CNTRLPLANE-1388: Spot with termination handler - #7567

In
`@control-plane-operator/controllers/hostedcontrolplane/v2/awsnodeterminationhandler/secret.go`:
- Around line 11-29: adaptCredentialsSecret can panic if HCP AWS spec or
RolesRef.NodePoolManagementARN is nil/empty; add a defensive guard at the start
of adaptCredentialsSecret to validate hcp.Spec.Platform != nil,
hcp.Spec.Platform.AWS != nil and that
hcp.Spec.Platform.AWS.RolesRef.NodePoolManagementARN is non-empty, and return a
clear error (not panic) if the ARN is missing; update usage in
adaptCredentialsSecret (referencing hcp and roleARN) to only proceed building
the awsCredentialsTemplate when the checks pass.

In `@hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go`:
- Around line 4317-4338: The code in isAWSNodeTerminationHandlerNeeded currently
treats any presence of the annotation "hypershift.openshift.io/enable-spot" as
enabling spot handling; change the check to validate the annotation value (e.g.,
use strconv.ParseBool or compare to "true") so only truthy values enable the
handler. In the loop over nodePools in isAWSNodeTerminationHandlerNeeded, fetch
nodePool.Annotations["hypershift.openshift.io/enable-spot"], parse it with
strconv.ParseBool (or normalize and compare to "true"), and only return true
when parsing succeeds and yields true; keep using listNodePools and preserve
existing error handling. Ensure nil annotations are handled safely.

In `@hypershift-operator/controllers/nodepool/capi_test.go`:
- Around line 1740-1744: The test contains a redundant conditional where
expectedTemplateName is initialized to awsMachineTemplateName and then set to
the same value inside the if block using isSpotEnabled(tt.nodePool); remove the
redundant branch or implement the intended alternative value for spot instances.
Update the test by deleting the if block that assigns expectedTemplateName =
awsMachineTemplateName (or replace it with the correct template name for spot
instances), keeping the final assertion
g.Expect(templateList.Items[0].GetName()).To(Equal(expectedTemplateName))
unchanged; reference symbols: expectedTemplateName, awsMachineTemplateName,
isSpotEnabled, tt.nodePool, templateList.Items.

In `@test/e2e/nodepool_spot_termination_handler_test.go`:
- Around line 114-126: The SQS IAM policy constructed in the sqsPolicy string
currently uses a wildcard ARN ("arn:aws:sqs:%s:*:*") granting
ReceiveMessage/DeleteMessage to all queues in the region; change this to target
only the test queue by building the exact queue ARN (or URL-derived ARN) instead
of using the wildcard: obtain the queue name or URL (e.g., via the code that
creates/looks up the queue) and combine it with the AWS account ID and
s.clusterOpts.AWSPlatform.Region to produce the specific ARN, then replace the
Resource value in sqsPolicy with that specific ARN so only the intended queue is
allowed.
- Around line 286-293: The HostedCluster annotation removal must be registered
with defer so it always runs even if the test fails; move the
e2eutil.UpdateObject call that deletes AnnotationTerminationHandlerQueueURL
earlier (immediately after you set or assert the annotation exists) and wrap it
in a defer closure that calls e2eutil.UpdateObject(t, s.ctx, s.mgmtClient,
s.hostedCluster, func(obj *hyperv1.HostedCluster) { delete(obj.Annotations,
AnnotationTerminationHandlerQueueURL) }); then remove the explicit cleanup block
currently in Step 7 so you don't run the same removal twice.

In
`@control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml`:
- Around line 84-86: The fixture is missing the AWS_REGION env var value causing
SQS client MissingRegion; update the deployment fixture so the AWS_REGION
environment variable is populated with the AWS region consistent with QUEUE_URL
(us-east-1). Edit the test YAML where the env list contains the AWS_REGION entry
(in the aws-node-termination-handler deployment fixture) and set its value to
"us-east-1" to mirror how awsnodeterminationhandler/deployment.go pulls
hcp.Spec.Platform.AWS.Region, ensuring the rendered deployment matches the
controller logic.

In
`@hypershift-operator/controllers/hostedcluster/hostedcluster_controller_test.go`:
- Around line 5327-5328: Replace the hardcoded annotation key
"hypershift.openshift.io/enable-spot" in the test Annotations maps with the
existing constant nodepool.AnnotationEnableSpot; add the appropriate import for
the nodepool package (use an import alias if needed) and update all test
occurrences where that string is used so they reference
nodepool.AnnotationEnableSpot instead.