Roll out platform-metadata IRSA pattern to remaining GitOps charts

[paulczar]

Summary

Apply the accepted platform metadata / IRSA bootstrap pattern to remaining charts that still hardcode AWS account ARNs or reconstruct role names in cluster-config.

Context

ADR: docs/architecture/platform-metadata-irsa.md

Decision: Terraform owns IAM + SM payloads; bootstrap publishes rosa-platform-metadata; GitOps charts consume metadata (Job/hook) instead of embedding arn:aws:iam::ACCOUNT:role/.... ESO cannot fetch its own IRSA role from SM first (chicken-and-egg).

Already done (first consumers):

• Bootstrap publish_platform_metadata in bootstrap-gitops.sh
• external-secrets-operator platformMetadata.enabled
• cudn-bgp-routing-operator ExternalSecret remote key from bgpConfigSecretName (Drive CUDN BGP Helm values from ESO ConfigMap/Secret (drop static cluster-config hardcoding) #51)

Acceptance Criteria

• Inventory cluster-config / helm charts that still hardcode IRSA ARNs or account IDs (e.g. NetObserv Loki, Kuadrant/RHCL credentials, cert-manager if moved fully to GitOps, others)
• For each: prefer platformMetadata (or equivalent Job) over values ARNs; keep explicit roleArn only as break-glass
• Update chart READMEs + enablement snippets
• No shared IAM roles across clusters (OIDC is per-cluster)

Related

• Drive CUDN BGP Helm values from ESO ConfigMap/Secret (drop static cluster-config hardcoding) #51 (BGP / ESO dynamic config)
• Replace Argo CD Vault Plugin with Secrets Manager Operator for GitOps secrets #43 (ESO replaces AVP)
• Cert-manager/awspca bootstrap --set certManagerRole precedent