pluto: add regional map of pause container source accounts

[tjkirch]

This allows us to handle regions where EKS keeps the container in a different account.

---

The map code is based on Matt's work in schnauzer.

Testing done:

test test_pause_container_account::url_af_south_1 ... ok
test test_pause_container_account::url_fallback ... ok
test test_pause_container_account::url_eu_west_1 ... ok

Made an AMI, ran a pod in us-west-2 OK, and ran a pod in af-south-1 OK.

Before, I saw this in af-south-1, and the instance didn't register with EKS: (the end got snipped, sorry)

not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:af-south-1:602401143452:repository/eks/pause-amd64

After, the pause container pulls OK (and the instance worked with EKS):

level=info msg="Pulled successfully" img="ecr.aws/arn:aws:ecr:af-south-1:877085696533:repository/eks/pause-amd64:3.1"

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[webern]

Looks good.

[zmrow]

👻