instance-manager strips out user permissions from aws-auth configmap about instance-manager

[eytan-avisror]

Solution:

• Discover active ARNs from controller configmap & tagged CF stacks
• If existing configmap has a role that conflicts with discovered configmap, override it from the discovered ARNs as a node role, for example if ['arn-1', 'arn-2'] were discovered, and configmap was:

data:
  mapRoles: |
    - rolearn: arn:aws:iam::0000000000:role/arn-1
      username: user:some-user
      groups:
        - system:masters

It will be removed, and replaced with the node mapRole.

data:
  mapRoles: |
    - rolearn: arn:aws:iam::0000000000:role/arn-1
      username: system:node:{{EC2PrivateDNSName}}
      groups:
      - system:bootstrappers
      - system:nodes

• If existing configmap has a role that does not conflict with discovered ARNs, we add it as is in addition to discovered ARNs.

[wanghong230]

user: pattern won't work. We should be able to support the assume role pattern, which will show up as role: also.

[eytan-avisror]

@wanghong230 will not use any pattern - will parse out existing configmap and dedupe with instance-manager additions.
see PR : #28