fix: only add ECR Public perms in aws partition (#8709)

ECR Public doesn't exist in all partitions, so filter it out when
creating clusters elsewhere.

Author: fletcherw

pkg/cfn/builder/auto_mode.go

@@ -42,6 +42,9 @@ func AddAutoModeResources(clusterTemplate *gfn.Template, permissionsBoundary api
 		}
 		clusterTemplate.Resources[resourceName] = resource
 	}
+	for key, condition := range template.Conditions {
+		clusterTemplate.Conditions[key] = condition
+	}
 	for key, output := range template.Outputs {
 		clusterTemplate.Outputs[key] = output
 	}

pkg/cfn/builder/roles/auto-mode-node-role.yaml

@@ -1,5 +1,7 @@
 AWSTemplateFormatVersion: '2010-09-09'
 Description: 'Amazon EKS Karpenter NodeRole'
+Conditions:
+  IsAWSPartition: !Equals [!Ref "AWS::Partition", "aws"]
 Resources:
   AutoModeNodeRole:
     Type: AWS::IAM::Role
@@ -18,7 +20,7 @@ Resources:
               - sts:AssumeRole
       ManagedPolicyArns:
         - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly"
-        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonElasticContainerRegistryPublicReadOnly"
+        - !If [IsAWSPartition, !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonElasticContainerRegistryPublicReadOnly", !Ref "AWS::NoValue"]
         - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy"
 
 Outputs: