fix fargate deletion issue

packages/@aws-cdk/aws-eks-v2-alpha/lib/cluster.ts

@@ -1025,6 +1025,8 @@ export class Cluster extends ClusterBase {
 
   private readonly _kubectlProvider?: IKubectlProvider;
 
+  private readonly _clusterAdminAccess?: AccessEntry;
+
   /**
    * Initiates an EKS Cluster with the supplied arguments
    *
@@ -1190,11 +1192,7 @@ export class Cluster extends ClusterBase {
 
       // give the handler role admin access to the cluster
       // so it can deploy/query any resource.
-      this.grantAccess('ClusterAdminRoleAccess', this._kubectlProvider?.role!.roleArn, [
-        AccessPolicy.fromAccessPolicyName('AmazonEKSClusterAdminPolicy', {
-          accessScopeType: AccessScopeType.CLUSTER,
-        }),
-      ]);
+      this._clusterAdminAccess = this.grantClusterAdmin('ClusterAdminRoleAccess', this._kubectlProvider?.role!.roleArn);
     }
 
     // do not create a masters role if one is not provided. Trusting the accountRootPrincipal() is too permissive.
@@ -1240,6 +1238,32 @@ export class Cluster extends ClusterBase {
     this.addToAccessEntry(id, principal, accessPolicies);
   }
 
+    /**
+   * Grants the specified IAM principal cluster admin access to the EKS cluster.
+   *
+   * This method creates an `AccessEntry` construct that grants the specified IAM principal the cluster admin 
+   * access permissions. This allows the IAM principal to perform the actions permitted
+   * by the cluster admin acces.
+   *
+   * @param id - The ID of the `AccessEntry` construct to be created.
+   * @param principal - The IAM principal (role or user) to be granted access to the EKS cluster.
+   * @returns the access entry construct
+   */
+  @MethodMetadata()
+  public grantClusterAdmin(id: string, principal: string): AccessEntry {
+    const newEntry = new AccessEntry(this, id, {
+      principal,
+      cluster: this,
+      accessPolicies: [
+        AccessPolicy.fromAccessPolicyName('AmazonEKSClusterAdminPolicy', {
+          accessScopeType: AccessScopeType.CLUSTER,
+        }),
+      ],
+    });
+    this.accessEntries.set(principal, newEntry);
+    return newEntry;
+  }
+
   /**
    * Fetch the load balancer address of a service of type 'LoadBalancer'.
    *
@@ -1570,13 +1594,19 @@ export class Cluster extends ClusterBase {
       },
     });
 
-    new KubernetesPatch(this, 'CoreDnsComputeTypePatch', {
+    const k8sPatch = new KubernetesPatch(this, 'CoreDnsComputeTypePatch', {
       cluster: this,
       resourceName: 'deployment/coredns',
       resourceNamespace: 'kube-system',
       applyPatch: renderPatch(CoreDnsComputeType.FARGATE),
       restorePatch: renderPatch(CoreDnsComputeType.EC2),
     });
+
+    // In Patch deletion, it needs to apply the restore patch to the cluster
+    // So the cluster admin access can only be deleted after the patch
+    if (this._clusterAdminAccess) {
+      k8sPatch.node.addDependency(this._clusterAdminAccess);
+    }
   }
 }
 

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.alb-controller.ts

@@ -7,7 +7,7 @@ import * as kplus from 'cdk8s-plus-27';
 import { Pinger } from './pinger/pinger';
 import * as eks from '../lib';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
-import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS } from 'aws-cdk-lib/cx-api';
+import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS, LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 const LATEST_VERSION: eks.AlbControllerVersion = eks.AlbControllerVersion.V2_8_2;
 class EksClusterAlbControllerStack extends Stack {
@@ -74,6 +74,7 @@ class EksClusterAlbControllerStack extends Stack {
 const app = new App({
   postCliContext: {
     [IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS]: false,
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
   },
 });
 const stack = new EksClusterAlbControllerStack(app, 'aws-cdk-eks-cluster-alb-controller');

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-addon.ts

@@ -3,6 +3,7 @@ import * as eks from '../lib';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
+import { LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   constructor(scope: App, id: string) {
@@ -25,7 +26,11 @@ class EksClusterStack extends Stack {
   }
 }
 
-const app = new App();
+const app = new App({
+  postCliContext: {
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
+  },
+});
 
 const stack = new EksClusterStack(app, 'EksClusterWithAddonStack');
 new integ.IntegTest(app, 'EksClusterwithAddon', {

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-al2023-nodegroup.ts

@@ -6,6 +6,7 @@ import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as eks from '../lib';
 import { NodegroupAmiType } from 'aws-cdk-lib/aws-eks';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
+import { LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   private cluster: eks.Cluster;
@@ -55,7 +56,11 @@ class EksClusterStack extends Stack {
   }
 }
 
-const app = new App();
+const app = new App({
+  postCliContext: {
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
+  },
+});
 
 const stack = new EksClusterStack(app, 'aws-cdk-eks-cluster-al2023-nodegroup-test');
 new integ.IntegTest(app, 'aws-cdk-eks-cluster-al2023-nodegroup', {

