roadmap: declarative AWS test credentials via a devantler-tech/aws Crossplane tenant (unblocks ksail EKS) #2324

🤖 Generated by the Daily AI Assistant

Problem

The ksail AWS EKS provider is implemented and unit-covered but stays 🚧 because its remaining acceptance criteria (ksail#4328) are AWS-credential-gated: the EKS CI system test (create → info → GitOps bootstrap → delete) needs AWS test credentials, and there are none in the portfolio today (platform is Hetzner-only; no AWS Crossplane provider, no AWS creds anywhere).

Decision (maintainer, 2026-06-29)

Provision the AWS test credentials declaratively via Crossplane (favored over Terraform), behind a new devantler-tech/aws tenant created first. This epic captures the path so it can be picked up incrementally.

Proposed architecture — mirror the existing github-config tenant

The portfolio already runs GitHub-as-code this exact way: a tenant namespace runs provider-upjet-github, ProviderConfig credentials come from OpenBao via an ExternalSecret, and declarative CRs live in github/devantler-tech/.github-public/deploy/. Mirror it for AWS:

Sequenced children

1. AWS provider + aws tenant scaffold — install the AWS Crossplane provider + ProviderConfig (OpenBao-seeded bootstrap creds), create the devantler-tech/aws repo (per the net-new-repo custom-property bootstrap) and wire it as a platform tenant. (foundation)
2. Declaratively provision the EKS-test AWS identity — least-privilege IAM for eksctl EKS create/delete + the GitOps-on-EKS test, surfaced for CI. Decision point: GitHub OIDC role (preferred, no long-lived secret) vs. static access key.
3. Deliver the credential to ksail CI declaratively — either a GitHub OIDC identity-provider trust, or a declarative RepositoryActionsSecret (requires activating that provider-upjet-github CRD — not yet activated) sourced from the Crossplane connection secret.
4. ksail#4328 (existing, the consumer) — add system-test-eks.yaml mirroring system-test-hetzner.yaml + drop the README 🚧, once 1–3 land.

Notes / known gaps (from a live scan)

• No AWS Crossplane provider is installed in platform today — greenfield.
• provider-upjet-github has no Actions-secret CRD activated; the platform has no declarative GitHub-Actions-secret pattern at all yet (child 3 builds it, unless OIDC removes the need).
• Bootstrap chicken-and-egg: the AWS ProviderConfig needs an initial bootstrap IAM credential seeded into OpenBao (a manual maintainer step, like the GitHub App credential).
• Prefer GitHub OIDC → AWS role so CI assumes a short-lived role with no stored secret; fall back to a static access key only if OIDC is impractical.

Rough size: M–L across platform + a new repo + .github + ksail; each child is independently shippable.