feat(base): support IRSA annotations on logs controller SA when cloudwatch enabled

[davidf-null]

What

Renders annotations on the nullplatform-pod-metadata-reader-sa ServiceAccount only when cloudwatch.enabled is true and cloudwatch.serviceAccount.annotations is non-empty. Adds the cloudwatch.serviceAccount.annotations value (default {}).

No change for existing installs: with cloudwatch disabled or no annotations set, the SA renders exactly as before.

Why

The logs controller (k8s-logs-controller) runs under nullplatform-pod-metadata-reader-sa. The SA had no annotations and no way to set them via values, so on EKS the controller could only reach CloudWatch through the node instance role (broad, node-wide privilege).

This lets you set eks.amazonaws.com/role-arn on the SA and use IRSA — a scoped IAM role for just the logs controller — instead of granting CloudWatch to every pod on the node.

Changes

• templates/serviceaccount.yaml — conditional annotations block on the reader SA
• values.yaml — new cloudwatch.serviceAccount.annotations (default {}) with documented example
• README.md — values table entry

Usage

cloudwatch:
  enabled: true
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>

Testing

helm template verified in three scenarios:

• cloudwatch disabled → SA has no annotations
• cloudwatch enabled + role-arn → annotation rendered with correct indentation
• cloudwatch enabled + empty map → no empty annotations: block (valid YAML)

Paired with the tofu-modules change that passes this value through the base module: nullplatform/tofu-modules#441

🤖 Generated with Claude Code