fix(eks): the defaultChild of a KubernetesManifest is not a `CfnR…

…esource` (#18052)

The type of `node.defaultChild` is `KubernetesManifest` and not a `CfnResource`, preventing users from using escape hatches in the standard way.

Fixes #9921.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/aws-eks/lib/k8s-manifest.ts

@@ -139,7 +139,7 @@ export class KubernetesManifest extends CoreConstruct {
       this.injectIngressAlbAnnotations(props.manifest, props.ingressAlbScheme ?? AlbScheme.INTERNAL);
     }
 
-    new CustomResource(this, 'Resource', {
+    const customResource = new CustomResource(this, 'Resource', {
       serviceToken: provider.serviceToken,
       resourceType: KubernetesManifest.RESOURCE_TYPE,
       properties: {
@@ -154,6 +154,8 @@ export class KubernetesManifest extends CoreConstruct {
         SkipValidation: props.skipValidation,
       },
     });
+
+    this.node.defaultChild = customResource.node.defaultChild;
   }
 
   /**

packages/@aws-cdk/aws-eks/test/k8s-manifest.test.ts

@@ -1,6 +1,6 @@
 import '@aws-cdk/assert-internal/jest';
 import { SynthUtils } from '@aws-cdk/assert-internal';
-import { Stack } from '@aws-cdk/core';
+import { CfnResource, Stack } from '@aws-cdk/core';
 import { Cluster, KubernetesManifest, KubernetesVersion, HelmChart } from '../lib';
 import { testFixtureNoVpc, testFixtureCluster } from './util';
 
@@ -109,6 +109,17 @@ describe('k8s manifest', () => {
 
   });
 
+  test('default child is a CfnResource', () => {
+    const stack = new Stack();
+    const cluster = Cluster.fromClusterAttributes(stack, 'MyCluster', {
+      clusterName: 'my-cluster-name',
+      kubectlRoleArn: 'arn:aws:iam::1111111:role/iam-role-that-has-masters-access',
+    });
+
+    const manifest = cluster.addManifest('foo', { bar: 2334 });
+    expect(manifest.node.defaultChild).toBeInstanceOf(CfnResource);
+  });
+
   describe('prune labels', () => {
 
     test('base case', () => {