Continue the redistribution of `guess/` started by PRs #2980 and #3000:
move every helper that operates on an EKS cluster object or the EKS API
into a dedicated `common/eks/` package. After this commit, `common/eks/`
contains:
  - authmode.go (was guess/clusterauthmode.go)
  - podidentityagent.go (was guess/ekspodidentityagent.go)
  - oidcprovider.go (was guess/oidcprovider.go)
  - privatesubnets.go (was guess/privatesubnets.go)

Import alias `commoneks` is used to avoid colliding with the existing
`github.com/aws/aws-sdk-go-v2/service/eks` (aliased `eks`).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…rn (#3012)

* kubectl-datadog: extract EKS helpers to common/eks/

Continue the redistribution of `guess/` started by PRs #2980 and #3000:
move every helper that operates on an EKS cluster object or the EKS API
into a dedicated `common/eks/` package. After this commit, `common/eks/`
contains:
  - authmode.go (was guess/clusterauthmode.go)
  - podidentityagent.go (was guess/ekspodidentityagent.go)
  - oidcprovider.go (was guess/oidcprovider.go)
  - privatesubnets.go (was guess/privatesubnets.go)

Import alias `commoneks` is used to avoid colliding with the existing
`github.com/aws/aws-sdk-go-v2/service/eks` (aliased `eks`).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: consolidate aws-auth into common/awsauth/

`common/aws/aws-auth.go` was misnamed: it manipulates a Kubernetes
ConfigMap (`kube-system/aws-auth`), not an AWS-SDK resource. Together
with `guess/aws-auth.go` (read-only presence check), it belongs in a
dedicated `common/awsauth/` package: both files operate on the same
ConfigMap.

Function names lose the now-redundant `AwsAuth` prefix:
  - `IsAwsAuthConfigMapPresent` -> `IsConfigMapPresent`
  - `EnsureAwsAuthRole`         -> `EnsureRole`
  - `RemoveAwsAuthRole`         -> `RemoveRole`

`common/aws/` now contains only cloudformation.go (pure AWS-SDK).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: fold clustername into common/clients/

The only caller of `guess.GetClusterNameFromKubeconfig` is the wrapper
`clients.GetClusterNameFromKubeconfig` in `common/clients/clients.go`.
Move the helper next to its caller as an unexported function
`clusterNameFromKubeconfig`. The public API of `common/clients/` is
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: carve out karpenter package

Consolidate everything Karpenter-shaped into `common/karpenter/`,
alongside the existing detection helper:

- Intermediate model: NodePoolsSet, EC2NodeClass, NodePool,
  MetadataOptions, BlockDeviceMapping (from guess/nodepoolsset.go)
- Producers from EKS node groups: GetNodeGroupsProperties (from
  guess/nodegroupproperties.go -> fromnodegroups.go)
- Producers from running k8s Nodes: GetNodesProperties (from
  guess/nodesproperties.go -> fromnodes.go)
- CR builders: CreateOrUpdateEC2NodeClass, CreateOrUpdateNodePool
  (from cluster/k8s/{ec2nodeclass,nodepool}.go)

`cluster/k8s/` is gone (it was misnamed: those files build Karpenter
CRDs, they aren't generic k8s primitives). `common/k8s/` keeps its
narrow scope: generic object CRUD + deployment-finder.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: awsauth: extract ConfigMap name/namespace constants

`kube-system` and `aws-auth` each appeared 5 times across the three
functions. Promote them to package-level constants so the package's
single-ConfigMap scope is explicit at a glance.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

…2980)

* [CASCL-1304] kubectl-datadog: enrich dd-cluster-info ConfigMap

The dd-cluster-info ConfigMap (introduced by #2945) now records:

- the running Karpenter installation (version, namespace, ownership)
  under a new `autoscaling` parent that also groups the existing
  clusterAutoscaler entry and a new eksAutoMode entry,
- a `managedByDatadog` flag per node-management entity (Fargate
  profile, Karpenter NodePool), so a future migration tool can
  distinguish Datadog-managed entities to keep from legacy ones to
  drain.

Detection helpers `FindKarpenterInstallation` and `IsEKSAutoModeEnabled`
move from `install/guess/` to new `common/karpenter/` and
`common/eksautomode/` packages so the clusterinfo classifier can reuse
them. A generic `commonk8s.FindFirstDeployment` factors out the shared
pager+predicate scan, and `commonk8s.ExtractDeploymentVersion` factors
out the controller-image-tag → label fallback used by both detectors.

