Change EKS addons auth from IRSA to Pod Identity

Author: kush-chandra

infra/aws/main.yaml

@@ -430,15 +430,19 @@ Resources:
     Properties:
       NamespaceConfig:
         Namespace: "kube-system"
-      ServiceAccountRoleArn: !GetAtt VdcClusterCsiDriverRole.Arn
+      PodIdentityAssociations:
+        - ServiceAccount: "ebs-csi-controller-sa"
+          RoleArn: !GetAtt VdcClusterCsiDriverRole.Arn
       ClusterName: !Ref VdcCluster
       AddonName: "aws-ebs-csi-driver"
   VdcClusterAddonCloudWatchAgent:
     Type: "AWS::EKS::Addon"
     Properties:
       NamespaceConfig:
         Namespace: "amazon-cloudwatch"
-      ServiceAccountRoleArn: !GetAtt VdcClusterCloudWatchObservabilityRole.Arn
+      PodIdentityAssociations:
+        - ServiceAccount: "cloudwatch-agent"
+          RoleArn: !GetAtt VdcClusterCloudWatchObservabilityRole.Arn
       ClusterName: !Ref VdcCluster
       AddonName: "amazon-cloudwatch-observability"
   VdcClusterAddonNodeMonitoringAgent: