Enable EKS API auth mode by default

[larryl3u]

Summary

• Adds an access_config block to aws_eks_cluster in terraform-modules/movement-validator-infra/eks.tf.
• Adds a new variable cluster_authentication_mode with a default of API_AND_CONFIG_MAP and validation against the three legal values.

Why

With the current default (CONFIG_MAP), cluster access is gated only by the in-cluster kube-system/aws-auth ConfigMap. Editing that requires existing cluster admin, which creates a chicken-and-egg dependency on whoever first ran terraform apply. This has blocked teammates with full AWS IAM permissions (e.g. for deploying the observability stack) from accessing clusters they should already be able to manage.

Switching to API_AND_CONFIG_MAP:

• Keeps existing aws-auth mappings working (backward compatible)
• Lets teammates with the eks:CreateAccessEntry IAM permission grant access via AWS Access Entries — no in-cluster edit, no dependency on the original creator
• Is the AWS-recommended modern default

What changes for existing clusters

On terraform apply, EKS performs an in-place update of the cluster's accessConfig. No node disruption, no pod restarts. Existing pods, services, NLBs all keep running.

Caveats

• EKS auth-mode transitions are one-way: CONFIG_MAP → API_AND_CONFIG_MAP → API. You can move forward but never back. API_AND_CONFIG_MAP is chosen as the default because it preserves existing aws-auth mappings.
• The bootstrap_cluster_creator_admin_permissions = true keeps the historical behavior: the IAM principal that runs terraform apply initially gets system:masters.

Test plan

• Run terraform plan against an existing cluster (one of testnet-v2-vn-XX-cluster in mi:testnet) — confirm in-place update diff only, no replacement
• Run terraform apply on one cluster, confirm aws eks describe-cluster --query cluster.accessConfig.authenticationMode returns API_AND_CONFIG_MAP
• Verify existing aws-auth mappings still work (kubectl get pods from current admin)
• Verify a new teammate can be granted access via aws eks create-access-entry + associate-access-policy and successfully kubectl get pods

🤖 Generated with Claude Code

[nicholasflintwillow]

Looks good to me!