(2/4) Make openscapes' grafana pod acquire credentials to assume the IAM Role

[consideRatio]

This is task 2/4 in #4546, which is part of the big epic #4453.

We look to expose AWS credentials for grafana to assume the IAM role created in #4547. The Grafana chart is creating a k8s ServiceAccount by default it seems, and it can be configured with an annotation - this is everything we need!

The annotation should be eks.amazonaws.com/role-arn: <previously created iam role arn here>, so in practice it looks from the grafana helm chart's default chart values we just have to declare the following in the openscapes support chart and verify success after deploying:

grafana:
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: <previously created iam role arn here>

Definition of done

• The grafana pod references a k8s ServiceAccount via serviceAccountName, which is annotated with eks.amazonaws.com/role-arn=<arn of iam role created with terraform>.
  kubectl get pod -l app.kubernetes.io/name=grafana -n support -o yaml | grep serviceAccountName can be used for this, followed by inspecting that the named ServiceAccount has the relevant annotation.

• The grafana pod has been updated to include AWS_... environment variables.
  kubectl get pod -l app.kubernetes.io/name=grafana -n support -o yaml | grep AWS can be used for this.

  PS: these variables are set on pod creation time by an AWS pod admission controller manipulating the pod specification. It is registered with the k8s api-server to be contacted whenever a Pod is being created. This is setup via a MutatingWebhookConfiguration resource. This is what makes the k8s ServiceAccount's annotation meaningful.

[sgibson91]

• The grafana pod has been updated to include AWS_... environment variables.
  kubectl get pod -n dask-staging jupyter-consideratio -o yaml | grep AWS can be used for this.

This talks about the grafana pod being given AWS_* env variables, but then the example command references a jupyter singleuser server which is confusing.

[consideRatio]

Nice catch @sgibson91! It should be "-l app.kubernetes.io/name=grafana -n support" within that command. Top post is now updated!