Karpenter NodePool ownership uses the broader
`autoscaling.datadoghq.com/created` label only (vs. uninstall's AND-pair
with `app.kubernetes.io/managed-by: kubectl-datadog`) so NodePools
managed by the Datadog cluster agent are also preserved by the
migration tool. Datadog-managed NodePools with no nodes yet (typical
right after install) are seeded into the snapshot with an empty Nodes
list so the migration tool sees the destination NodePools exist.

Fargate profile ownership reads tags via EKS DescribeFargateProfile;
the `managed-by: kubectl-datadog` tag is propagated automatically from
the CloudFormation stack tags, so no infrastructure change is needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: fix missed call site after merge of #2976

The merge of main into the feature branch (commit 87c6e46) brought in
PR #2976's `update.go`, which referenced `guess.FindKarpenterInstallation`
— the symbol our PR moved to `karpenter.FindInstallation`. The
resolution updated all other call sites but missed this one, so the
build broke on the merge commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: pass *Deployment to predicates

The pager-driven scan in commonk8s.FindFirstDeployment yields
*appsv1.Deployment values out of EachListItem, but the predicate
parameter was a value type — forcing a several-hundred-byte struct
copy on every iteration. Switch the predicate signature (and
ExtractDeploymentVersion) to take a pointer, eliminating the copy
in the per-iteration callback.

Container-level predicates (isControllerContainer,
isClusterAutoscalerContainer) keep value semantics because
slices.ContainsFunc requires func(E) bool for []E.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: table-drive FindFirstDeployment tests

Collapse the three predicate-driven tests (NoMatch, ReturnsFirstMatch,
ShortCircuits) into a single table that pins both the returned
Deployment and the predicate-call count per row. The short-circuit
invariant becomes a column rather than a dedicated test, and the row
shape made it cheap to add three previously-uncovered cases (empty
cluster, last deployment matches, multiple matches → first wins).

PropagatesListError stays separate: its setup (PrependReactor) and
assertions (ErrorIs) diverge from the predicate-counting flow.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: centralize managed-by tag constants

The Datadog ownership tag (`managed-by: kubectl-datadog`) is written
on CloudFormation stacks by `aws.buildTags` and propagated by CFN to
the EKS Fargate profile resources. The classifier in clusterinfo reads
those propagated tags to flag Fargate profiles as ManagedByDatadog.

Both ends previously embedded the same string literals; a rename in
buildTags would have silently broken classification. Hoist the pair
to exported constants `aws.ManagedByTag` / `aws.ManagedByTagValue`
and reference them from both writer and reader.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: extract cluster-autoscaler detector to its own package

Mirror the karpenter package's shape — Installation type +
FindInstallation function + private matchesDeployment / matchesContainer
predicates — for the cluster-autoscaler detector, which had stayed
inline in clusterinfo. Both detectors now answer "is the X controller
running on this cluster?" with the same surface and the same package
layout, eliminating the asymmetry that was masking the duplicated
fingerprint pattern.

The unit-level coverage (label variants, image-substring match, version
extraction with image-tag → label fallback, scaled-to-zero treated as
absent) moves to the new common/clusterautoscaler/clusterautoscaler_test.go
table-driven tests. classify_test.go keeps a single integration smoke
test verifying the snapshot wires the detection through.

karpenter.go's predicates are renamed for symmetry: matchesController →
matchesDeployment, isControllerContainer → matchesContainer. Both packages
now expose the same internal vocabulary.

clusterautoscaler.Installation has no IsOwn / InstalledBy /
InstallerVersion fields, on purpose: kubectl-datadog never installs
cluster-autoscaler, only detects it. The asymmetry with karpenter.Installation
reflects an actual behavioural asymmetry.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: list NodePools via the typed client

The kubectl-datadog binary already imports `karpv1 "sigs.k8s.io/karpenter/pkg/apis/v1"`
(via cluster/k8s/nodepool.go and cluster/common/clients/clients.go which
registers `karpv1.NodePool` and `karpv1.NodePoolList` on the controller-runtime
scheme). The justification for going through `unstructured.UnstructuredList`
in `enrichKarpenterOwnership` was therefore wrong — replace it with a typed
`karpv1.NodePoolList` and drop the unstructured import.

