In the per-tunnel key system, the ipsec-key-rotate action currently assumes a fixed number of nodes. This is tuned to the conformance-ipsec-e2e workflow - but doesn't support the conformance-eks workflow, which uses a different number of nodes. Thus the eks workflow currently doesn't test the per-tunnel key system.

We should improve the key-rotate action, so that it supports workflows with any number of nodes.