@pulumi/eks 1.0.0 → 1.0.1

package/README.md

@@ -7,22 +7,27 @@
 
 # Pulumi Amazon Web Services (AWS) EKS Components
 
-The Pulumi EKS library provides a Pulumi component that creates and manages the resources necessary to run an EKS Kubernetes cluster in AWS.
+The Pulumi EKS library provides a Pulumi component that creates and manages the resources necessary to run an EKS Kubernetes cluster in AWS. This component exposes the Crosswalk for AWS functionality documented in the [Pulumi Elastic Kubernetes Service guide](https://www.pulumi.com/docs/guides/crosswalk/aws/eks/) as a package available in all Pulumi languages.
+
 
 This includes:
 - The EKS cluster control plane.
 - The cluster's worker nodes configured as node groups, which are managed by an auto scaling group.
 - The AWS CNI Plugin [`aws-k8s-cni`](https://github.com/aws/amazon-vpc-cni-k8s/) to manage pod networking in Kubernetes.
 
-## Pre-Requisites
 
-1. [Install Pulumi](https://www.pulumi.com/docs/reference/install).
-1. [Install `kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) (v1.24.0 or higher).
-1. [Install AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) (>=v1.24.0 for v1 or >=2.7.0 for v2).
-1. [Install Node.js](https://nodejs.org/en/download/) (required even if using this library from another Pulumi language).
+<div>
+    <a href="https://www.pulumi.com/templates/kubernetes/aws/" title="Get Started">
+       <img src="https://www.pulumi.com/images/get-started.svg?" width="120">
+    </a>
+</div>
 
 ## Installing
 
+This package is available in many languages in the standard packaging formats.
+
+### Node.js (JavaScript/TypeScript)
+
 To use from JavaScript or TypeScript in Node.js, install it using either `npm`:
 
 ```bash
@@ -56,17 +61,17 @@ To use from .NET, install using `dotnet add package`:
 ## References
 
 * [Tutorial](https://www.pulumi.com/blog/easily-create-and-manage-aws-eks-kubernetes-clusters-with-pulumi/)
-* [Reference Documentation](https://www.pulumi.com/docs/reference/pkg/eks/)
+* [Reference Documentation](https://www.pulumi.com/registry/packages/eks/api-docs/)
 * [Examples](./examples)
-* [Crosswalk for AWS & EKS Guide](https://www.pulumi.com/docs/guides/crosswalk/aws/eks/)
+* [Crosswalk for AWS - EKS Guide](https://www.pulumi.com/docs/guides/crosswalk/aws/eks/)
 
-### Contributing
+## Contributing
 
 If you are interested in contributing, please see the [contributing docs][contributing].
 
-### Code of Conduct
+## Code of Conduct
 
-You can read the code of conduct [here][code-of-conduct].
+Please follow the [code of conduct][code-of-conduct].
 
 [contributing]: CONTRIBUTING.md
 [code-of-conduct]: CODE-OF-CONDUCT.md

package/cert-thumprint.d.ts

@@ -2,15 +2,15 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as http from "http";
 /**
-* Get the certificate thumprint of the issuing CA for the TLS enabled URL.
-*
-* This is used for OIDC provider configuration.
-*
-* See for more details:
-* - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
-* - https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
-* - https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
-* - https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c
-* - https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/aws/eks/#enabling-iam-roles-for-service-accounts
-*/
+ * Get the certificate thumprint of the issuing CA for the TLS enabled URL.
+ *
+ * This is used for OIDC provider configuration.
+ *
+ * See for more details:
+ * - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
+ * - https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
+ * - https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
+ * - https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c
+ * - https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/aws/eks/#enabling-iam-roles-for-service-accounts
+ */
 export declare function getIssuerCAThumbprint(issuerUrl: pulumi.Input<string>, agent: http.Agent): pulumi.Output<string>;

package/cert-thumprint.js

@@ -25,23 +25,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getIssuerCAThumbprint = void 0;
 const pulumi = require("@pulumi/pulumi");
 const https = require("https");
+const tls = require("tls");
 const url = require("url");
 const THUMBPRINT_MAX_RETRIES = 12;
 const THUMBPRINT_SLEEP_MILLISECOND_INTERVAL = 5000;
 /**
-* Get the certificate thumprint of the issuing CA for the TLS enabled URL.
