it is sad that

@pulumi/eks

is not usable. I am struggling with it since yesterday. here is for example, its adds labels on fresh stack then running up again wants to remove the labels.

++kubernetes:core/v1:ConfigMap: (create-replacement)
                [id=kube-system/aws-auth]
                [urn=urn:pulumi:dev::allrites-infrastructure::custom:resource:eks$eks:index:Cluster$kubernetes:core/v1:ConfigMap::primary-eks-eks-cluster-nodeAccess]
                [provider: urn:pulumi:dev::allrites-infrastructure::custom:resource:eks$eks:index:Cluster$pulumi:providers:kubernetes::primary-eks-eks-cluster-eks-k8s::586e6654-9fcb-4908-9f46-53b23ae4c5c8 => urn:pulumi:dev::allrites-infrastructure::custom:resource:eks$eks:index:Cluster$pulumi:providers:kubernetes::primary-eks-eks-cluster-eks-k8s::output<string>]
              ~ metadata  : {
                  - labels   : {
                      - <http://app.kubernetes.io/managed-by|app.kubernetes.io/managed-by>: "pulumi"
                    }
                }
            +-kubernetes:core/v1:ConfigMap: (replace)
                [id=kube-system/aws-auth]
                [urn=urn:pulumi:dev::allrites-infrastructure::custom:resource:eks$eks:index:Cluster$kubernetes:core/v1:ConfigMap::primary-eks-eks-cluster-nodeAccess]
                [provider: urn:pulumi:dev::allrites-infrastructure::custom:resource:eks$eks:index:Cluster$pulumi:providers:kubernetes::primary-eks-eks-cluster-eks-k8s::586e6654-9fcb-4908-9f46-53b23ae4c5c8 => urn:pulumi:dev::allrites-infrastructure::custom:resource:eks$eks:index:Cluster$pulumi:providers:kubernetes::primary-eks-eks-cluster-eks-k8s::output<string>]
              ~ metadata  : {
                  - labels   : {
                      - <http://app.kubernetes.io/managed-by|app.kubernetes.io/managed-by>: "pulumi"
                    }
                }

that looks like the Kubernetes provider, not EKS?