[v7]: cluster certificateAuthority only returns a single item (#5661)

Follow up to #5655. The upstream API only returns a single item so we
should remove the list version not the single item version

Author: corymhall

docs/version-7-upgrade.md

@@ -712,7 +712,7 @@ Remove `resolveConflicts`—it is no longer supported. Use `resolveConflictsOnCr
 
 ## Resource `aws.eks.Cluster`
 
-`certificateAuthority` is no longer supported. Use `certificateAuthorities` instead.
+`certificateAuthorities` is no longer supported. Use `certificateAuthority` instead.
 
 ## Resource `aws.elasticache.ReplicationGroup`
 

provider/cmd/pulumi-resource-aws/bridge-metadata.json

@@ -12383,7 +12383,7 @@
                         "maxItemsOne": true
                     },
                     "certificate_authority": {
-                        "maxItemsOne": false
+                        "maxItemsOne": true
                     },
                     "compute_config": {
                         "maxItemsOne": true,

provider/cmd/pulumi-resource-aws/schema.json

@@ -276844,11 +276844,8 @@
                     "type": "boolean",
                     "description": "Install default unmanaged add-ons, such as `aws-cni`, `kube-proxy`, and CoreDNS during cluster creation. If `false`, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to `true`.\n"
                 },
-                "certificateAuthorities": {
-                    "type": "array",
-                    "items": {
-                        "$ref": "#/types/aws:eks/ClusterCertificateAuthority:ClusterCertificateAuthority"
-                    },
+                "certificateAuthority": {
+                    "$ref": "#/types/aws:eks/ClusterCertificateAuthority:ClusterCertificateAuthority",
                     "description": "Attribute block containing `certificate-authority-data` for your cluster. Detailed below.\n"
                 },
                 "clusterId": {
@@ -276959,7 +276956,7 @@
             "required": [
                 "accessConfig",
                 "arn",
-                "certificateAuthorities",
+                "certificateAuthority",
                 "clusterId",
                 "createdAt",
                 "endpoint",
@@ -277079,11 +277076,8 @@
                         "description": "Install default unmanaged add-ons, such as `aws-cni`, `kube-proxy`, and CoreDNS during cluster creation. If `false`, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to `true`.\n",
                         "willReplaceOnChanges": true
                     },
-                    "certificateAuthorities": {
-                        "type": "array",
-                        "items": {
-                            "$ref": "#/types/aws:eks/ClusterCertificateAuthority:ClusterCertificateAuthority"
-                        },
+                    "certificateAuthority": {
+                        "$ref": "#/types/aws:eks/ClusterCertificateAuthority:ClusterCertificateAuthority",
                         "description": "Attribute block containing `certificate-authority-data` for your cluster. Detailed below.\n"
                     },
                     "clusterId": {

provider/resources.go

@@ -2272,6 +2272,13 @@ func ProviderFromMeta(metaInfo *tfbridge.MetadataInfo) *tfbridge.ProviderInfo {
 				},
 			},
 			"aws_eks_cluster": {
+				Fields: map[string]*info.Schema{
+					"certificate_authority": {
+						Name: "certificateAuthority",
+						// The upstream API only returns a single item
+						MaxItemsOne: tfbridge.True(),
+					},
+				},
 				TransformFromState: func(_ context.Context, pm resource.PropertyMap) (resource.PropertyMap, error) {
 					// if the defaultOutboundAccessEnabled property is not set, set it to the default value of true
 					// this prevents an unnecessary replacement when upgrading the provider