instanceRole still created when skipDefaultNodeGroup is enabled.

[ringods]

What happened?

Customer reports he doesn't pass an instanceRole or instanceRoles because he enabled skipDefaultNodeGroup (actually the skip_default_node_group in the Python SDK). They don't want our code to still create an instance role.

Example

Role created:

pulumi-eks/nodejs/eks/cluster.ts

Lines 782 to 802 in 161e7af

	const instanceRole = new ServiceRole(
	`${name}-instanceRole`,
	{
	service: pulumi.interpolate`ec2.${dnsSuffix}`,
	managedPolicyArns: [
	{
	id: "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
	arn: pulumi.interpolate`arn:${partition}:iam::aws:policy/AmazonEKSWorkerNodePolicy`,
	},
	{
	id: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
	arn: pulumi.interpolate`arn:${partition}:iam::aws:policy/AmazonEKS_CNI_Policy`,
	},
	{
	id: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
	arn: pulumi.interpolate`arn:${partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly`,
	},
	],
	},
	{ parent, provider },
	).role;

Profile skipped due to skipDefaultNodeGroup:

pulumi-eks/nodejs/eks/cluster.ts

Lines 822 to 830 in 161e7af

	// Create an instance profile if using a default node group
	if (!skipDefaultNodeGroup) {
	nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(
	name,
	parent,
	instanceRole,
	args.instanceProfileName,
	);
	}

Output of pulumi about

N/A

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[flostadler]

One workaround is setting the instance_roles parameter to an empty array:

from pulumi_aws import s3
import pulumi_eks as eks

cluster2 = eks.Cluster('eks-cluster', instance_roles=[])

I'd argue that this is not really intuitive, but removing that role now when skipDefaultNodeGroup is true would be a breaking change because some users might use the role through the instanceRoles output.

[flostadler]

We could add an additional flag skipInstanceRole, but this would add clutter to the API surface of the cluster. I'd rather take this small enhancement with the next major release