tare dataplane identity bind

Bind the data plane's signing ServiceAccount to an AWS IAM role so the Envoy AI
Gateway reaches Bedrock with the pod's role (the AWS SDK default credential
chain) instead of static keys. Pairs with a credential-less AWS provider
(fraser#4520): the data plane reconciles it to a region-only
BackendSecurityPolicy and the SDK resolves whatever identity the cluster
provides.

Two mechanisms, picked with --type:
  irsa              an IAM role trusted by the cluster OIDC provider, bound by
                    annotating the SA (eks.amazonaws.com/role-arn). Prereq: the
                    cluster's IAM OIDC provider is registered.
  eks-pod-identity  an IAM role trusted by pods.eks.amazonaws.com, bound by an
                    EKS pod-identity association (no SA annotation). Prereq: the
                    eks-pod-identity-agent addon. Always needs --cluster/--region.

The signing container is ai-gateway-extproc in the egress pod, but the cluster
injects credentials into every container once the SA is bound, so binding the
egress SA is enough. The missing prerequisite is reported with its fix command
rather than failing opaquely.

Before applying, a read-only preflight confirms the signing SA exists and the
current context can patch the resources the bind touches (skip with
--skip-preflight). After binding, --wait polls the rollout and confirms
credentials were injected into the egress pod.

Examples:
  # IRSA: create the role + trust + bedrock policy, then bind it
  tare dataplane identity bind --type irsa --create-iam \
    --cluster my-eks --region us-east-1

  # IRSA: bind an IAM role you already created
  tare dataplane identity bind --type irsa \
    --role-arn arn:aws:iam::123456789012:role/my-eks-bedrock-dp

  # Pod Identity: create the role + association (always needs --cluster/--region)
  tare dataplane identity bind --type eks-pod-identity --create-iam \
    --cluster my-eks --region us-east-1

  # Preview the actions without applying
  tare dataplane identity bind --type eks-pod-identity --create-iam \
    --cluster my-eks --region us-east-1 --dry-run

  # Verify the binding is in place (read-only; no changes)
  tare dataplane identity bind --check --type eks-pod-identity

Usage:
  tare dataplane identity bind [flags]

Flags:
      --check                    Read-only: report whether the SA is bound and credentials are injected; make no changes
      --cluster string           EKS cluster name (required with --create-iam, and always for --type eks-pod-identity)
      --context string           kubeconfig context (default: current context)
      --create-iam               Create/update the role, its trust, and the bedrock:InvokeModel policy
      --dry-run                  Print the planned actions without applying them (--create-iam still queries AWS read-only to resolve the ARN and verify the OIDC prereq)
      --namespace string         Namespace holding the signing ServiceAccount (default "tars-dataplane")
      --region string            AWS region (required with --create-iam, and always for --type eks-pod-identity)
      --role-arn string          Existing IAM role ARN to bind (omit with --create-iam)
      --role-name string         Role name to create with --create-iam (default: <cluster>-bedrock-dp)
      --service-account string   Signing ServiceAccount to bind (the egress pod's SA) (default "egress")
      --skip-preflight           Skip the read-only cluster preflight (SA exists + RBAC can-i)
      --timeout string           Timeout for --wait rollout (e.g. 90s, 2m) (default "2m")
      --type string              Identity mechanism: irsa or eks-pod-identity (default "irsa")
      --wait                     After binding, wait for the rollout and confirm credentials propagated (default true)
      --yes                      Skip the confirmation prompt; required in non-TTY contexts

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr