feat: Add EKS Auto Mode Security Groups per Pod support

- Implement Auto Mode Detection Service for EKS cluster mode detection
- Add Enhanced ENI Manager with pool-based allocation for Auto Mode
- Implement Security Group Manager for pod-level security group assignment
- Add Configuration Management with environment variable support
- Integrate Auto Mode components with existing IPAM context
- Add comprehensive unit and integration tests
- Update documentation with Auto Mode SGPP usage examples

This enhancement enables fine-grained network security controls
in EKS Auto Mode clusters by supporting Security Groups per Pod.

Components added:
- pkg/automode/detector.go - Auto Mode detection
- pkg/automode/eni_manager.go - Enhanced ENI management
- pkg/automode/security_group_manager.go - Security group management
- pkg/automode/config.go - Configuration management
- pkg/automode/automode_test.go - Comprehensive tests
- pkg/ipamd/auto_mode_integration.go - IPAM integration
- pkg/ipamd/auto_mode_integration_test.go - Integration tests

Resolves: EKS Auto Mode SGPP limitation
Closes: aws#1

Author: soumentrivedi

pkg/automode/automode_test.go

@@ -0,0 +1,282 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may
+// not use this file except in compliance with the License. A copy of the
+// License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed
+// on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+// express or implied. See the License for the specific language governing
+// permissions and limitations under the License.
+
+package automode
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+const (
+	// Environment variables for Auto Mode configuration
+	envAutoModeEnabled            = "AUTO_MODE_SGPP_ENABLED"
+	envAutoModeClusterName        = "CLUSTER_NAME"
+	envAutoModeRegion             = "AWS_REGION"
+	envAutoModeENIPoolSize        = "AUTO_MODE_ENI_POOL_SIZE"
+	envAutoModeSGFallback         = "AUTO_MODE_SG_FALLBACK"
+	envAutoModeAllocationStrategy = "AUTO_MODE_ENI_ALLOCATION_STRATEGY"
+	envAutoModeCacheTTL           = "AUTO_MODE_CACHE_TTL"
+	envAutoModeLogLevel           = "AUTO_MODE_LOG_LEVEL"
+
+	// Default values
+	defaultAutoModeEnabled            = false
+	defaultAutoModeENIPoolSize        = 10
+	defaultAutoModeSGFallback         = "cluster-security-group"
+	defaultAutoModeAllocationStrategy = "pool-based"
+	defaultAutoModeCacheTTL           = 300 // 5 minutes in seconds
+	defaultAutoModeLogLevel           = "info"
+)
+
+// ConfigurationManager manages Auto Mode configuration
+type ConfigurationManager struct {
+	config *AutoModeConfig
+}
+
+// NewConfigurationManager creates a new configuration manager
+func NewConfigurationManager() *ConfigurationManager {
+	return &ConfigurationManager{
+		config: LoadAutoModeConfig(),
+	}
+}
+
+// LoadAutoModeConfig loads Auto Mode configuration from environment variables
+func LoadAutoModeConfig() *AutoModeConfig {
+	return &AutoModeConfig{
+		SGPPEnabled:        parseBoolEnvVar(envAutoModeEnabled, defaultAutoModeEnabled),
+		ENIPoolSize:        parseIntEnvVar(envAutoModeENIPoolSize, defaultAutoModeENIPoolSize),
+		SGFallback:         getStringEnvVar(envAutoModeSGFallback, defaultAutoModeSGFallback),
+		AllocationStrategy: getStringEnvVar(envAutoModeAllocationStrategy, defaultAutoModeAllocationStrategy),
+		CacheTTL:           parseIntEnvVar(envAutoModeCacheTTL, defaultAutoModeCacheTTL),
+		LogLevel:           getStringEnvVar(envAutoModeLogLevel, defaultAutoModeLogLevel),
+	}
+}
+
+// GetConfiguration returns the current configuration