-*
-* This is used for OIDC provider configuration.
-*
-* See for more details:
-* - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
-* - https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
-* - https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
-* - https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c
-* - https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/aws/eks/#enabling-iam-roles-for-service-accounts
-*/
+ * Get the certificate thumprint of the issuing CA for the TLS enabled URL.
+ *
+ * This is used for OIDC provider configuration.
+ *
+ * See for more details:
+ * - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
+ * - https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
+ * - https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
+ * - https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c
+ * - https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/aws/eks/#enabling-iam-roles-for-service-accounts
+ */
 function getIssuerCAThumbprint(issuerUrl, agent) {
-    return pulumi.output(issuerUrl).apply(issUrl => {
+    return pulumi.output(issuerUrl).apply((issUrl) => {
         return getThumbprint(issUrl, THUMBPRINT_MAX_RETRIES, THUMBPRINT_SLEEP_MILLISECOND_INTERVAL, agent);
     });
 }
@@ -77,20 +78,23 @@ function getThumbprint(issuerUrl, retriesLeft, interval, agent) {
                 const req = https
                     .get(options)
                     .on("error", reject)
-                    .on("socket", socket => {
+                    .on("socket", (socket) => {
+                    if (!(socket instanceof tls.TLSSocket)) {
+                        req.emit("error", new Error("socket is not of type TLSSocket"));
+                        return;
+                    }
                     socket.on("secureConnect", () => {
                         const certificate = socket.getPeerCertificate(true);
                         const fingerprint = findIntRootCACertificate(certificate).fingerprint;
                         // Check if certificate is valid
                         if (socket.authorized === false) {
-                            req.emit("error", new Error(socket.authorizationError));
-                            return req.abort();
+                            req.emit("error", socket.authorizationError);
+                            req.destroy();
+                            return;
                         }
-                        resolve(// Ref: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
-                        fingerprint
-                            .split(":")
-                            .join("")
-                            .toLowerCase());
+                        resolve(
+                        // Ref: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
+                        fingerprint.split(":").join("").toLowerCase());
                     });
                 });
                 req.end();
@@ -99,7 +103,7 @@ function getThumbprint(issuerUrl, retriesLeft, interval, agent) {
         catch (e) {
             if (retriesLeft) {
                 pulumi.log.info(`Waiting for cert issuer URL(${THUMBPRINT_MAX_RETRIES - retriesLeft})`, undefined, undefined, true);
-                yield new Promise(resolve => setTimeout(resolve, interval));
+                yield new Promise((resolve) => setTimeout(resolve, interval));
                 return getThumbprint(issuerUrl, retriesLeft - 1, interval, agent);
             }
         }

package/cert-thumprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"cert-thumprint.js","sourceRoot":"","sources":["../cert-thumprint.ts"],"names":[],"mappings":";AAAA,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;;;;;;;;;;AAEjC,yCAAyC;AAEzC,+BAA+B;AAE/B,2BAA2B;AAE3B,MAAM,sBAAsB,GAAW,EAAE,CAAC;AAC1C,MAAM,qCAAqC,GAAW,IAAI,CAAC;AAE3D;;;;;;;;;;;EAWE;AACF,SAAgB,qBAAqB,CACjC,SAA+B,EAC/B,KAAiB;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAC3C,OAAO,aAAa,CAChB,MAAM,EACN,sBAAsB,EACtB,qCAAqC,EACrC,KAAK,CACR,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAZD,sDAYC;AAED,gEAAgE;AAEhE,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,SAAS,wBAAwB,CAAC,WAAwC;;IACtE,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,IAAI,QAAQ,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,iBAAiB,CAAC;IAEvC,4FAA4F;IAC5F,yEAAyE;IACzE,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,aAAK,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,iBAAiB,0CAAE,WAAW,CAAA,EAAG;QAChE,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;KACjC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,+GAA+G;AAC/G,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,kDAAkD;AAClD,SAAe,aAAa,CACxB,SAAiB,EACjB,WAAmB,EACnB,QAAgB,EAChB,KAAiB;;QAEjB,8EAA8E;QAC9E,IAAI;YACA,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACzC,MAAM,OAAO,mCACN,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KACvB,KAAK,EAAE,KAAK,GACf,CAAC;gBACF,MAAM,GAAG,GAAG,KAAK;qBACZ,GAAG,CAAC,OAAO,CAAC;qBACZ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;qBACnB,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE;wBAC5B,MAAM,WAAW,GAAgC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;wBACjF,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC;wBACtE,gCAAgC;wBAChC,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,EAAE;4BAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;4BACxD,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;yBACtB;wBACD,OAAO,CAAE,8GAA8G;wBACnH,WAAW;6BACV,KAAK,CAAC,GAAG,CAAC;6BACV,IAAI,CAAC,EAAE,CAAC;6BACR,WAAW,EAAE,CACjB,CAAC;oBACN,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;gBACP,GAAG,CAAC,GAAG,EAAE,CAAC;YACd,CAAC,CAAC,CAAC;SACN;QAAC,OAAO,CAAC,EAAE;YACR,IAAI,WAAW,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,sBAAsB,GAAG,WAAW,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACpH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC5D,OAAO,aAAa,CAAC,SAAS,EAAE,WAAW,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;aACrE;SACJ;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,GAAG,SAAS,CAAC,CAAC;IACnG,CAAC;CAAA"}
+{"version":3,"file":"cert-thumprint.js","sourceRoot":"","sources":["../cert-thumprint.ts"],"names":[],"mappings":";AAAA,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;;;;;;;;;;AAEjC,yCAAyC;AAEzC,+BAA+B;AAC/B,2BAA2B;AAC3B,2BAA2B;AAE3B,MAAM,sBAAsB,GAAW,EAAE,CAAC;AAC1C,MAAM,qCAAqC,GAAW,IAAI,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,SAAgB,qBAAqB,CACjC,SAA+B,EAC/B,KAAiB;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7C,OAAO,aAAa,CAChB,MAAM,EACN,sBAAsB,EACtB,qCAAqC,EACrC,KAAK,CACR,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAZD,sDAYC;AAED,gEAAgE;AAEhE,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,SAAS,wBAAwB,CAC7B,WAAwC;;IAExC,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,IAAI,QAAQ,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,iBAAiB,CAAC;IAEvC,4FAA4F;IAC5F,yEAAyE;IACzE,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,aAAK,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,iBAAiB,0CAAE,WAAW,CAAA,EAAE;QAC/D,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;KACjC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,+GAA+G;AAC/G,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,kDAAkD;AAClD,SAAe,aAAa,CACxB,SAAiB,EACjB,WAAmB,EACnB,QAAgB,EAChB,KAAiB;;QAEjB,8EAA8E;QAC9E,IAAI;YACA,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACzC,MAAM,OAAO,mCACN,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KACvB,KAAK,EAAE,KAAK,GACf,CAAC;gBACF,MAAM,GAAG,GAAG,KAAK;qBACZ,GAAG,CAAC,OAAO,CAAC;qBACZ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;qBACnB,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;oBACrB,IAAI,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,EAAE;wBACpC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;wBAChE,OAAO;qBACV;oBACD,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE;wBAC5B,MAAM,WAAW,GACb,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;wBACpC,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC;wBACtE,gCAAgC;wBAChC,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,EAAE;4BAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;4BAC7C,GAAG,CAAC,OAAO,EAAE,CAAC;4BACd,OAAO;yBACV;wBACD,OAAO;wBACH,8GAA8G;wBAC9G,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAChD,CAAC;oBACN,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;gBACP,GAAG,CAAC,GAAG,EAAE,CAAC;YACd,CAAC,CAAC,CAAC;SACN;QAAC,OAAO,CAAC,EAAE;YACR,IAAI,WAAW,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,IAAI,CACX,+BAA+B,sBAAsB,GAAG,WAAW,GAAG,EACtE,SAAS,EACT,SAAS,EACT,IAAI,CACP,CAAC;gBACF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC9D,OAAO,aAAa,CAAC,SAAS,EAAE,WAAW,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;aACrE;SACJ;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,GAAG,SAAS,CAAC,CAAC;IACnG,CAAC;CAAA"}

