Adding Support for EKS Fargate

[dalgibbard]

This PR adds in support for Fargate-only EKS Clusters -- so the External Secrets controller pod can run on fargate and still function.
The key difference is that the EC2 metadata API is not available on EKS Fargate instances, and you must instead use a Web Identity.

Summary:

• Call assumeRoleWithWebIdentity in place of AssumeRole when env.FARGATE=1
• Read a web token from the service account token mount in the container (usually /var/run/secrets/eks.amazonaws.com/serviceaccount/token when automounted by K8S)
• Deploy the chart with --set env.FARGATE=1 -- this enables the use of assumeRoleWithWebIdentity instead of assumeRole.
• Deploy the chart with --set securityContext.fsGroup=65534 -- The securityContext.fsGroup sets ownership permissions for the servicetoken; without this, its set to root:root // 0640 and isn't accessible to the app.

PS. I'm a JS noob, so all feedback is welcome!
TODO: Update any readme's/doc's if this change is deemed sensible.

[dalgibbard]

Closes #254

[Flydiverny]

Thanks for PR! :) Merged #416 as it seemed like a more generic implementation fix as the same issue exists for IRSA usage in EKS, eg not using the correct assume role. The AWS SDK should pick up and use the web token automatically if set, but we were not switching over to using the correct assume role for those credentials.

So closing this as I don't think we have a need for the FARGATE env var. Please reopen if the merged PR doesn't resolve your problem!

[dalgibbard]

Hey, Yeap that makes sense, will test and report back :)