I do something similar for EKS clusters

// add annotation to default namespace
    if (!isDryRun()) {
      cluster.kubeconfig.apply(async kubeconfig => {
        await new Promise(resolve => fs.writeFile(`/tmp/${name}-kubeconfig.yml`, JSON.stringify(kubeconfig), resolve))
        await child_process.exec(
          `kubectl --kubeconfig=/tmp/${name}-kubeconfig.yml annotate ns default <http://iam.amazonaws.com/permitted=%22.*%22|iam.amazonaws.com/permitted=".*"> --overwrite`
        )
      })
    }