+func (cm *ConfigurationManager) GetConfiguration() *AutoModeConfig {
+	return cm.config
+}
+
+// UpdateConfiguration updates the configuration
+func (cm *ConfigurationManager) UpdateConfiguration(config *AutoModeConfig) error {
+	if err := ValidateAutoModeConfig(config); err != nil {
+		return err
+	}
+	cm.config = config
+	return nil
+}
+
+// ReloadConfiguration reloads configuration from environment variables
+func (cm *ConfigurationManager) ReloadConfiguration() {
+	cm.config = LoadAutoModeConfig()
+}
+
+// GetClusterName returns the cluster name from environment
+func GetClusterName() string {
+	return getStringEnvVar(envAutoModeClusterName, "")
+}
+
+// GetAWSRegion returns the AWS region from environment
+func GetAWSRegion() string {
+	return getStringEnvVar(envAutoModeRegion, "")
+}
+
+// IsAutoModeEnabled checks if Auto Mode SGPP is enabled
+func IsAutoModeEnabled() bool {
+	return parseBoolEnvVar(envAutoModeEnabled, defaultAutoModeEnabled)
+}
+
+// GetENIPoolSize returns the ENI pool size configuration
+func GetENIPoolSize() int {
+	return parseIntEnvVar(envAutoModeENIPoolSize, defaultAutoModeENIPoolSize)
+}
+
+// GetSGFallback returns the security group fallback configuration
+func GetSGFallback() string {
+	return getStringEnvVar(envAutoModeSGFallback, defaultAutoModeSGFallback)
+}
+
+// GetAllocationStrategy returns the ENI allocation strategy
+func GetAllocationStrategy() string {
+	return getStringEnvVar(envAutoModeAllocationStrategy, defaultAutoModeAllocationStrategy)
+}
+
+// GetCacheTTL returns the cache TTL configuration
+func GetCacheTTL() int {
+	return parseIntEnvVar(envAutoModeCacheTTL, defaultAutoModeCacheTTL)
+}
+
+// GetLogLevel returns the log level configuration
+func GetLogLevel() string {
+	return getStringEnvVar(envAutoModeLogLevel, defaultAutoModeLogLevel)
+}
+
+// ValidateConfiguration validates the current configuration
+func (cm *ConfigurationManager) ValidateConfiguration() error {
+	return ValidateAutoModeConfig(cm.config)
+}
+
+// GetConfigurationSummary returns a summary of the current configuration
+func (cm *ConfigurationManager) GetConfigurationSummary() map[string]interface{} {
+	return map[string]interface{}{
+		"sgppEnabled":        cm.config.SGPPEnabled,
+		"eniPoolSize":        cm.config.ENIPoolSize,
+		"sgFallback":         cm.config.SGFallback,
+		"allocationStrategy": cm.config.AllocationStrategy,
+		"cacheTTL":           cm.config.CacheTTL,
+		"logLevel":           cm.config.LogLevel,
+		"clusterName":        GetClusterName(),
+		"awsRegion":          GetAWSRegion(),
+	}
+}
+
+// SetEnvironmentVariables sets environment variables for testing
+func SetEnvironmentVariables(vars map[string]string) {
+	for key, value := range vars {
+		os.Setenv(key, value)
+	}
+}
+
+// ClearEnvironmentVariables clears environment variables for testing
+func ClearEnvironmentVariables(keys []string) {
+	for _, key := range keys {
+		os.Unsetenv(key)
+	}
+}
+
+// GetRequiredEnvironmentVariables returns the list of required environment variables
+func GetRequiredEnvironmentVariables() []string {
+	return []string{
+		envAutoModeClusterName,
+		envAutoModeRegion,
+	}
+}
+
+// GetOptionalEnvironmentVariables returns the list of optional environment variables
+func GetOptionalEnvironmentVariables() []string {
+	return []string{
+		envAutoModeEnabled,
+		envAutoModeENIPoolSize,
+		envAutoModeSGFallback,
+		envAutoModeAllocationStrategy,
+		envAutoModeCacheTTL,
+		envAutoModeLogLevel,
+	}
+}
+
+// ValidateEnvironmentVariables validates all environment variables
+func ValidateEnvironmentVariables() error {
+	// Check required variables
+	required := GetRequiredEnvironmentVariables()
+	for _, key := range required {
+		if value := os.Getenv(key); value == "" {
+			return fmt.Errorf("required environment variable %s is not set", key)
+		}
+	}
+
+	// Validate optional variables
+	if clusterName := GetClusterName(); clusterName != "" {
+		if len(clusterName) < 3 || len(clusterName) > 100 {
+			return fmt.Errorf("CLUSTER_NAME must be between 3 and 100 characters")
+		}
+	}
+
+	if region := GetAWSRegion(); region != "" {
+		if !isValidAWSRegion(region) {
+			return fmt.Errorf("invalid AWS region: %s", region)
+		}
+	}
+
+	if poolSize := GetENIPoolSize(); poolSize < 1 || poolSize > 100 {
+		return fmt.Errorf("AUTO_MODE_ENI_POOL_SIZE must be between 1 and 100")
+	}
+
+	if fallback := GetSGFallback(); fallback != "" {
+		if !strings.HasPrefix(fallback, "sg-") {
+			return fmt.Errorf("AUTO_MODE_SG_FALLBACK must start with 'sg-'")
+		}
+	}
+
+	if strategy := GetAllocationStrategy(); strategy != "" {
+		validStrategies := []string{"pool-based", "on-demand", "hybrid"}
+		if !contains(validStrategies, strategy) {
+			return fmt.Errorf("invalid allocation strategy: %s, must be one of %v",
+				strategy, validStrategies)
+		}
+	}
+
+	if cacheTTL := GetCacheTTL(); cacheTTL < 60 || cacheTTL > 3600 {
+		return fmt.Errorf("AUTO_MODE_CACHE_TTL must be between 60 and 3600 seconds")
+	}
+
+	if logLevel := GetLogLevel(); logLevel != "" {
+		validLevels := []string{"debug", "info", "warn", "error"}
+		if !contains(validLevels, strings.ToLower(logLevel)) {
+			return fmt.Errorf("invalid log level: %s, must be one of %v",
+				logLevel, validLevels)
+		}
+	}
+
+	return nil
+}
+
+// isValidAWSRegion checks if a string is a valid AWS region
+func isValidAWSRegion(region string) bool {
+	validRegions := []string{
+		"us-east-1", "us-east-2", "us-west-1", "us-west-2",
+		"eu-west-1", "eu-west-2", "eu-west-3", "eu-central-1",
+		"ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ap-northeast-2",
+		"ap-south-1", "ca-central-1", "sa-east-1",
+	}
+	return contains(validRegions, region)
+}
+
+// GetConfigurationHelp returns help text for configuration
+func GetConfigurationHelp() string {
+	return `
+Auto Mode SGPP Configuration:
+
+Required Environment Variables:
+  CLUSTER_NAME              - EKS cluster name
+  AWS_REGION               - AWS region where the cluster is located
+
+Optional Environment Variables:
+  AUTO_MODE_SGPP_ENABLED   - Enable Auto Mode SGPP (default: false)
+  AUTO_MODE_ENI_POOL_SIZE  - ENI pool size (default: 10, range: 1-100)
+  AUTO_MODE_SG_FALLBACK    - Fallback security group (default: cluster-security-group)
+  AUTO_MODE_ENI_ALLOCATION_STRATEGY - ENI allocation strategy (default: pool-based)
+  AUTO_MODE_CACHE_TTL      - Cache TTL in seconds (default: 300, range: 60-3600)
+  AUTO_MODE_LOG_LEVEL      - Log level (default: info)
+
+Pod Annotations:
+  vpc.amazonaws.com/security-groups - Comma-separated list of security group IDs
+
+Example:
+  export CLUSTER_NAME=my-auto-mode-cluster
+  export AWS_REGION=us-west-2
+  export AUTO_MODE_SGPP_ENABLED=true
+  export AUTO_MODE_ENI_POOL_SIZE=20
+`
+}
+
+// parseIntEnvVar parses an integer environment variable with a default value
+func parseIntEnvVar(envVar string, defaultValue int) int {
+	if strValue := os.Getenv(envVar); strValue != "" {
+		if parsedValue, err := strconv.Atoi(strValue); err == nil {
+			return parsedValue
+		}
+	}
+	return defaultValue
+}