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-cluster-imported.ts

@@ -14,7 +14,7 @@ import * as eks from '../lib';
 import * as cdk8s from 'cdk8s';
 import * as kplus from 'cdk8s-plus-27';
 import * as constructs from 'constructs';
-import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS } from 'aws-cdk-lib/cx-api';
+import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS, LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   private cluster: eks.Cluster;
@@ -204,6 +204,7 @@ class EksClusterStack extends Stack {
 const app = new App({
   postCliContext: {
     [IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS]: false,
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
   },
 });
 const stack = new EksClusterStack(app, 'aws-cdk-eks-import-cluster-test');

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-cluster-private-endpoint.ts

@@ -5,6 +5,7 @@ import { App, Stack } from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as eks from '../lib';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
+import { LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   constructor(scope: App, id: string) {
@@ -42,7 +43,11 @@ class EksClusterStack extends Stack {
   }
 }
 
-const app = new App();
+const app = new App({
+  postCliContext: {
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
+  },
+});
 
 const stack = new EksClusterStack(app, 'aws-cdk-eks-cluster-private-endpoint-test');
 new integ.IntegTest(app, 'aws-cdk-eks-cluster-private-endpoint', {

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-cluster.ts

@@ -12,7 +12,7 @@ import * as constructs from 'constructs';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
 import * as hello from './hello-k8s';
 import * as eks from '../lib';
-import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS } from 'aws-cdk-lib/cx-api';
+import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS, LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   private cluster: eks.Cluster;
@@ -350,6 +350,7 @@ const supportedRegions = [
 const app = new App({
   postCliContext: {
     [IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS]: false,
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
   },
 });
 

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-helm-asset.ts

@@ -7,6 +7,7 @@ import { App, Stack } from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as eks from '../lib';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
+import { LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   private cluster: eks.Cluster;
@@ -106,7 +107,11 @@ class EksClusterStack extends Stack {
   }
 }
 
-const app = new App();
+const app = new App({
+  postCliContext: {
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
+  },
+});
 
 const stack = new EksClusterStack(app, 'aws-cdk-eks-helm-test');
 new integ.IntegTest(app, 'aws-cdk-eks-helm', {

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-inference-nodegroup.ts

@@ -4,7 +4,7 @@ import { App, Stack } from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as eks from '../lib';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
-import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS } from 'aws-cdk-lib/cx-api';
+import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS, LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterInferenceStack extends Stack {
   constructor(scope: App, id: string) {
@@ -37,6 +37,7 @@ class EksClusterInferenceStack extends Stack {
 const app = new App({
   postCliContext: {
     [IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS]: false,
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
   },
 });
 const stack = new EksClusterInferenceStack(app, 'aws-cdk-eks-cluster-inference-nodegroup');

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-oidc-provider.ts

@@ -1,13 +1,8 @@
 import { App, Stack } from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as eks from '../lib';
-import { IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS } from 'aws-cdk-lib/cx-api';
 
-const app = new App({
-  postCliContext: {
-    [IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS]: false,
-  },
-});
+const app = new App();
 const stack = new Stack(app, 'aws-eks-oidc-provider-test');
 
 new eks.OpenIdConnectProvider(stack, 'NoClientsNoThumbprint', {

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-standard-access-entry.ts

@@ -5,6 +5,7 @@ import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as eks from '../lib';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
+import { LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksStandardAccessEntry extends Stack {
   constructor(scope: App, id: string) {
@@ -41,7 +42,11 @@ class EksStandardAccessEntry extends Stack {
   }
 }
 
-const app = new App();
+const app = new App({
+  postCliContext: {
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
+  },
+});
 const stack = new EksStandardAccessEntry(app, 'EKSStandardAccessEntry');
 new integ.IntegTest(app, 'aws-cdk-eks-standard-access-entry-integ', {
   testCases: [stack],

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-subnet-updates.ts

@@ -3,6 +3,7 @@ import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as eks from '../lib';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
+import { LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   constructor(scope: App, id: string) {
@@ -22,7 +23,11 @@ class EksClusterStack extends Stack {
   }
 }
 
-const app = new App();
+const app = new App({
+  postCliContext: {
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
+  },
+});
 
 const stack = new EksClusterStack(app, 'aws-cdk-eks-cluster-stack');
 new integ.IntegTest(app, 'aws-cdk-eks-cluster', {

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.eks-windows-ng.ts

@@ -6,6 +6,7 @@ import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as eks from '../lib';
 import { KubectlV32Layer } from '@aws-cdk/lambda-layer-kubectl-v32';
 import { NodegroupAmiType, TaintEffect } from 'aws-cdk-lib/aws-eks';
+import { LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY } from 'aws-cdk-lib/cx-api';
 
 class EksClusterStack extends Stack {
   private cluster: eks.Cluster;
@@ -49,7 +50,11 @@ class EksClusterStack extends Stack {
   }
 }
 
-const app = new App();
+const app = new App({
+  postCliContext: {
+    [LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: true,
+  },
+});
 
 const stack = new EksClusterStack(app, 'aws-cdk-eks-cluster-windows-ng-test');
 new integ.IntegTest(app, 'aws-cdk-eks-cluster-windows-ng', {

packages/@aws-cdk/aws-eks-v2-alpha/test/integ.fargate-cluster.js.snapshot/eks-fargate-cluster-test-stack.template.json

@@ -1035,6 +1035,7 @@
     "PatchType": "strategic"
    },
    "DependsOn": [
+    "FargateTestClusterClusterAdminRoleAccess9EFE9888",
     "FargateTestClusterKubectlReadyBarrier724731D5"
    ],
    "UpdateReplacePolicy": "Delete",