feat: support IAMRoleSelector

Author: michaelhtm

templates/config/controller/deployment.yaml.tpl

@@ -43,6 +43,7 @@ spec:
         - "$(RECONCILE_DEFAULT_MAX_CONCURRENT_SYNCS)"
         - --feature-gates
         - "$(FEATURE_GATES)"
+        - --enable-carm=$(ENABLE_CARM)
         image: controller:latest
         name: controller
         ports:
@@ -80,6 +81,8 @@ spec:
           value: "1"
         - name: "FEATURE_GATES"
           value: ""
+        - name: "ENABLE_CARM"
+          value: "true"
         securityContext:
           allowPrivilegeEscalation: false
           privileged: false

templates/helm/values.yaml.tpl

@@ -183,4 +183,6 @@ featureGates:
   # Enable ReadOnlyResources feature/annotation. 
   ReadOnlyResources: true
   # Enable ResourceAdoption feature/annotation. 
-  ResourceAdoption: true
+  ResourceAdoption: true
+  # Enable IAMRoleSelector, a multirole feature, replacing CARM. See https://github.com/aws-controllers-k8s/community/pull/2628
+  IAMRoleSelector: false

templates/pkg/resource/registry.go.tpl

@@ -7,8 +7,8 @@ import (
 	acktypes "github.com/aws-controllers-k8s/runtime/pkg/types"
 )
 
-// +kubebuilder:rbac:groups=services.k8s.aws,resources=adoptedresources,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=services.k8s.aws,resources=adoptedresources/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=services.k8s.aws,resources=iamroleselectors,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=services.k8s.aws,resources=iamroleselectors/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=services.k8s.aws,resources=fieldexports,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=services.k8s.aws,resources=fieldexports/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch