Merge pull request #3252 from pydctw/fix-multitenacy-doc-code

Update multitenancy doc

Author: k8s-ci-robot

docs/book/src/topics/multitenancy.md

@@ -158,7 +158,6 @@ spec:
   roleARN: arn:aws:iam::11122233344:role/multi-tenancy-role
   sessionName: multi-tenancy-role-session
   sourceidentityRef:
-    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
     kind: AWSClusterControllerIdentity
     name: default
 ---
@@ -172,18 +171,15 @@ spec:
   roleARN: arn:aws:iam::11122233355:role/multi-tenancy-nested-role
   sessionName: multi-tenancy-nested-role-session
   sourceidentityRef:
-    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
     kind: AWSClusterRoleIdentity
     name: multi-tenancy-role
 ```
 
-## Secure Access to Identitys
-`allowedNamespaces` field is used to grant access to the namespaces to use Identitys.
+## Secure Access to Identities
+`allowedNamespaces` field is used to grant access to the namespaces to use Identities.
 Only AWSClusters that are created in one of the Identity's allowed namespaces can use that Identity.
 `allowedNamespaces` are defined by providing either a list of namespaces or label selector to select namespaces.
 
-Note that the `capa-eks-control-plane-system` namespace will need to be included in the allow namespace list and/or have labels added to allow access to identities used by AWSClusters.
-
 ### Examples
 
 An empty `allowedNamespaces` indicates that the Identity can be used by all namespaces.
@@ -245,7 +241,7 @@ allowedNamespaces:
   selector: {}
 ```
 
-**Important** The default behaviour of an empty label selector is to match all objects, however here we do not follow that behavior to avoid unintended access to the identitys.
+**Important** The default behaviour of an empty label selector is to match all objects, however here we do not follow that behavior to avoid unintended access to the identities.
 This is consistent with core cluster API selectors, e.g., Machine and ClusterResourceSet selectors. The result of matchLabels and matchExpressions are ANDed.
 
 

exp/controlleridentitycreator/awscontrolleridentity_controller_test.go

@@ -29,8 +29,8 @@ import (
 	infrav1 "sigs.k8s.io/cluster-api-provider-aws/api/v1beta1"
 )
 
-func TestAWSInstanceStateController(t *testing.T) {
-	t.Run("should maintain list of cluster queue URLs and reconcile failing machines", func(t *testing.T) {
+func TestAWSControllerIdentityController(t *testing.T) {
+	t.Run("should create AWSClusterControllerIdentity when identityRef is not specified", func(t *testing.T) {
 		g := NewWithT(t)
 		ctx := context.Background()