Add support for eusc-de-east-1 (AWS European Sovereign Cloud)

[gustavodiaz7722]

Description

Adds support for the AWS European Sovereign Cloud: the aws-eusc partition and its first region, Germany East (eusc-de-east-1).

This overlaps with #8743, which is also open and came first. I'm not trying to jump the queue — I started out reviewing that PR and ended up with a branch. If the maintainers would rather land #8743, I'm happy to close this and move the notes below over as review comments; the findings matter more than which PR merges.

Partition entry (pkg/apis/eksctl.io/v1alpha5/partitions.go)

• v1SDKDNSPrefix is amazonaws.eu, not amazonaws.com. This is the part with real consequences: addons.UseRegionalImage formats %s.dkr.ecr.%s.%s, so the suffix decides whether the regional add-on images resolve at all. The correct host is 877088126301.dkr.ecr.eusc-de-east-1.amazonaws.eu, per View Amazon container image registries for Amazon EKS add-ons — the same table the EKS resource account ID comes from. The suffix is corroborated by botocore's endpoints.json (aws-eusc → dnsSuffix: amazonaws.eu) and by the SDK already vendored here: aws-sdk-go-v2/service/eks@v1.80.2 resolves aws-eusc to eks.{region}.amazonaws.eu.
• Uses standardServiceMappings rather than a reduced EC2/EKS/EKSFargatePods map. Both ssm and rolesanywhere are present in the aws-eusc partition in endpoints.json, so the SSM and IRA service principals are valid there. That keeps ClusterResourceSet.addSSM and the IAM Roles Anywhere path for hybrid nodes from hitting a missing FindInMap key, and makes this entry identical in shape to aws-us-gov.
• No endpointServiceDomainPrefixAlt. GetEndpointServiceDomainPrefix only reads that field under case PartitionISOE, PartitionISOF, so setting it for a partition outside that switch would be dead weight. EUSC takes the default: branch and gets the standard com.amazonaws prefix. That's also why there's no new service_details_* / vpc_private_* fixture here: the ISOE/ISOF fixtures exist specifically to cover their alternate prefix, and EUSC has no such special case to cover.

Default add-ons — eusc-de-east-1 is deliberately not added to MetricsServerAddon.ExcludedRegions. That list currently holds every other non-standard partition, so it looks like an omission; it isn't. metrics-server is available in the AWS European Sovereign Cloud, and excluding the region would silently drop a default add-on there. Flagging it so a reviewer doesn't "fix" it.

Fixtures — the aws-eusc block is inserted between aws-cn and aws-iso. cloudformation.Template.Mappings is a map[string]interface{} and Template.JSON() goes through json.MarshalIndent, so rendered key order is sorted, and pkg/actions/nodegroup/upgrade_test.go plus karpenter_test.go both compare with exact-string Equal — position matters. All three expected templates in karpenter_test.go are updated, not just the first.

Testing

go build ./... is clean and go test ./pkg/... passes for 85 packages. Two packages fail in my environment for reasons unrelated to this change, and fail identically on unmodified main: pkg/iam/oidc needs cfssl/cfssljson on PATH, and pkg/karpenter/providers/helm pulls a chart from public.ecr.aws and gets a 403.

I could not manually test this — I have no access to eusc-de-east-1. The one thing worth confirming in-region is the DNS suffix, via either of the commands that actually consume it:

eksctl utils update-aws-node --cluster <cluster> --region eusc-de-east-1
eksctl utils update-coredns  --cluster <cluster> --region eusc-de-east-1

Both should resolve images under 877088126301.dkr.ecr.eusc-de-east-1.amazonaws.eu.

Worth noting for anyone validating: addons.UseRegionalImage is reached only from utils update-aws-node, utils update-coredns, utils update-addon and utils install-vpc-controllers. It is not on the eksctl create cluster path when EKS-managed add-ons are used, which is the default. So a successful cluster-creation smoke test in the region does not exercise the DNS suffix and will pass whichever value is set.

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the userdocs directory)
• Manually tested
• Made sure the title of the PR is a good description that can go into the release notes
• (Core team) Added labels for change area (e.g. area/nodegroup) and kind (e.g. kind/improvement)

[github-actions]

Hello gustavodiaz7722 👋 Thank you for opening a Pull Request in eksctl project. The team will review the Pull Request and aim to respond within 1-10 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website