package/cluster.js

@@ -57,42 +57,46 @@ function createOrGetInstanceProfile(name, parent, instanceRoleName, instanceProf
 /** @internal */
 function generateKubeconfig(clusterName, clusterEndpoint, certData, opts) {
     let args = ["eks", "get-token", "--cluster-name", clusterName];
-    const env = [{
-            "name": "KUBERNETES_EXEC_INFO",
-            "value": `{"apiVersion": "client.authentication.k8s.io/v1beta1"}`,
-        }];
+    const env = [
+        {
+            name: "KUBERNETES_EXEC_INFO",
+            value: `{"apiVersion": "client.authentication.k8s.io/v1beta1"}`,
+        },
+    ];
     if (opts === null || opts === void 0 ? void 0 : opts.roleArn) {
         args = [...args, "--role", opts.roleArn];
     }
     if (opts === null || opts === void 0 ? void 0 : opts.profileName) {
         env.push({
-            "name": "AWS_PROFILE",
-            "value": opts.profileName,
+            name: "AWS_PROFILE",
+            value: opts.profileName,
         });
     }
-    return pulumi.all([
-        args,
-        env,
-    ]).apply(([tokenArgs, envvars]) => {
+    return pulumi.all([args, env]).apply(([tokenArgs, envvars]) => {
         return {
             apiVersion: "v1",
-            clusters: [{
+            clusters: [
+                {
                     cluster: {
                         server: clusterEndpoint,
                         "certificate-authority-data": certData,
                     },
                     name: "kubernetes",
-                }],
-            contexts: [{
+                },
+            ],
+            contexts: [
+                {
                     context: {
                         cluster: "kubernetes",
                         user: "aws",
                     },
                     name: "aws",
-                }],
+                },
+            ],
             "current-context": "aws",
             kind: "Config",
-            users: [{
+            users: [
+                {
                     name: "aws",
                     user: {
                         exec: {
@@ -102,7 +106,8 @@ function generateKubeconfig(clusterName, clusterEndpoint, certData, opts) {
                             env: envvars,
                         },
                     },
-                }],
+                },
+            ],
         };
     });
 }
@@ -182,7 +187,7 @@ function getRoleProvider(name, region, profile, parent, provider) {
             roleArn: iamRole.arn.apply((arn) => __awaiter(this, void 0, void 0, function* () {
                 // wait 30 seconds to assume the IAM Role https://github.com/pulumi/pulumi-aws/issues/673
                 if (!pulumi.runtime.isDryRun()) {
-                    yield new Promise(resolve => setTimeout(resolve, 30 * 1000));
+                    yield new Promise((resolve) => setTimeout(resolve, 30 * 1000));
                 }
                 return arn;
             })),
@@ -210,18 +215,19 @@ function createCore(name, args, parent, provider) {
     if (args.subnetIds && (args.publicSubnetIds || args.privateSubnetIds)) {
         throw new Error("subnetIds, and the use of publicSubnetIds and/or privateSubnetIds are mutually exclusive. Choose a single approach.");
     }
-    if (args.nodeGroupOptions && (args.nodeSubnetIds ||
-        args.nodeAssociatePublicIpAddress ||
-        args.instanceType ||
-        args.instanceProfileName ||
-        args.nodePublicKey ||
-        args.nodeRootVolumeSize ||
-        args.nodeUserData ||
-        args.minSize ||
-        args.maxSize ||
-        args.desiredCapacity ||
-        args.nodeAmiId ||
-        args.gpu)) {
+    if (args.nodeGroupOptions &&
+        (args.nodeSubnetIds ||
+            args.nodeAssociatePublicIpAddress ||
+            args.instanceType ||
+            args.instanceProfileName ||
+            args.nodePublicKey ||
+            args.nodeRootVolumeSize ||
+            args.nodeUserData ||
+            args.minSize ||
+            args.maxSize ||
+            args.desiredCapacity ||
+            args.nodeAmiId ||
+            args.gpu)) {
         throw new Error("Setting nodeGroupOptions, and any set of singular node group option(s) on the cluster, is mutually exclusive. Choose a single approach.");
     }
     // Configure the node group options.
