docs: Steps to summarize all the options available in CAPA for the credentials to be used when we pivot to management cluster #3510
Description
To summarize all the options we have to go forward with when we pivot to management cluster so that we can document it together:
- To create a dedicated IAM user for the controller which will be long lived credentials. We can create a bootstrap user in CAPA. These credentials are the ones that need to be encoded.
- To use short lived credentials for the kind cluster only and then pivot into the new management cluster using IRSA for CAPA.(applicable for EKS)
- To use short lived credentials for the kind cluster only and then use one of the “multi-tenancy” types for any future workload clusters created from your new management cluster.
- To use the role attached to management cluster instances by zeroing the secret bootstrap cluster used after moving the mgmt cluster to AWS, this can be done by using clusterawsadm or manually setting the secret data to nil. This is already covered in PR docs: Using IAM roles instead of AWS credentials in management cluster #3328
- To use PodIdentity webhooks.(applicable for EKS)
Originally posted by @Ankitasw in #3328 (comment)