Tagging subnets from an imported VPC and instances created from a EKS node group

[dingyuanli]

Hello,

I have questions in tagging subnets from an imported VPC and instances created from a EKS node group. I used aws_cdk Tags and aws_cdk.Tag, but both are not working. Following code snippets are the code I used for your reference.

May I have some suggestions about how to do it via CDK directly? Or I could only do it via AWS Boto3? Thank you.

Env: Python 3.11
CDK Version: 2.81.0 (build bd920f2)
aws-cdk-lib (2.81.0)

======Snippet 01======
from aws_cdk import Tags

from aws_cdk import Tag

resource_id = "vpc-imported-{}".format(target_vpc)
imported_vpc = ec2.Vpc.from_lookup(self, id=resource_id, vpc_name=target_vpc)

for subnet in imported_vpc.private_subnets:
Tags.of(subnet).add("kubernetes.io/role/internal-elb", "1")
# Tag("kubernetes.io/role/internal-elb", "1").visit(subnet)

for subnet in imported_vpc.public_subnets:
Tags.of(subnet).add("kubernetes.io/role/elb", "1")
# Tag("kubernetes.io/role/elb", "1").visit(subnet)

======Snippet 02======
node_group = eks.Nodegroup(self, id="node-group-{}".format(ng_name),
cluster=target_cluster,
max_size=ng_min_size,
min_size=ng_max_size,
node_role=ng_role,
nodegroup_name=ng_name,
launch_template_spec=eks.LaunchTemplateSpec(
id=ng_lt.ref,
version=ng_lt.attr_latest_version_number
),
subnets=ec2.SubnetSelection(
one_per_az=True,
subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS
)
)

Tag("Name", target_cluster.cluster_name+"-"+ng_name+"-Node").visit(target_cluster)

[pahud]

The Tag class essentially scan all "taggable" resources managed by CDK with Aspect. If you import a Vpc with CDK, I am afraid the Tag class just can't tag the existing subnets in that VPC.

[dingyuanli]

@pahud Thanks, Pahud. I have already use boto3 to workaround that. How about the instances created by the node group? The node group is created by CDK, and the instances were created by the node group. Is this also the same case and cannot be tagged by Tag class?

Thanks

[pahud]

Yes. From CDK's perspective, only the nodegroup(AWS::EKS::NodeGroup) is managed by CDK and CloudFormation. The ASG and instances created by ASG can't be managed by CDK so it's not possible to use the Tag class to tag instances behind that. An option is to use CustomResource to find out the ASG behind the nodegroup resource and use SDK call to create tags for the ASG.