@@ -240,7 +246,7 @@ function createCore(name, args, parent, provider) {
         gpu: args.gpu,
         version: args.version,
     };
-    const partition = pulumi.output(aws.getPartition({ provider })).partition;
+    const { partition, dnsSuffix } = pulumi.output(aws.getPartition({ provider }));
     // Configure default networking architecture.
     let vpcId = args.vpcId;
     let clusterSubnetIds = [];
@@ -248,8 +254,10 @@ function createCore(name, args, parent, provider) {
     if (!args.vpcId) {
         const invokeOpts = { parent, async: true };
         const vpc = aws.ec2.getVpc({ default: true }, invokeOpts);
-        vpcId = vpc.then(v => v.id);
-        clusterSubnetIds = vpc.then(v => aws.ec2.getSubnets({ filters: [{ name: "vpc-id", values: [v.id] }] }, invokeOpts)).then(subnets => subnets.ids);
+        vpcId = vpc.then((v) => v.id);
+        clusterSubnetIds = vpc
+            .then((v) => aws.ec2.getSubnets({ filters: [{ name: "vpc-id", values: [v.id] }] }, invokeOpts))
+            .then((subnets) => subnets.ids);
     }
     // Form the subnetIds to use on the cluster from either:
     //  - subnetIds
@@ -258,10 +266,9 @@ function createCore(name, args, parent, provider) {
         clusterSubnetIds = args.subnetIds;
     }
     else if (args.publicSubnetIds !== undefined || args.privateSubnetIds !== undefined) {
-        clusterSubnetIds = pulumi.all([
-            args.publicSubnetIds || [],
-            args.privateSubnetIds || [],
-        ]).apply(([publicIds, privateIds]) => {
+        clusterSubnetIds = pulumi
+            .all([args.publicSubnetIds || [], args.privateSubnetIds || []])
+            .apply(([publicIds, privateIds]) => {
             return [...publicIds, ...privateIds];
         });
     }
@@ -271,7 +278,7 @@ function createCore(name, args, parent, provider) {
         eksRole = pulumi.output(args.serviceRole);
     }
     else {
-        eksRole = (new servicerole_1.ServiceRole(`${name}-eksRole`, {
+        eksRole = new servicerole_1.ServiceRole(`${name}-eksRole`, {
             service: "eks.amazonaws.com",
             description: "Allows EKS to manage clusters on your behalf.",
             managedPolicyArns: [
@@ -280,7 +287,7 @@ function createCore(name, args, parent, provider) {
                     arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEKSClusterPolicy`,
                 },
             ],
-        }, { parent, provider })).role;
+        }, { parent, provider }).role;
     }
     // Create the EKS cluster security group
     let eksClusterSecurityGroup;
@@ -291,10 +298,7 @@ function createCore(name, args, parent, provider) {
         eksClusterSecurityGroup = new aws.ec2.SecurityGroup(`${name}-eksClusterSecurityGroup`, {
             vpcId: vpcId,
             revokeRulesOnDelete: true,
-            tags: pulumi.all([
-                args.tags,
-                args.clusterSecurityGroupTags,
-            ]).apply(([tags, clusterSecurityGroupTags]) => (Object.assign(Object.assign({ "Name": `${name}-eksClusterSecurityGroup` }, clusterSecurityGroupTags), tags))),
+            tags: pulumi.all([args.tags, args.clusterSecurityGroupTags]).apply(([tags, clusterSecurityGroupTags]) => (Object.assign(Object.assign({ Name: `${name}-eksClusterSecurityGroup` }, clusterSecurityGroupTags), tags))),
         }, { parent, provider });
         const eksClusterInternetEgressRule = new aws.ec2.SecurityGroupRule(`${name}-eksClusterInternetEgressRule`, {
             description: "Allow internet access.",
@@ -311,20 +315,24 @@ function createCore(name, args, parent, provider) {
     let encryptionProvider;
     let encryptionConfig;
     if (args.encryptionConfigKeyArn) {
-        encryptionProvider = pulumi.output(args.encryptionConfigKeyArn).apply(keyArn => ({ keyArn }));
-        encryptionConfig = encryptionProvider.apply(ep => ({
+        encryptionProvider = pulumi.output(args.encryptionConfigKeyArn).apply((keyArn) => ({
+            keyArn,
+        }));
+        encryptionConfig = encryptionProvider.apply((ep) => ({
             provider: ep,
             resources: ["secrets"],
         }));
     }
     let kubernetesNetworkConfig;
     if (args.kubernetesServiceIpAddressRange) {
