[aws-eks] fargate profile issue in aws-auth config map

[eduardomourar]

Whenever you use awsAuth.addRoleMapping(), the aws-auth config map is being replaced instead of appended within the EKS cluster.

Reproduction Steps

• Create a cluster:

    const cluster = new eks.Cluster(this, 'EksFargate', {
      clusterName: `${prefix}-eks`,
      mastersRole: clusterAdmin,
      vpc,
      defaultCapacity: 0,
      coreDnsComputeType: eks.CoreDnsComputeType.FARGATE,
      kubectlEnabled: true,
    });

    const fargateProfile: eks.FargateProfile = cluster.addFargateProfile('FargateProfile', {
      fargateProfileName: `${prefix}`,
      selectors: [
        { namespace: 'default' },
        { namespace: 'kube-system' },
      ],
      podExecutionRole: fargateProfileRole,
      subnetSelection: { subnets: vpc.privateSubnets },
    });

• You run kubectl edit cm aws-auth -n kube-system -o yaml:

  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      - system:node-proxier
      rolearn: arn:aws:iam::123456789012:role/MyFargatePodExecutionRole
      username: system:node:{{SessionName}}

• In a later CDK deployment:

    const clusterUser = iam.Role.fromRoleArn(this, 'ClusterUser',
      `arn:aws:iam::${this.account}:role/ClusterUser`
    );
    cluster.awsAuth.addRoleMapping(clusterUser, {
      username: 'cluster-user-viewer',
      groups: [],
    });

• Now the fargate profile execution role in not part of your aws-auth config map anymore.

Error Log

fargate-scheduler Misconfigured Fargate Profile: fargate profile <PROFILE_NAME> blocked for new launches due to: Pod execution role is not found in auth config or does not have all required permissions for launching fargate pods.

Environment

• CLI Version : 1.38.0
• Framework Version: 1.38.0
• OS : MacOS
• Language : TypeScript

Other

Workaround:

    cluster.awsAuth.addRoleMapping(fargateProfileRole, {
      username: 'system:node:{{SessionName}}',
      groups: [ 'system:bootstrappers', 'system:nodes', 'system:node-proxier' ],
    });

This is 🐛 Bug Report

[eladb]

Can you please paste your entire CDK app (the relevant portion).

I am not sure I understand your workflow.

[eladb]

Waiting for a response. Closing for now.

[eduardomourar]

Please, reopen this issue because it is quite important. Relevant code can be found here: https://play-with-cdk.com?s=81c92ad7d69044732f052b8f9a76d3ef