Add StreamConsumer resource support

[bjorn-stange-expel]

Resolves aws-controllers-k8s/community#2844

Why?

The kinesis-controller currently only manages Stream resources. Kinesis enhanced fan-out requires registering stream consumers (RegisterStreamConsumer), which today has to be done outside Kubernetes. This PR adds a StreamConsumer custom resource so consumers can be managed declaratively alongside their streams.

What changed?

All controller code is generated by ACK code-generator (v0.61.0) — the source change is in generator.yaml, which maps a new StreamConsumer resource to the consumer APIs:

• RegisterStreamConsumer (create), DescribeStreamConsumer (read one), DeregisterStreamConsumer (delete). There is no update API — consumers are immutable, so sdkUpdate returns a terminal NotImplemented.
• consumerName is the primary key. streamARN supports ACK resource references, so a consumer can point at its stream with spec.streamRef.from.name instead of a hard-coded ARN.
• The ResourceSynced condition is set once ConsumerStatus is ACTIVE.
• Tag ensure is ignored for this resource (tags.ignore: true). The Kinesis API recently added consumer tagging (Tags on RegisterStreamConsumer, plus TagResource/ListTagsForResource), but those operations don't exist yet in the aws-sdk-go-v2/service/kinesis version this controller is generated against, so tag support isn't generatable today. A natural follow-up once the SDK pin is bumped.

Everything else (apis/, pkg/resource/stream_consumer/, CRDs, RBAC, helm) is generated output. Release version was kept at v1.3.2 so no release artifacts churn.

Also adds an e2e test (test_stream_consumer.py) that creates a Stream, registers a consumer against it via streamRef, verifies the consumer goes ACTIVE with its ARN in status, and tears both down.

Verification

• go build ./... passes; gofmt clean
• go test ./... passes (no unit test files in this repo; e2e lives in test/e2e)
• Generated with the pinned toolchain: code-generator v0.61.0, runtime v0.61.0, matching upstream main
• e2e test passed against real AWS (2026-07-08): built the controller image locally, installed it into a kind cluster via the helm chart, and ran pytest e2e/tests/test_stream_consumer.py against us-east-1. Full CRUD verified in 2m02s — Stream created, consumer registered via streamRef reference resolution, went ACTIVE with ResourceSynced=True and status.consumerARN matching the AWS-side ARN, then deregistered and cleaned up (no leaked resources).

e2e/tests/test_stream_consumer.py::TestStreamConsumer::test_crud PASSED
================== 1 passed, 12 warnings in 122.81s (0:02:02) ==================

🤖 Generated with Claude Code

[ack-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: bjorn-stange-expel
Once this PR has been reviewed and has the lgtm label, please assign jlbutler for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ack-prow]

Hi @bjorn-stange-expel. Thanks for your PR.

I'm waiting for a aws-controllers-k8s member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.