-        kubernetesNetworkConfig = pulumi.output(args.kubernetesServiceIpAddressRange).apply(serviceIpv4Cidr => ({ serviceIpv4Cidr }));
+        kubernetesNetworkConfig = pulumi
+            .output(args.kubernetesServiceIpAddressRange)
+            .apply((serviceIpv4Cidr) => ({ serviceIpv4Cidr }));
     }
     // Create the EKS cluster
     const eksCluster = new aws.eks.Cluster(`${name}-eksCluster`, {
         name: args.name,
-        roleArn: eksRole.apply(r => r.arn),
+        roleArn: eksRole.apply((r) => r.arn),
         vpcConfig: {
             securityGroupIds: [eksClusterSecurityGroup.id],
             subnetIds: clusterSubnetIds,
@@ -335,10 +343,7 @@ function createCore(name, args, parent, provider) {
         version: args.version,
         enabledClusterLogTypes: args.enabledClusterLogTypes,
         defaultAddonsToRemoves: args.defaultAddonsToRemove,
-        tags: pulumi.all([
-            args.tags,
-            args.clusterTags,
-        ]).apply(([tags, clusterTags]) => (Object.assign(Object.assign({ "Name": `${name}-eksCluster` }, clusterTags), tags))),
+        tags: pulumi.all([args.tags, args.clusterTags]).apply(([tags, clusterTags]) => (Object.assign(Object.assign({ Name: `${name}-eksCluster` }, clusterTags), tags))),
         encryptionConfig,
         kubernetesNetworkConfig,
     }, {
@@ -364,8 +369,7 @@ function createCore(name, args, parent, provider) {
                 try {
                     yield new Promise((resolve, reject) => {
                         const options = Object.assign(Object.assign({}, url.parse(healthz)), { rejectUnauthorized: false, agent: agent, timeout: reqTimeoutMilliseconds });
-                        const req = https
-                            .request(options, res => {
+                        const req = https.request(options, (res) => {
                             res.statusCode === 200 ? resolve() : reject(); // Verify healthz returns 200
                         });
                         req.on("timeout", reject);
@@ -376,10 +380,10 @@ function createCore(name, args, parent, provider) {
                     break;
                 }
                 catch (e) {
-                    const retrySecondsLeft = (maxRetries - i) * timeoutMilliseconds / 1000;
+                    const retrySecondsLeft = ((maxRetries - i) * timeoutMilliseconds) / 1000;
                     pulumi.log.info(`Waiting up to (${retrySecondsLeft}) more seconds for cluster readiness...`, eksCluster, undefined, true);
                 }
-                yield new Promise(resolve => setTimeout(resolve, timeoutMilliseconds));
+                yield new Promise((resolve) => setTimeout(resolve, timeoutMilliseconds));
             }
         }
         return clusterEndpoint;
@@ -387,11 +391,17 @@ function createCore(name, args, parent, provider) {
     // Compute the required kubeconfig. Note that we do not export this value: we want the exported config to
     // depend on the autoscaling group we'll create later so that nothing attempts to use the EKS cluster before
     // its worker nodes have come up.
-    const kubeconfig = pulumi.all([eksCluster.name, endpoint, eksCluster.certificateAuthority, args.providerCredentialOpts])
-        .apply(([clusterName, clusterEndpoint, clusterCertificateAuthority, providerCredentialOpts]) => {
+    const kubeconfig = pulumi
+        .all([
+        eksCluster.name,
+        endpoint,
+        eksCluster.certificateAuthority,
+        args.providerCredentialOpts,
+    ])
+        .apply(([clusterName, clusterEndpoint, clusterCertificateAuthority, providerCredentialOpts,]) => {
         let config = {};
         if (args.creationRoleProvider) {
-            config = args.creationRoleProvider.role.arn.apply(arn => {
+            config = args.creationRoleProvider.role.arn.apply((arn) => {
                 const opts = { roleArn: arn };
                 return generateKubeconfig(clusterName, clusterEndpoint, clusterCertificateAuthority.data, opts);
             });
@@ -435,7 +445,9 @@ function createCore(name, args, parent, provider) {
     let instanceRoles;
     // Create role mappings of the instance roles specified for aws-auth.
