aws: use new LB controller to fix SecurityGroup cleanup on K8s service deletion (#2090)

* add current chart

add current helm chart

* disable service controller for aws ccm

* add new iam roles

* doc AWS internet LB + add to LB test

* pass clusterName to helm for AWS LB

* fix update-aws-lb chart to also include .helmignore

* move chart outside services

* working state

* add subnet tags for AWS subnet discovery

* fix .helmignore load rule with file in subdirectory

* upgrade iam profile

* revert new loader impl since cilium is not correctly loaded

* install chart if not already present during `upgrade apply`

* cleanup PR + fix build + add todos

cleanup PR + add todos

* shared helm pkg for cli install and bootstrapper

* add link to eks docs

* refactor iamMigrationCmd

* delete unused helm.symwallk

* move iammigrate to upgrade pkg

* fixup! delete unused helm.symwallk

* add to upgradecheck

* remove nodeSelector from go code (Otto)

* update iam docs and sort permission + remove duplicate roles

* fix bug in `upgrade check`

* better upgrade check output when svc version upgrade not possible

* pr feedback

* remove force flag in upgrade_test

* use upgrader.GetUpgradeID instead of extra type

* remove todos + fix check

* update doc lb (leo)

* remove bootstrapper helm package

* Update cli/internal/cmd/upgradecheck.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* final nits

* add docs for e2e upgrade test setup

* Apply suggestions from code review

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update cli/internal/helm/loader.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* Update cli/internal/cmd/tfmigrationclient.go

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>

* fix daniel review

* link to the iam permissions instead of manually updating them (agreed with leo)

* disable iam upgrade in upgrade apply

---------

Co-authored-by: Daniel Weiße <66256922+daniel-weisse@users.noreply.github.com>
Co-authored-by: Malte Poll

cli/internal/upgrade/iammigrate_test.go

@@ -0,0 +1,112 @@
+/*
+Copyright (c) Edgeless Systems GmbH
+
+SPDX-License-Identifier: AGPL-3.0-only
+*/
+
+package upgrade
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"path/filepath"
+	"testing"
+
+	"github.com/edgelesssys/constellation/v2/cli/internal/terraform"
+	"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
+	"github.com/edgelesssys/constellation/v2/internal/constants"
+	"github.com/edgelesssys/constellation/v2/internal/file"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIAMMigrate(t *testing.T) {
+	upgradeID := "test-upgrade"
+	upgradeDir := filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformIAMUpgradeWorkingDir)
+	fs, file := setupMemFSAndFileHandler(t, []string{"terraform.tfvars", "terraform.tfstate"}, []byte("OLD"))
+	// act
+	fakeTfClient := &tfClientStub{upgradeID, file}
+	sut := &IAMMigrateCmd{fakeTfClient, upgradeID, cloudprovider.AWS, terraform.LogLevelDebug}
+	hasDiff, err := sut.Plan(context.Background(), file, bytes.NewBuffer(nil))
+	// assert
+	assert.NoError(t, err)
+	assert.False(t, hasDiff)
+	assertFileExists(fs, filepath.Join(upgradeDir, "terraform.tfvars"), t)
+	assertFileExists(fs, filepath.Join(upgradeDir, "terraform.tfstate"), t)
+
+	// act
+	err = sut.Apply(context.Background(), file)
+	assert.NoError(t, err)
+	// assert
+	assertFileReadsContent(file, filepath.Join(constants.TerraformIAMWorkingDir, "terraform.tfvars"), "NEW", t)
+	assertFileReadsContent(file, filepath.Join(constants.TerraformIAMWorkingDir, "terraform.tfstate"), "NEW", t)
+	assertFileDoesntExist(fs, filepath.Join(upgradeDir), t)
+}
+
+func assertFileReadsContent(file file.Handler, path string, expectedContent string, t *testing.T) {
+	bt, err := file.Read(path)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedContent, string(bt))
+}
+
+func assertFileExists(fs afero.Fs, path string, t *testing.T) {
+	res, err := fs.Stat(path)
+	assert.NoError(t, err)
+	assert.NotNil(t, res)
+}
+
+func assertFileDoesntExist(fs afero.Fs, path string, t *testing.T) {
+	res, err := fs.Stat(path)
+	assert.Error(t, err)
+	assert.Nil(t, res)
+}
+
+// setupMemFSAndFileHandler sets up a file handler with a memory file system and writes the given files with the given content.
+func setupMemFSAndFileHandler(t *testing.T, files []string, content []byte) (afero.Fs, file.Handler) {
+	fs := afero.NewMemMapFs()
+	file := file.NewHandler(fs)
+	err := file.MkdirAll(constants.TerraformIAMWorkingDir)
+	require.NoError(t, err)
+
+	for _, f := range files {
+		err := file.Write(filepath.Join(constants.TerraformIAMWorkingDir, f), content)
+		require.NoError(t, err)
+	}
+	return fs, file
+}
+
+type tfClientStub struct {
+	upgradeID string
+	file      file.Handler
+}
+
+func (t *tfClientStub) Plan(_ context.Context, _ terraform.LogLevel, _ string) (bool, error) {
+	return false, nil
+}
+
+func (t *tfClientStub) ShowPlan(_ context.Context, _ terraform.LogLevel, _ string, _ io.Writer) error {
+	return nil
+}
+
+func (t *tfClientStub) ApplyIAMConfig(_ context.Context, _ cloudprovider.Provider, _ terraform.LogLevel) (terraform.IAMOutput, error) {
+	upgradeDir := filepath.Join(constants.UpgradeDir, t.upgradeID, constants.TerraformIAMUpgradeWorkingDir)
+	err := t.file.Remove(filepath.Join(upgradeDir, "terraform.tfvars"))
+	if err != nil {
+		return terraform.IAMOutput{}, err
+	}
+	err = t.file.Write(filepath.Join(upgradeDir, "terraform.tfvars"), []byte("NEW"))
+	if err != nil {
+		return terraform.IAMOutput{}, err
+	}
+	err = t.file.Remove(filepath.Join(upgradeDir, "terraform.tfstate"))
+	if err != nil {
+		return terraform.IAMOutput{}, err
+	}
+	err = t.file.Write(filepath.Join(upgradeDir, "terraform.tfstate"), []byte("NEW"))
+	if err != nil {
+		return terraform.IAMOutput{}, err
+	}
+	return terraform.IAMOutput{}, nil
+}