feat,fix: eks vault iam permissions,eks autoscaler iam role,

[jokestax]

Description

This PR -
1) Narrow down permissions for vault iam role
2) Add role for cluster-autoscaler service account
3) fix: variable gpu in Civo gitlab
4) fix: add service account annotation for kubefirst-pro-api
5) update vault image to v1.14.1 refer

How to test

/path/to/kubefirst aws create
--alerts-email
--github-org
--cluster-name
--domain-name
--gitops-template-branch eks-autoscaler

[muse-sisay]

Hi @jokestax,

After our call I dug deeper into why we needed to attach two more polices (in this commit) to the default node group instance profile for Vault to unseal. There was a problem with vault 1.14.0 (the version we use) refer here where it wasn't honoring AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variable and fell back to the instance profile. Hence the reason we were getting the following error while vault was starting up

Error initializing storage of type dynamodb: AccessDeniedException: User: 
arn:aws:sts::<account_id>:assumed-role/default_node_group-eks-node-
group-2024000000000000000000001/i-<instance_id> is not authorized to perform: 
dynamodb:DescribeTable on resource: arn:aws:dynamodb:us-east-1:<account_id>:table/vault-
backend-<cluster_name> because no identity-based policy allows the dynamodb:DescribeTable action 
status code: 400, request id: <request_id>

This was fixed in 1.14.1 as per the issue linked above. But, the Vault role we create has a very permissive permission set 😱.

I see you have added two permission policy with narrowed down scope (aws_iam_policy.vault_dynamodb and aws_iam_policy.vault_kms) that we can use instead of these two AWS managed policies. I would would also try to scope it down to just the resources we create.

  role_policy_arns = {
    dynamo = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
    kms    = "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser",
    vault  = aws_iam_policy.vault_server.arn,
  }

Good work Rishi!

[jokestax]

@muse-sisay ohh but i cant find a vault helm chart where it installs 1.14.1 ;-;