Do not create instance role when skipDefaultNodeGroup is enabled (#…

…1411)

docs/eks-v3-migration.md

@@ -159,10 +159,14 @@ The `NodeGroup` and `NodeGroupV2` components now accept inputs for the following
 - `taints`
 - `nodeAssociatePublicIpAddress`
 
-If you're using Go you'll need to adjust your program to handle those types being inputs.
+If you are using Go you will need to adjust your program to handle those types being inputs.
 
 ### Default Security Groups can now be disabled
 If you do not need the default cluster and node security groups you can disable those now
 with the `skipDefaultSecurityGroups` flag. Those security groups will not be created when setting that flag to true.
 
 Because of this change, the `clusterSecurityGroup`, `nodeSecurityGroup` and `clusterIngressRule` properties are optional now. If you're using those outputs you'll need to update your code accordingly.
+
+### Cluster does not create extraneous node IAM role if `skipDefaultNodeGroup` is set to `true`
+
+Previously the Cluster component created a default node IAM role even if `skipDefaultNodeGroup` was set to `true`. This role gets correctly omitted now if you are specifying `skipDefaultNodeGroup`.

examples/custom-managed-nodegroup/index.ts

@@ -31,6 +31,8 @@ const cluster = new eks.Cluster("example-managed-nodegroup", {
   }
 });
 
+export const defaultInstanceRoles = cluster.instanceRoles;
+
 // Export the cluster's kubeconfig.
 export const kubeconfig = cluster.kubeconfig;
 

examples/examples_nodejs_test.go

@@ -829,6 +829,9 @@ func TestAccManagedNodeGroupCustom(t *testing.T) {
 					info.Outputs["kubeconfig"],
 				)
 
+				defaultInstanceRoles := info.Outputs["defaultInstanceRoles"]
+				assert.Empty(t, defaultInstanceRoles, "Expected no instanceRoles to be created")
+
 				expectedLaunchTemplateName := info.Outputs["launchTemplateName"]
 
 				var launchTemplateFound bool = false

nodejs/eks/cluster.ts

@@ -847,7 +847,7 @@ export function createCore(
         }
         instanceRoles = pulumi.output([args.instanceRole]);
         defaultInstanceRole = pulumi.output(args.instanceRole);
-    } else {
+    } else if (!args.skipDefaultNodeGroup) {
         const instanceRole = new ServiceRole(
             `${name}-instanceRole`,
             {
@@ -890,15 +890,14 @@ export function createCore(
             );
         }
 
-        // Create an instance profile if using a default node group
-        if (!skipDefaultNodeGroup) {
-            nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(
-                name,
-                parent,
-                instanceRole,
-                args.instanceProfileName,
-            );
-        }
+        nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(
+            name,
+            parent,
+            instanceRole,
+            args.instanceProfileName,
+        );
+    } else {
+        instanceRoles = pulumi.output([]);
     }
 
     let eksNodeAccess: k8s.core.v1.ConfigMap | undefined = undefined;

provider/provider_yaml_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestEksAuthModeUpgrade(t *testing.T) {
+	t.Skip("Temporarily skipping upgrade tests. Needs to be addressed in pulumi/pulumi-eks#1387")
 	t.Parallel()
 	if testing.Short() {
 		t.Skipf("Skipping in testing.Short() mode, assuming this is a CI run without credentials")