     if (args.instanceRoles) {
-        instanceRoleMappings = pulumi.output(args.instanceRoles).apply(roles => roles.map(role => createInstanceRoleMapping(role.arn)));
+        instanceRoleMappings = pulumi
+            .output(args.instanceRoles)
+            .apply((roles) => roles.map((role) => createInstanceRoleMapping(role.arn)));
         instanceRoles = pulumi.output(args.instanceRoles);
     }
     else if (args.instanceRole) {
@@ -443,12 +455,14 @@ function createCore(name, args, parent, provider) {
         if (!skipDefaultNodeGroup) {
             nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(name, parent, args.instanceRole, args.instanceProfileName);
         }
-        instanceRoleMappings = pulumi.output(args.instanceRole).apply(instanceRole => [createInstanceRoleMapping(instanceRole.arn)]);
+        instanceRoleMappings = pulumi
+            .output(args.instanceRole)
+            .apply((instanceRole) => [createInstanceRoleMapping(instanceRole.arn)]);
         instanceRoles = pulumi.output([args.instanceRole]);
     }
     else {
-        const instanceRole = (new servicerole_1.ServiceRole(`${name}-instanceRole`, {
-            service: "ec2.amazonaws.com",
+        const instanceRole = new servicerole_1.ServiceRole(`${name}-instanceRole`, {
+            service: pulumi.interpolate `ec2.${dnsSuffix}`,
             managedPolicyArns: [
                 {
                     id: "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
@@ -463,7 +477,7 @@ function createCore(name, args, parent, provider) {
                     arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly`,
                 },
             ],
-        }, { parent, provider })).role;
+        }, { parent, provider }).role;
         instanceRoles = pulumi.output([instanceRole]);
         // Create a new policy for the role, if specified.
         if (args.customInstanceRolePolicy) {
@@ -477,13 +491,16 @@ function createCore(name, args, parent, provider) {
         if (!skipDefaultNodeGroup) {
             nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(name, parent, instanceRole, args.instanceProfileName);
         }
-        instanceRoleMappings = pulumi.output(instanceRole).apply(role => [createInstanceRoleMapping(role.arn)]);
+        instanceRoleMappings = pulumi
+            .output(instanceRole)
+            .apply((role) => [createInstanceRoleMapping(role.arn)]);
     }
-    const roleMappings = pulumi.all([pulumi.output(args.roleMappings || []), instanceRoleMappings])
+    const roleMappings = pulumi
+        .all([pulumi.output(args.roleMappings || []), instanceRoleMappings])
         .apply(([mappings, instanceMappings]) => {
         let mappingYaml = "";
         try {
-            mappingYaml = jsyaml.safeDump([...mappings, ...instanceMappings].map(m => ({
+            mappingYaml = jsyaml.dump([...mappings, ...instanceMappings].map((m) => ({
                 rolearn: m.roleArn,
                 username: m.username,
                 groups: m.groups,
@@ -498,10 +515,10 @@ function createCore(name, args, parent, provider) {
         mapRoles: roleMappings,
     };
     if (args.userMappings) {
-        nodeAccessData.mapUsers = pulumi.output(args.userMappings).apply(mappings => {
+        nodeAccessData.mapUsers = pulumi.output(args.userMappings).apply((mappings) => {
             let mappingYaml = "";
             try {
-                mappingYaml = jsyaml.safeDump(mappings.map(m => ({
+                mappingYaml = jsyaml.dump(mappings.map((m) => ({
                     userarn: m.userArn,
                     username: m.username,
                     groups: m.groups,
@@ -521,19 +538,22 @@ function createCore(name, args, parent, provider) {
         },
         data: nodeAccessData,
     }, { parent, provider: k8sProvider });
-    const fargateProfile = pulumi.output(args.fargate).apply(argsFargate => {
+    const fargateProfile = pulumi
+        .output(args.fargate)
+        .apply((argsFargate) => {
         let result;
         if (argsFargate) {
             const fargate = argsFargate !== true ? argsFargate : {};
-            const podExecutionRoleArn = fargate.podExecutionRoleArn || (new servicerole_1.ServiceRole(`${name}-podExecutionRole`, {
-                service: "eks-fargate-pods.amazonaws.com",
-                managedPolicyArns: [
-                    {
-                        id: "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy",
-                        arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy`,
-                    },
-                ],
-            }, { parent, provider })).role.apply(r => r.arn);
+            const podExecutionRoleArn = fargate.podExecutionRoleArn ||
+                new servicerole_1.ServiceRole(`${name}-podExecutionRole`, {
+                    service: "eks-fargate-pods.amazonaws.com",
+                    managedPolicyArns: [
+                        {
+                            id: "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy",
+                            arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy`,
+                        },
+                    ],
+                }, { parent, provider }).role.apply((r) => r.arn);
             const selectors = fargate.selectors || [
                 // For `fargate: true`, default to including the `default` namespaces and
                 // `kube-system` namespaces so that all pods by default run in Fargate.
