Summary

Add IRSA (IAM Role for Service Accounts) support for the Cluster Autoscaler in the eks-nbs module. The autoscaler Helm chart was previously deployed on dev71 without IAM permissions — the ServiceAccount had no role annotation, so it couldn't call AWS APIs to scale nodes.

Changes

• irsa.tf — New cluster_autoscaler_irsa_role module and cluster_autoscaler_irsa_policy IAM policy with tag-scoped autoscaling permissions
• variables.tf — New create_cluster_autoscaler_irsa (bool) and cluster_autoscaler_cluster_name (string) variables, both defaulting to off so existing environments are unaffected
• outputs.tf — New cluster_autoscaler_irsa_role_arn output

IAM Policy Details

• Describe actions (DescribeAutoScalingGroups, DescribeTags, DescribeInstanceTypes, eks:DescribeNodegroup, etc.) use Resource: "*" as these APIs don't support resource-level restrictions
• Scale actions (SetDesiredCapacity, TerminateInstanceInAutoScalingGroup) are scoped via k8s.io/cluster-autoscaler tag-based IAM conditions per upstream Cluster Autoscaler best practices
• SonarCloud Resource: "*" findings reviewed and safe to dismiss

Validation

• Tested end-to-end on nbs7-dev2-eks
• Applied Terraform — created IRSA role and policy
• Deployed Cluster Autoscaler via helm install with --set for the SA annotation
• Confirmed SA annotated with role ARN
• Autoscaler logs show successful ASG discovery, no AccessDenied errors, scale-down evaluation running on all nodes
• Chart version: cluster-autoscaler-9.58.0