feat: kube2iam/kiam/kube-aws-iam-controller support

[mumoshu]

As described in https://github.com/weaveworks/eksctl/pull/381/files#r245498323, a feature that eases deploying kube2iam/kiam/kube-aws-iam-controller would be good to have.

Adding a flag like --assume-role-access alone is an incomplete solution to the problem, because making apps like kube2iam also requires you to set correct trust-relationship(or assume role policy document) to the roles "assumed by" the instance role.

Adding a feature to eksctl that modifies assumed roles seems overkill and out-of-scope of the project.

Instead, I propose either of the belows:

1. A flag like --instance-role that accepts an existing instance role arn. Also, an eksctl command that produces a cfn stack template containing the default eksctl instance role helps.
2. Add --assume-role-access or --instance-role-policy-arns, and improve eksctl get nodegroup to print the nodegroup info containing the instance role arn, in a data format helps integration with other tools. JSON would work.

[mumoshu]

The third possible solution would be to add --assume-role-access/--node-role-policy-arns and --node-role-name. --node-role-name specifies the name of the node role created by eksctl. This is not for reusing an existing role, but used for specifying the exact name of the role to be created by eksctl.

As the role name is now known beforehand, you can establish trust relationship containing the role name before creating the cluster, which simplifies the setup when you use kube2iam/kiam/kube-aws-iam-controller.

The implementation can be done in cfn stack templates by setting RoleName for IAMRole resources, like kube-aws do.

[mumoshu]

--assume-role-access MAY become unnecessary after AWS ships the official pod IAM role support (aws/containers-roadmap#23 ETA though).

--node-role-policy-arns has a wider range of use-cases like giving whatever IAM permissions to pods not depending on kube-2iam, like hostNetwork pods.

Then, it may make more sense to add --node-role-policy-arns along with --node-role-name for maximum productivity :)

[mumoshu]

Submitted a pull request for this #411.

This is slightly off-topic but I'm pretty sure that you can use --node-role-polilcies solely, without deploying kube2iam, when and only when you don't do multi-tenant.

This isn't perfect but still allows you to provide your pods minimum privilege, without needs to deploy and operate an AWS IAM integration of your choice.