aws: use new LB controller to fix SecurityGroup cleanup on K8s service deletion (#2090)

* add current chart

add current helm chart

* disable service controller for aws ccm

* add new iam roles

* doc AWS internet LB + add to LB test

* pass clusterName to helm for AWS LB

* fix update-aws-lb chart to also include .helmignore

* move chart outside services

* working state

* add subnet tags for AWS subnet discovery

* fix .helmignore load rule with file in subdirectory

* upgrade iam profile

* revert new loader impl since cilium is not correctly loaded

* install chart if not already present during `upgrade apply`

* cleanup PR + fix build + add todos

cleanup PR + add todos

* shared helm pkg for cli install and bootstrapper

* add link to eks docs

* refactor iamMigrationCmd

* delete unused helm.symwallk

* move iammigrate to upgrade pkg

* fixup! delete unused helm.symwallk

* add to upgradecheck

* remove nodeSelector from go code (Otto)

* update iam docs and sort permission + remove duplicate roles

* fix bug in `upgrade check`

* better upgrade check output when svc version upgrade not possible

* pr feedback

* remove force flag in upgrade_test

* use upgrader.GetUpgradeID instead of extra type

* remove todos + fix check

* update doc lb (leo)

* remove bootstrapper helm package

* Update cli/internal/cmd/upgradecheck.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* final nits

* add docs for e2e upgrade test setup

* Apply suggestions from code review

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update cli/internal/helm/loader.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update cli/internal/cmd/tfmigrationclient.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* fix daniel review

* link to the iam permissions instead of manually updating them (agreed with leo)

* disable iam upgrade in upgrade apply

---------

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Malte Poll

cli/internal/upgrade/iammigrate.go

@@ -0,0 +1,112 @@
+/*
+Copyright (c) Edgeless Systems GmbH
+
+SPDX-License-Identifier: AGPL-3.0-only
+*/
+
+package upgrade
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+
+	"github.com/edgelesssys/constellation/v2/cli/internal/terraform"
+	"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
+	"github.com/edgelesssys/constellation/v2/internal/constants"
+	"github.com/edgelesssys/constellation/v2/internal/file"
+)
+
+// TfMigrationCmd is an interface for all terraform upgrade / migration commands.
+type TfMigrationCmd interface {
+	CheckTerraformMigrations(file file.Handler) error
+	Plan(ctx context.Context, file file.Handler, outWriter io.Writer) (bool, error)
+	Apply(ctx context.Context, fileHandler file.Handler) error
+	String() string
+	UpgradeID() string
+}
+
+// IAMMigrateCmd is a terraform migration command for IAM.
+type IAMMigrateCmd struct {
+	tf        tfIAMClient
+	upgradeID string
+	csp       cloudprovider.Provider
+	logLevel  terraform.LogLevel
+}
+
+// NewIAMMigrateCmd creates a new IAMMigrateCmd.
+func NewIAMMigrateCmd(ctx context.Context, upgradeID string, csp cloudprovider.Provider, logLevel terraform.LogLevel) (*IAMMigrateCmd, error) {
+	tfClient, err := terraform.New(ctx, filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformIAMUpgradeWorkingDir))
+	if err != nil {
+		return nil, fmt.Errorf("setting up terraform client: %w", err)
+	}
+	return &IAMMigrateCmd{
+		tf:        tfClient,
+		upgradeID: upgradeID,
+		csp:       csp,
+		logLevel:  logLevel,
+	}, nil
+}
+
+// String returns the name of the command.
+func (c *IAMMigrateCmd) String() string {
+	return "iam migration"
+}
+
+// UpgradeID returns the upgrade ID.
+func (c *IAMMigrateCmd) UpgradeID() string {
+	return c.upgradeID
+}
+
+// CheckTerraformMigrations checks whether Terraform migrations are possible in the current workspace.
+func (c *IAMMigrateCmd) CheckTerraformMigrations(file file.Handler) error {
+	return checkTerraformMigrations(file, c.upgradeID, constants.TerraformIAMUpgradeBackupDir)
+}
+
+// Plan prepares the upgrade workspace and plans the Terraform migrations for the Constellation upgrade, writing the plan to the outWriter.
+func (c *IAMMigrateCmd) Plan(ctx context.Context, file file.Handler, outWriter io.Writer) (bool, error) {
+	templateDir := filepath.Join("terraform", "iam", strings.ToLower(c.csp.String()))
+	if err := terraform.PrepareIAMUpgradeWorkspace(file,
+		templateDir,
+		constants.TerraformIAMWorkingDir,
+		filepath.Join(constants.UpgradeDir, c.upgradeID, constants.TerraformIAMUpgradeWorkingDir),
+		filepath.Join(constants.UpgradeDir, c.upgradeID, constants.TerraformIAMUpgradeBackupDir),
+	); err != nil {
+		return false, fmt.Errorf("preparing terraform workspace: %w", err)
+	}
+
+	hasDiff, err := c.tf.Plan(ctx, c.logLevel, constants.TerraformUpgradePlanFile)
+	if err != nil {
+		return false, fmt.Errorf("terraform plan: %w", err)
+	}
+
+	if hasDiff {
+		if err := c.tf.ShowPlan(ctx, c.logLevel, constants.TerraformUpgradePlanFile, outWriter); err != nil {
+			return false, fmt.Errorf("terraform show plan: %w", err)
+		}
+	}
+
+	return hasDiff, nil
+}
+
+// Apply applies the Terraform IAM migrations for the Constellation upgrade.
+func (c *IAMMigrateCmd) Apply(ctx context.Context, fileHandler file.Handler) error {
+	if _, err := c.tf.ApplyIAMConfig(ctx, c.csp, c.logLevel); err != nil {
+		return fmt.Errorf("terraform apply: %w", err)
+	}
+
+	if err := fileHandler.RemoveAll(constants.TerraformIAMWorkingDir); err != nil {
+		return fmt.Errorf("removing old terraform directory: %w", err)
+	}
+	if err := fileHandler.CopyDir(filepath.Join(constants.UpgradeDir, c.upgradeID, constants.TerraformIAMUpgradeWorkingDir), constants.TerraformIAMWorkingDir); err != nil {
+		return fmt.Errorf("replacing old terraform directory with new one: %w", err)
+	}
+
+	if err := fileHandler.RemoveAll(filepath.Join(constants.UpgradeDir, c.upgradeID, constants.TerraformIAMUpgradeWorkingDir)); err != nil {
+		return fmt.Errorf("removing terraform upgrade directory: %w", err)
+	}
+
+	return nil
+}