Auto accept for AWS based registration

[jaswalkiranavtar]

Describe the enhancement
Currently the AutoApproval feature for CSR registration has a feature auto-approve based on the username in CSR.

However there is no CSR in the picture for AWS registration, so we want to propose following for AWS registration:

1. Add a new field called autoAcceptEKSClusters to registrationConfiguration.registrationDrivers under clustermanager.
2. This will be array type as we can pass list of EKS cluster ARN patterns e.g. arn:aws:eks:us-west-2:123456789012:cluster/*
3. Then in managedcluster controller, we only approve the ManagedCluster whose ARN matches with one of the patterns in autoAcceptEKSClusters, if ManagedClusterAutoApproval feature gate is enabled. The ManagedCluster ARN can be retrieved from annotation on ManagedCluster CR.

This will allow hub admin to restrict which trusted clusters they want to autoapprove based on the clusterARN. Please advise if this idea sounds ok to you before we implement anything.
cc: @mikeshng @qiujian16 @zhiweiyin318

[qiujian16]

cc @skeeey

I wonder what this ARN represents. could we have a more general concept of it? Having a field in API stating EKS is a bit vendor specific, and we should try to avoid that.

[jaswalkiranavtar]

It stands for Amazon Resources Name. I think it is used to unique identity an EKS cluster in a customer's aws account.

Sure we can remove word EKS, does autoAcceptClusterARNPatterns sound ok?

[skeeey]

How about we enhance the autoApproveUsers to autoApproveIdentities , it may like

autoApproveIdentities:
- identityType: ARNPattern
   value: arn:aws:eks:us-west-2:123456789012:cluster/*
- identityType: CSRUser
   value: user1

[jaswalkiranavtar]

Please note that ARN is unique id or name of the EKS cluster, it is not a principle of any subject. It might not fit as an identity which is like an id of a principle.

[qiujian16]

I think it is could be represented as the identity of a managed cluster, or a pattern of the identity. e.g. arn:aws:eks:us-west-2:123456789012:cluster is a certain pattern for a certain registration driver. So I would think there should be something similar as @skeeey suggests

approvedIdentities
- driver: CSR
   identities:
   - user1
   - user2
- driver: AWS
   identities:
   - arn:aws:eks:us-west-2:123456789012:cluster/*

[jaswalkiranavtar]

To be clear, we are talking about replacing existing autoApproveUsers field in clustermanager with new field called approvedIdentities correct?

[qiujian16]

yes, I think so, we can not directly deprecate the existing field, the two have to exist for a time period. And we can deprecate the old one finally.