Extend cross-account discovery for EKS clusters

[tigrato]

This PR adds support for cross-account EKS auto-discovery. It only adds support for discovery, serving Kube cluster still requires one kube service per AWS account.

Database Access: #22866

[nklaassen]

It only adds support for discovery, serving Kube cluster still requires one kube service per AWS account.

I'm curious what is the purpose if you still need a kube service per account, couldn't that kube service discover its own local clusters?

[tigrato]

It only adds support for discovery, serving Kube cluster still requires one kube service per AWS account.

I'm curious what is the purpose if you still need a kube service per account, couldn't that kube service discover its own local clusters?

@nklaassen

Kubernetes discovery does not happen on the kubernetes agent.

Teleport 10 introduced discovery_service for EC2 discovery and the product team decided to move all discoveries into this new service.

The discovery service scans the cloud providers and creates kube_cluster objects. The agents watch them and serve.

The kube agent will support multi AWS accounts but we are waiting on product decision/rfd to extend discovery (importing rules) and eventually allow decoupling of discovery and agents permissions (the current database implementation requires that discovery_service and database_service must run with the same IAM role).

[public-teleport-github-review-bot]

@tigrato See the table below for backport results.

Branch	Result
branch/v13	Create PR

[nklaassen]

Ahhh thank you, makes sense