This message was deleted.

this is how i do it

const cluster = new eks.Cluster(
      name,
      {
        name,
        skipDefaultNodeGroup: true,
        vpcId: vpc.id,
        publicSubnetIds: vpc.publicSubnetIds,
        privateSubnetIds: vpc.privateSubnetIds,
        nodeAssociatePublicIpAddress: false,
        instanceRoles: [role],
        userMappings: [
          {
            /**
             * The ARN of the IAM user to add.
             */
            userArn: 'arn:aws:iam::xxx:root',
            /**
             * The user name within Kubernetes to map to the IAM user. By default, the user name is the ARN of the IAM user.
             */
            username: 'xxx',
            /**
             * A list of groups within Kubernetes to which the user is mapped to.
             */
            groups: ['system:masters'],
          },
        ],
        providerCredentialOpts: {},
      },
      {
        provider: regionProvider,
        parent: this,
        protect: false,
      }
    );

    eks.createManagedNodeGroup(
      `${name}-ng`,
      {
        cluster: cluster,
        nodeGroupName: `${name}`,
        nodeRoleArn: role.arn,
        instanceTypes: ['t3.xlarge'],
        scalingConfig: {
          desiredSize: 3,
          minSize: 3,
          maxSize: 50,
        },
        labels: {
          [`cluster-autoscaler/${name}`]: 'owned',
          'cluster-autoscaler/enabled': 'true',
        },
      },
      cluster,
      regionProvider
    );

you can do something like this as well, this is for the vpc subnet but will work for the node groups as well: https://github.com/jaxxstorm/pulumi-examples/blob/main/typescript/aws/eks_subnet_tags/index.ts#L51-L57

Cool, thanks to both of you @proud-pizza-80589 & @billowy-army-68599!