eks: Windows Node Groups get an aws-auth roleMapping without eks:kube-proxy-windows

[cw-alexcroteau]

Describe the bug

Per the AWS documentation, the eks:kube-proxy-windows group is required for kube-proxy to work for windows nodes.

In the current state, the nodes all get created with groups that exclude that one. This forces users to use a workaround like call cluster.awsAuth.addRoleMapping manually, which risks adding duplicate values to the aws-auth ConfigMap.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

When creating a NodeGroup where the AmiType is Windows (e.g. props.amiType && windowsAmiTypes.includes(props.amiType)), the eks:kube-proxy-windows group should be added, or we should at least be able to provide a custom list of roles for the NodeGroup.

Current Behavior

The eks:kube-proxy-windows group is not added for Windows node groups, and we are unable to provide a custom list of groups.

Reproduction Steps

1. Instantiate a Nodegroup object with a Windows AMI
2. Deploy and confirm that the created aws-auth ConfigMap does not contain the expected eks:kube-proxy-windows group

Possible Solution

Conditionally add the eks:kube-proxy-windows group when the AmiType is part of windowsAmiTypes (props.amiType && windowsAmiTypes.includes(props.amiType)). Alternatively, allow providing a custom list of groups for the node role, defaulting to the existing values.

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.189.1

AWS CDK CLI version

2.1004.0 (build f0ad96e)

Node.js Version

v20.17.0

OS

macOS 15.7.2 (24G325)

Language

TypeScript

Language Version

typescript@5.1.6

Other information

No response

[pahud]

Hi @cw-alexcroteau,

Thanks for the bug report and PR #36627!

This is a good catch - the eks:kube-proxy-windows group is required for Windows nodes per AWS documentation. Your PR provides a nice solution that:

• Automatically adds the required group for Windows AMI types
• Introduces nodeRoleGroups property for custom group control
• Prevents aws-auth ConfigMap pollution with unwanted defaults

The implementation looks solid and includes proper testing. This will resolve the Windows EKS issue while providing additional flexibility for advanced use cases.

Since the team is working on stabilizing aws-eks-v2-alpha, you might also consider implementing this enhancement there to ensure Windows support is available in the next-generation EKS module.

Thanks for the contribution!