf. Threaded root → comet_eks, mirroring the external-secrets change (#60).

Why

Prerequisite for folding the AWS Load Balancer Controller into the comet-infra umbrella (comet-system namespace). The IRSA trust is a StringEquals exact-match on the SA subject, so moving the controller's SA breaks AWS auth unless the trust allows the new subject.

During migration the caller lists both subjects for a zero-gap cutover. Note: the umbrella runs the controller with default (release-prefixed) naming — so the new SA is comet-infra-aws-load-balancer-controller (chosen over fullnameOverride to avoid a ClusterRole name-collision with the standalone app during the overlap). The dual-subject list is therefore:

aws_load_balancer_controller_namespace_service_accounts = [
  "kube-system:aws-load-balancer-controller",                # standalone app (current)
  "comet-system:comet-infra-aws-load-balancer-controller",   # umbrella (new, release-prefixed SA)
]

then a follow-up trims to just the umbrella subject.

Impact

Default unchanged → no diff for any existing cluster until a caller sets the new variable. Suggested release: v5.4.0.

Note: main.tf shows alignment churn from terraform fmt (the long variable name widened the = alignment of the module.comet_eks block). The only functional change is the single new pass-through line — confirm with git diff -w.

🤖 Generated with Claude Code

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Configure AWS Load Balancer Controller IRSA trust through aws_load_balancer_controller_namespace_service_accounts, passing it from the root module into comet_eks while preserving the existing default. Document the required ServiceAccount subject and validate namespace/name entries to support zero-gap migration to the comet-infra umbrella.

Topic	Details
Configurable IRSA trust	Allow callers to configure exact OIDC-trusted ServiceAccount subjects for the AWS Load Balancer Controller, including simultaneous standalone and umbrella subjects during migration while retaining backward compatibility. Modified files (4) main.tf modules/comet_eks/main.tf modules/comet_eks/variables.tf variables.tf Latest Contributors(2) User Commit Date alexb@comet.com fix(baz): validate IRS... August 11, 2026 CRThaze Merge pull request #52... July 29, 2026
IRSA usage guidance	Clarify that the controller ServiceAccount must match the configured IRSA subject and explain the default and umbrella naming expectations. Modified files (2) modules/comet_eks/outputs.tf outputs.tf Latest Contributors(2) User Commit Date alexb@comet.com fix(baz): validate IRS... August 11, 2026 jms200 v1.17.1 hotfix: escape... June 02, 2026

_{Review this PR on Baz | Customize your next review}