New 0.6.5 EKS cluster with new awsclustercontrolleridentities is having issues with capa-eks-control-plane-controller-manager

[martin-ducar-gd]

/kind bug

What steps did you take and what happened:

clusterctl init -i aws -c kubeadm:v0.3.14,aws-eks -b kubeadm:v0.3.14,aws-eks --core cluster-api:v0.3.14

than deploy cluster with setup:

---
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha3
kind: AWSClusterControllerIdentity
metadata:
  name: "default"
spec:
  allowedNamespaces: {} 
---
apiVersion: cluster.x-k8s.io/v1alpha3
kind: Cluster
metadata:
  name: "mgmt01"
spec:
  clusterNetwork:
    pods:
      cidrBlocks: ["192.168.0.0/16"]
  infrastructureRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1alpha3
    kind: AWSManagedCluster
    name: "mgmt01"
  controlPlaneRef:
    kind: AWSManagedControlPlane
    apiVersion: controlplane.cluster.x-k8s.io/v1alpha3
    name: "mgmt01-control-plane"
---
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha3
kind: AWSManagedCluster
metadata:
  name: "mgmt01"
---
kind: AWSManagedControlPlane
apiVersion: controlplane.cluster.x-k8s.io/v1alpha3
metadata:
  name: "mgmt01-control-plane"
spec:
  region: "us-east-1"
  sshKeyName: "capi-management"
  version: "v1.19.8"
  identityRef:
    kind: AWSClusterControllerIdentity
    name: default

in log of capa-eks-control-plane-controller-manager

$ kubectl logs -c manager -n capa-eks-control-plane-system       capa-eks-control-plane-controller-manager-<hash>
...
E0419 12:35:48.487128       1 reflector.go:153] pkg/mod/k8s.io/client-go@v0.17.9/tools/cache/reflector.go:105: Failed to list *v1alpha3.AWSClusterControllerIdentity: awsclustercontrolleridentities.infrastructure.cluster.x-k8s.io is forbidden: User "system:serviceaccount:capa-eks-control-plane-system:capa-eks-control-plane-controller-manager" cannot list resource "awsclustercontrolleridentities" in API group "infrastructure.cluster.x-k8s.io" at the cluster scope
...

What did you expect to happen:
Cluster to spin up

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

Environment:

• Cluster-api-provider-aws version: 0.6.5
• Kubernetes version: (use kubectl version): 1.20.2
• OS (e.g. from /etc/os-release):

NAME="Ubuntu"
VERSION="20.04.2 LTS (Focal Fossa)"

[martin-ducar-gd]

clusterctl install output:

Installing Provider="cluster-api" Version="v0.3.14" TargetNamespace="capi-system"
Installing Provider="bootstrap-kubeadm" Version="v0.3.14" TargetNamespace="capi-kubeadm-bootstrap-system"
Installing Provider="bootstrap-aws-eks" Version="v0.6.5" TargetNamespace="capa-eks-bootstrap-system"
Installing Provider="control-plane-kubeadm" Version="v0.3.14" TargetNamespace="capi-kubeadm-control-plane-system"
Installing Provider="control-plane-aws-eks" Version="v0.6.5" TargetNamespace="capa-eks-control-plane-system"
Installing Provider="infrastructure-aws" Version="v0.6.5" TargetNamespace="capa-system"

[richardcase]

/help
/good-first-issue

[k8s-ci-robot]

@richardcase:
This request has been marked as suitable for new contributors.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-good-first-issue command.

In response to this:

/area eks/provider
/help
/good-first-issue

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

@richardcase: The label(s) area/eks/provider cannot be applied, because the repository doesn't have them.

In response to this:

/area eks/provider
/help
/good-first-issue

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[richardcase]

/area provider/eks

[richardcase]

The rbac declaration appears to have been missed:
https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/controlplane/eks/controllers/awsmanagedcontrolplane_controller.go#L113

[richardcase]

/priority important-soon

[richardcase]

/milestone v0.7.0

[randomvariable]

Should we backport this one?

[richardcase]

/assign martin-ducar-gd
/lifecycle active

[richardcase]

Should we backport this one?

Yes i think we should backport.

[randomvariable]

/kind backport