From d334ebaa4642768aee97a35ca803ae7eafa3aa22 Mon Sep 17 00:00:00 2001
From: Atharva Joshi <josh.atharva2005@gmail.com>
Date: Sat, 12 Sep 2026 17:47:01 +0530
Subject: [PATCH] fix: resolve latest addon version before pod identity lookup

Signed-off-by: Atharva Joshi <josh.atharva2005@gmail.com>
---
 pkg/actions/addon/update.go      |  7 ++++-
 pkg/actions/addon/update_test.go | 48 +++++++++++++++++++++++++++++++-
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/pkg/actions/addon/update.go b/pkg/actions/addon/update.go
index c15e82edda..9a7a6a4244 100644
--- a/pkg/actions/addon/update.go
+++ b/pkg/actions/addon/update.go
@@ -73,6 +73,11 @@ func (a *Manager) Update(ctx context.Context, addon *api.Addon, podIdentityIAMUp
 		if summary.Version != latestVersion {
 			logger.Info("new version provided %s", latestVersion)
 		}
+		// Resolve the resolved version back into the addon so that subsequent
+		// steps (e.g. describing recommended pod identity policies) use the
+		// concrete version instead of the "latest" keyword, which the EKS API
+		// rejects (see https://github.com/eksctl-io/eksctl/issues/7841).
+		addon.Version = latestVersion
 		updateAddonInput.AddonVersion = &latestVersion
 	}
 
@@ -102,7 +107,7 @@ func (a *Manager) Update(ctx context.Context, addon *api.Addon, podIdentityIAMUp
 		if requiresIAMPermissions {
 			pidConfigList, supportsPodIdentity, err := a.getRecommendedPoliciesForPodID(ctx, addon)
 			if err != nil {
-				return fmt.Errorf("getting recommended policies for addon %s", addon.Name)
+				return fmt.Errorf("getting recommended policies for addon %s: %w", addon.Name, err)
 			}
 			if !supportsPodIdentity {
 				return &unsupportedPodIdentityErr{addonName: addon.Name}
diff --git a/pkg/actions/addon/update_test.go b/pkg/actions/addon/update_test.go
index adc336b293..52a3d5a9b1 100644
--- a/pkg/actions/addon/update_test.go
+++ b/pkg/actions/addon/update_test.go
@@ -77,7 +77,8 @@ var _ = Describe("Update", func() {
 						},
 						{
 							// not sure if all versions come with v prefix or not, so test a mix.
-							AddonVersion: aws.String("v1.7.7-eksbuild.2"),
+							AddonVersion:           aws.String("v1.7.7-eksbuild.2"),
+							RequiresIamPermissions: true,
 						},
 						{
 							AddonVersion: aws.String("v1.7.6"),
@@ -197,6 +198,51 @@ var _ = Describe("Update", func() {
 				})
 			})
 
+			When("the version is set to latest with useDefaultPodIdentityAssociations", func() {
+				It("resolves the latest version before describing recommended pod identity policies", func() {
+					var describeAddonConfigInput *awseks.DescribeAddonConfigurationInput
+					mockProvider.MockEKS().On("DescribeAddonConfiguration", mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
+						Expect(args).To(HaveLen(2))
+						Expect(args[1]).To(BeAssignableToTypeOf(&awseks.DescribeAddonConfigurationInput{}))
+						describeAddonConfigInput = args[1].(*awseks.DescribeAddonConfigurationInput)
+					}).Return(&awseks.DescribeAddonConfigurationOutput{
+						PodIdentityConfiguration: []ekstypes.AddonPodIdentityConfiguration{
+							{
+								ServiceAccount:             aws.String("my-app"),
+								RecommendedManagedPolicies: []string{"arn-1"},
+							},
+						},
+					}, nil)
+
+					podIdentityIAMUpdater.On("UpdateRole", mock.Anything, mock.Anything, mock.Anything, mock.Anything).
+						Return([]ekstypes.AddonPodIdentityAssociations{
+							{
+								RoleArn:        aws.String("role-arn"),
+								ServiceAccount: aws.String("my-app"),
+							},
+						}, nil)
+
+					err := addonManager.Update(context.Background(), &api.Addon{
+						Name:                              "my-addon",
+						Version:                           "latest",
+						UseDefaultPodIdentityAssociations: true,
+					}, &podIdentityIAMUpdater, 0)
+
+					Expect(err).NotTo(HaveOccurred())
+					Expect(describeAddonConfigInput).NotTo(BeNil())
+					// The resolved version must be used, not the "latest" keyword,
+					// otherwise the EKS API rejects the request (issue #7841).
+					Expect(*describeAddonConfigInput.AddonVersion).To(Equal("v1.7.7-eksbuild.2"))
+					Expect(*updateAddonInput.AddonVersion).To(Equal("v1.7.7-eksbuild.2"))
+					Expect(updateAddonInput.PodIdentityAssociations).To(Equal([]ekstypes.AddonPodIdentityAssociations{
+						{
+							RoleArn:        aws.String("role-arn"),
+							ServiceAccount: aws.String("my-app"),
+						},
+					}))
+				})
+			})
+
 			When("the version is set to a version that does not exist", func() {
 				It("returns an error", func() {
 					err := addonManager.Update(context.Background(), &api.Addon{