@@ -555,28 +575,32 @@ function createCore(name, args, parent, provider) {
                 clusterName: eksCluster.name,
                 podExecutionRoleArn: podExecutionRoleArn,
                 selectors: selectors,
-                subnetIds: pulumi.output(clusterSubnetIds).apply(subnets => nodegroup_1.computeWorkerSubnets(parent, subnets)),
+                subnetIds: pulumi
+                    .output(clusterSubnetIds)
+                    .apply((subnets) => nodegroup_1.computeWorkerSubnets(parent, subnets)),
             }, { parent, dependsOn: [eksNodeAccess], provider });
             // Once the FargateProfile has been created, try to patch CoreDNS if needed.  See
             // https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html#fargate-gs-coredns.
             pulumi.all([result.id, selectors, kubeconfig]).apply(([_, sels, kconfig]) => {
                 // Only patch CoreDNS if there is a selector in the FargateProfile which causes
                 // `kube-system` pods to launch in Fargate.
-                if (sels.findIndex(s => s.namespace === "kube-system") !== -1) {
+                if (sels.findIndex((s) => s.namespace === "kube-system") !== -1) {
                     // Only do the imperative patching during deployments, not previews.
                     if (!pulumi.runtime.isDryRun()) {
                         // Write the kubeconfig to a tmp file and use it to patch the `coredns`
                         // deployment that AWS deployed already as part of cluster creation.
                         const tmpKubeconfig = tmp.fileSync();
                         fs.writeFileSync(tmpKubeconfig.fd, JSON.stringify(kconfig));
-                        const patch = [{
+                        const patch = [
+                            {
                                 op: "replace",
                                 path: "/spec/template/metadata/annotations/eks.amazonaws.com~1compute-type",
                                 value: "fargate",
-                            }];
+                            },
+                        ];
                         const cmd = `kubectl patch deployment coredns -n kube-system --type json -p='${JSON.stringify(patch)}'`;
                         childProcess.execSync(cmd, {
-                            env: Object.assign(Object.assign({}, process.env), { "KUBECONFIG": tmpKubeconfig.name }),
+                            env: Object.assign(Object.assign({}, process.env), { KUBECONFIG: tmpKubeconfig.name }),
                         });
                     }
                 }
@@ -646,8 +670,11 @@ function createHttpAgent(proxy) {
         // Note: Envars used are a convention that were based on:
         // - curl: https://curl.haxx.se/docs/manual.html
         // - wget: https://www.gnu.org/software/wget/manual/html_node/Proxies.html
-        proxy = process.env.HTTPS_PROXY || process.env.https_proxy ||
-            process.env.HTTP_PROXY || process.env.http_proxy;
+        proxy =
+            process.env.HTTPS_PROXY ||
+                process.env.https_proxy ||
+                process.env.HTTP_PROXY ||
+                process.env.http_proxy;
     }
     if (proxy) {
         /**
@@ -769,10 +796,7 @@ function createCluster(name, self, args, opts) {
         vpcId: core.vpcId,
         clusterSecurityGroup: core.clusterSecurityGroup,
         eksCluster: core.cluster,
-        tags: pulumi.all([
-            args.tags,
-            args.nodeSecurityGroupTags,
-        ]).apply(([tags, nodeSecurityGroupTags]) => (Object.assign(Object.assign({}, nodeSecurityGroupTags), tags))),
+        tags: pulumi.all([args.tags, args.nodeSecurityGroupTags]).apply(([tags, nodeSecurityGroupTags]) => (Object.assign(Object.assign({}, nodeSecurityGroupTags), tags))),
     }, self);
     core.nodeGroupOptions.nodeSecurityGroup = nodeSecurityGroup;
     core.nodeGroupOptions.clusterIngressRule = eksClusterIngressRule;