The fake controller-runtime client in classify_test.go is updated to mirror
the production scheme (typed NodePool/NodePoolList registration).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: drop redundant empty-bucket guard

`range` over a nil or empty map is a no-op in Go, so the early-return
guard in enrichFargateOwnership was dead code. The function only reads
the bucket (it never initialises it), so no side effect is at risk.

The analogous guard in enrichKarpenterOwnership stays — it prevents
creating an empty NodeManagerKarpenter bucket when no Datadog NodePools
exist, which is a load-bearing semantic.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: gofmt clusterautoscaler_test.go

Struct-field alignment fix that go fmt picked up — the dd-gitlab
check_formatting job runs `make fmt && git diff --exit-code`.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* [CASCL-1304] kubectl-datadog: record cluster ARN and AWS region

Per the Slack discussion with Cedric on PR #2980, surface the cluster
identifier in the snapshot so a downstream tool can locate the cluster
unambiguously (the ARN embeds the AWS account, region and short name).

Classify gains a single EKS DescribeCluster call up front, parses the
ARN with aws/arn.Parse to derive the region, and populates two new
fields on ClusterInfo (`clusterArn` / `region`, both `omitempty`). The
EKSDescriber interface grows to expose DescribeCluster alongside the
existing DescribeFargateProfile so the test fake can substitute both.

Best-effort: a DescribeCluster error or a malformed ARN logs a warning
and leaves the fields empty rather than failing the snapshot — same
contract as the other autoscaling detectors.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

…rn (#3012)

* kubectl-datadog: extract EKS helpers to common/eks/

Continue the redistribution of `guess/` started by PRs #2980 and #3000:
move every helper that operates on an EKS cluster object or the EKS API
into a dedicated `common/eks/` package. After this commit, `common/eks/`
contains:
  - authmode.go (was guess/clusterauthmode.go)
  - podidentityagent.go (was guess/ekspodidentityagent.go)
  - oidcprovider.go (was guess/oidcprovider.go)
  - privatesubnets.go (was guess/privatesubnets.go)

Import alias `commoneks` is used to avoid colliding with the existing
`github.com/aws/aws-sdk-go-v2/service/eks` (aliased `eks`).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: consolidate aws-auth into common/awsauth/

`common/aws/aws-auth.go` was misnamed: it manipulates a Kubernetes
ConfigMap (`kube-system/aws-auth`), not an AWS-SDK resource. Together
with `guess/aws-auth.go` (read-only presence check), it belongs in a
dedicated `common/awsauth/` package: both files operate on the same
ConfigMap.

Function names lose the now-redundant `AwsAuth` prefix:
  - `IsAwsAuthConfigMapPresent` -> `IsConfigMapPresent`
  - `EnsureAwsAuthRole`         -> `EnsureRole`
  - `RemoveAwsAuthRole`         -> `RemoveRole`

`common/aws/` now contains only cloudformation.go (pure AWS-SDK).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: fold clustername into common/clients/

The only caller of `guess.GetClusterNameFromKubeconfig` is the wrapper
`clients.GetClusterNameFromKubeconfig` in `common/clients/clients.go`.
Move the helper next to its caller as an unexported function
`clusterNameFromKubeconfig`. The public API of `common/clients/` is
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: carve out karpenter package

Consolidate everything Karpenter-shaped into `common/karpenter/`,
alongside the existing detection helper:

- Intermediate model: NodePoolsSet, EC2NodeClass, NodePool,
  MetadataOptions, BlockDeviceMapping (from guess/nodepoolsset.go)
- Producers from EKS node groups: GetNodeGroupsProperties (from
  guess/nodegroupproperties.go -> fromnodegroups.go)
- Producers from running k8s Nodes: GetNodesProperties (from
  guess/nodesproperties.go -> fromnodes.go)
- CR builders: CreateOrUpdateEC2NodeClass, CreateOrUpdateNodePool
  (from cluster/k8s/{ec2nodeclass,nodepool}.go)

`cluster/k8s/` is gone (it was misnamed: those files build Karpenter
CRDs, they aren't generic k8s primitives). `common/k8s/` keeps its
narrow scope: generic object CRUD + deployment-finder.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* kubectl-datadog: awsauth: extract ConfigMap name/namespace constants

`kube-system` and `aws-auth` each appeared 5 times across the three
functions. Promote them to package-level constants so the package's
single-ConfigMap scope is explicit at a glance.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>