Allow passing in `NodeRole` when creating managed node groups

Describe the feature

Allow passing in a NodeRole or policies for the NodeRole for managed groups.

Use Case

I need to give the nodes some extra access, and to do that I need to add some permissions to the nodeRole.

However, when I try to pass in a nodeRole with the managedNodeGroups:

    const nodeRole = new aws_iam.Role(this, "NodeRole", {
      assumedBy: new aws_iam.ServicePrincipal("ec2.amazonaws.com"),
     ....
    });

    const clusterProvider = new blueprints.GenericClusterProvider({
      clusterName: clusterName,
      version: KubernetesVersion.V1_23,
      managedNodeGroups: {... nodeRole: nodeRole}
    });

I get an error:

<PARENT_STACK>/NodeRole should be defined in the scope of the <BLUEPRINTS_CLUSTER_STACK> stack to prevent circular dependencies

Proposed Solution

I think what needs to be done is add the ability to pass in permissions to the nodeRole, or give me access to the nodeRole afterwards so I can add permissions after its created.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request

CDK version used

2.50.0 (build 4c11af6)

EKS Blueprints Version

1.4.1

Node.js Version

v16.17.1

Environment details (OS name and version, etc.)

MacOS 12.6.1 (21G217)

[shapirov103]

You don’t have to make it a nested stack. Just create a separate stack where you either provision or look up the role you need. create a variable in the stack and then pass it over to the blueprints in Mng or generic cluster provider as nodeRole: myOtherStack.nodeRole. Similar to the example with S3 above.

However, I have a separate issue to make this configuration passing much easier. I expect it to be part of the solution soon.

[shapirov103]

Similar to #435, please see comments there. The approach used can be similar to https://docs.aws.amazon.com/cdk/api/v1/docs/aws-s3-readme.html#sharing-buckets-between-stacks