Support first-class EKS IAM auth for multicluster remote secrets

Describe the feature request

Istio multi-primary multicluster setup uses istioctl create-remote-secret to let each istiod access the remote Kubernetes API for service discovery. The default flow creates a kubeconfig backed by a Kubernetes service account bearer token.

For EKS production environments, it would be useful to have a first-class AWS IAM based auth option for remote cluster access, similar to how Argo CD supports EKS auth with awsAuthConfig using fields like clusterName, roleARN, and profile`.

Today, Istio can technically consume kubeconfig exec, but this requires enabling: PILOT_INSECURE_MULTICLUSTER_KUBECONFIG_OPTIONS=exec

That is risky because generic kubeconfig exec allows command execution inside istiod. It also requires adding aws CLI or another credential plugin to the istiod image.

Kubernetes has moved away from legacy long-lived service account token workflows: TokenRequest/projected tokens became stable in v1.22, automatic creation of long-lived service account token Secrets stopped by default in v1.24, and long-lived tokens are now discouraged in favor of bounded tokens. Manually created long-lived token Secrets still work today, but they are not ideal for production security posture.

Feature request: provide a safer supported EKS IAM auth path for multicluster remote discovery, for example:

• istioctl create-remote-secret --auth-type=aws-iam --aws-cluster-name=... --aws-role-arn=...
• or a constrained built-in EKS credential provider in istiod
• or an officially documented pattern using IRSA/EKS Pod Identity and EKS access entries

The goal is to avoid long-lived Kubernetes bearer tokens and avoid enabling arbitrary kubeconfig exec.

Describe alternatives you've considered

1. Use default istioctl create-remote-secret.

• Simple, but stores long-lived Kubernetes API credentials.

1. Rotate short-lived TokenRequest tokens.

• Better security model, but requires custom automation.

1. Use kubeconfig exec with aws eks get-token.

• Works in theory, but requires enabling generic exec and modifying the istiod image.

1. Build a custom istiod image with an EKS credential helper.

• Possible, but not a standard Istio workflow.

Affected product area (please put an X in all that apply)

[ ] Ambient [ ] Docs [ ] Dual Stack [x] Installation [ ] Networking [ ] Performance and Scalability [ ] Extensions and Telemetry [x] Security [ ] Test and Release [x] User Experience [ ] Developer Infrastructure

Affected features (please put an X in all that apply)

[x] Multi Cluster [ ] Virtual Machine [ ] Multi Control Plane

Additional context