Bind EKS lifecycle ownership to immutable AWS identity

[devantler]

🤖 Generated by the Daily AI Engineer

Summary

Bind KSail-managed EKS lifecycle state to an immutable AWS account and cluster identity before destructive delete/start/stop/update actions.

Motivation

The exact guard introduced while delivering #6087 corroborates the resolved name, region, and eksctl-created marker, and requires matching local KSail config or persisted EKS/AWS state. Those signals are still replayable across AWS accounts:

1. Create or manage demo through KSail in AWS account A.
2. Leave the local eks.yaml or ~/.ksail/clusters/demo/spec.json in place.
3. Switch the configured credentials to account B, where another operator has an eksctl-created demo in the same region.
4. A lifecycle command can match the stale local name plus the generic EksctlCreated=True result and target the account-B cluster.

Name, region, and generic eksctl provenance establish target intent, but do not prove that the current live cluster is the instance KSail created. Delete and nodegroup scaling make that identity gap destructive.

Proposed Solution

• Record the AWS account ID and immutable EKS cluster ARN or equivalent instance identity after KSail creates the cluster.
• Resolve the current caller identity through the same credential-isolated AWS configuration used by the lifecycle operation.
• Before every destructive EKS lifecycle action, compare current account and live cluster identity with persisted ownership state and fail closed on absence, parse errors, or mismatch.
• Define an explicit, non-destructive migration/rebind flow for legacy state rather than silently trusting name-only records.
• Keep custom AWS credential environment mappings isolated from the parent process.

Acceptance Criteria

• Persisted EKS ownership state includes AWS account and immutable cluster identity without storing credentials.
• Delete, start, stop, update, and TTL cleanup verify that identity at the current credentials before mutation.
• Switching to a different account containing the same name and region is rejected before delete or scaling.
• A replaced cluster with the same name in the same account is rejected before mutation.
• Missing or malformed ownership identity fails closed with an actionable migration message.
• Offline tests cover account mismatch, replaced-cluster mismatch, legacy state, credential aliases, and query failures.

Alternatives Considered

Treating a matching local config or name-only state as authorization is sufficient for #6087 routing, but cannot distinguish stale state from the original live cluster. EKS or eksctl generic tags have the same collision problem unless KSail writes and persists a unique marker.

Additional Context

Follow-up to #6087 and draft PR #6201.

🤖 Generated by the Daily AI Engineer