Convert kro lab to managed Amazon EKS Capabilities for kro and ACK

[nameprabhat]

PR Description

What

Converts the automation/controlplanes/kro lab from self-managed controllers to fully managed Amazon EKS Capabilities:

• kro — replaces the in-cluster helm install kro step with a managed capability (type = KRO). Amazon EKS runs the kro controller and installs the kro CRDs; there is no controller to install, patch, or scale in-cluster.
• ACK — replaces the self-managed aws-ia/eks-ack-addons Helm/IRSA controllers with a managed capability (type = ACK) for the DynamoDB, IAM, and EKS controllers this lab's ResourceGraphDefinition uses.

This follows the pattern established for the ACK lab in #1870, extended to also cover kro itself.

Why

EKS Capabilities let Amazon manage the availability, patching, and scaling of kro and ACK, removing the Helm/IRSA setup and version pinning the lab previously maintained. It also showcases the managed capability model that this lab is meant to teach.

Changes

Terraform (manifests/modules/automation/controlplanes/kro/.workshop/terraform/)

• main.tf — remove the eks_ack_addons module; add two aws_eks_capability resources (ACK + KRO), each with a capability IAM role trusted by capabilities.eks.amazonaws.com, cluster access entries, and IAM-propagation waits. The ACK capability role carries the DynamoDB/IAM/EKS permissions the RGD's controllers need; the KRO capability role needs no IAM permissions and is granted AmazonEKSKROPolicy + AmazonEKSClusterAdminPolicy so kro can create the resources its RGDs define.
• vars.tf — remove dynamo_ack_version and kro_version; add carts_dynamo_table_name.
• outputs.tf — drop the removed version variables.

Content (English + Japanese)

• index.md — update the prepare-environment summary to describe the managed ACK capability.
• introduction.md — remove the helm install kro step; explain kro is now provided by the managed EKS Capability.

Testing

Validated end-to-end on a workshop cluster created with make create-infrastructure:

• prepare-environment automation/controlplanes/kro completes successfully; both capabilities reach ACTIVE (ack, kro).
• kro CRDs are installed by the capability with no Helm release and no controller pod in kro-system.
• Applying the WebApplicationDynamoDB RGD instance provisions all four ACK resources (DynamoDB Table, IAM Policy + Role, EKS PodIdentityAssociation), all reaching ACK.ResourceSynced=True, and the carts application connects to the DynamoDB table.
• terraform fmt and terraform validate pass.

Notes

• The AmazonEKSClusterAdminPolicy granted to the kro capability role follows the AWS "getting started / development" guidance for kro capabilities. Happy to scope this to a narrower custom policy if preferred for the workshop.

[netlify]

✅ Deploy Preview for eks-workshop ready!

Name	Link
🔨 Latest commit	bff2e5d
🔍 Latest deploy log	https://app.netlify.com/projects/eks-workshop/deploys/6a5670c593bbe60007ec58f6
😎 Deploy Preview	https://deploy-preview-1874--eks-workshop.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.