Advanced AI Prompt for Hardening EKS Nodes with Bottlerocket OS

Act as an EKS Security Engineer. Formulate a seamless migration strategy to transition EKS managed worker nodes from generic Amazon Linux 2 to the highly secure, container-optimized Bottlerocket OS. Provide the Terraform HCL defining an `aws_eks_node_group` pinned to [CLUSTER_VERSION] utilizing the `BOTTLEROCKET_x86_64` AMI type. Enforce that the root and data EBS volumes are cryptographically secured using the [KMS_KEY_ARN]. Configure the underlying Bottlerocket TOML user-data settings to reflect [ADMIN_CONTAINER_ENABLED] for the host-level admin container, bound to the [SSH_KEY_NAME] key pair for break-glass emergency access. Provide a heavily documented `kubectl cordon` and `drain` workflow to cycle the nodes without dropping active client connections.