feat (operator): add support for IRSA (aws resources access)

[tcondeixa]

Changes

Add irsa_role_arn config field to enable IRSA (IAM Roles for Service Accounts) as an alternative to kube2iam.

Setting irsa_role_arn to a full IAM role ARN annotates the pod ServiceAccount with eks.amazonaws.com/role-arn, which causes the EKS mutating webhook to inject an OIDC web identity token volume into new pods. The AWS SDK credential chain prefers this token over the EC2 metadata endpoint (kube2iam), so IRSA takes effect immediately on the next pod rotation.

Zero-downtime migration: running pods are not patched in-place — the kube2iam annotation (iam.amazonaws.com/role) drains naturally as pods rotate. Both kube_iam_role and irsa_role_arn can be set simultaneously during migration. Once all pods have rotated, kube_iam_role can be removed. The operator logs migration progress on every reconcile.

Fix date to use POSIX format and auto-detect gsed when available, so make works on macOS.

Test

• Update operator without irsa_role_arn set — existing DBs unaffected, no SA annotation changes
• Update operator with irsa_role_arn set and kube_iam_role kept — SA annotated immediately, new pods get IRSA token volume, existing pods keep kube2iam until rotated
• Update operator with only irsa_role_arn (single deploy, no kube_iam_role) — one rotation produces clean pod with IRSA only
• Create new DB with irsa_role_arn set — pod starts with IRSA from day one
• Operator logs "IRSA migration complete" after all pods have rotated

[FxKu]

can you move syncPodServiceAccount into the sync.go file for now so we have it all in one place? In general, it's a good idea to split the code into single files per K8s resource type, but lets do that in a separate PR.

[tcondeixa]

move sa sync code to existing sync.go file to be all together

sure, I moved it to the existing sync.go file in d150b92

[FxKu]

The new option still needs to be documented: https://github.com/zalando/postgres-operator/blob/master/docs/reference/operator_parameters.md#aws-or-gcp-interaction

And added to the values.yaml file of the helm chart.

And the example config CRD as well as https://github.com/zalando/postgres-operator/blob/master/manifests/configmap.yaml

[tcondeixa]

I addressed all the feedback and I updated all the markdown files (even the administrator.md), so please check again @mikkeloscar @FxKu

[mikkeloscar]

@tcondeixa build is failing

[tcondeixa]

@tcondeixa build is failing

sorry, it was a network issues with vendor the module. After a retry in the pipeline the build is working.
I see the github actions failed for the operator-e2e-test, I will check if it's something I introduced or if we have flaky tests.

[mikkeloscar]

👍

[FxKu]

👍