feat: add permissions for ECR Public container pulls to Auto Mode NodeRole (#8698)

feat: ECR Public authenticated pulls

Update the default EKS Auto Mode Node Role to allow authenticated pulls from ECR public.
This ensures that container pulls are not unnecessarily throttled due to
unauthenticated pulls.

Author: fletcherw

pkg/cfn/builder/roles/auto-mode-node-role.yaml

@@ -18,6 +18,7 @@ Resources:
               - sts:AssumeRole
       ManagedPolicyArns:
         - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly"
+        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonElasticContainerRegistryPublicReadOnly"
         - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy"
 
 Outputs: