Controller `Upgrade` procedure needs to be improved

[liwenwu-amazon]

The eksctl command to setup IRSA is missing the --role-name argument. It is not a bug but it makes the tool create a IAM role with a random name.
The manifest to deploy CRDs and the Gateway Controller has a ServiceAccount definition for gateway-api-controller though we are creating the latter using eksctl. Again, this is not an issue until it is. If you unveil a new version, say, deploy-v0.0.2.yaml, and a user deletes the old manifest with kubectl delete -f and then does a kubectl apply -f with the new manifest, user will end up with a ServiceAccount definition without the IRSA annotation and it will break things.

[mikhail-aws]

we to investigate how to deal with ServiceAccount