<p>I have an EksNodeGroup with the following taints:</p>
<pre class="lang-js prettyprint-override"><code>    const ssdEksNodeGroupPublicLargeSubnet = new aws.eks.EksNodeGroup(
      this,
      &quot;ssdEksNodeGroupPublicLargeSubnet&quot;,
      {
        // ... other stuff...
        
        taint: [
          {
            key: &quot;app&quot;,
            value: &quot;strick&quot;,
            effect: &quot;NO_SCHEDULE&quot;,
          },
        ],
      }
    );
</code></pre>
<p>Elsewhere in my code, I'm trying to iterate over my nodeGroup taints to dynamically create kubernetes pod tolerations.</p>
<pre class="lang-js prettyprint-override"><code>      const nodeGrouop = ssdEksNodeGroupPublicLargeSubnet
      const tolerations: k8s.DeploymentSpecTemplateSpecToleration[] = [];
      for (let i = 0; i &lt; Fn.lengthOf(nodeGroup.taint); i++) {
        const taint = nodeGroup.taint.get(i);
        tolerations.push({
          key: taint.key,
          value: taint.value,
          effect: taint.effect,
          operator: &quot;Equal&quot;
        });
      }
      console.log(&quot;##################&quot;, tolerations)


</code></pre>
<p>However, when I try to run this, I see the log statement prints an empty array and when my pod/deployment is created it is created with no tolerations.</p>
<p>Here's full declaration of my kubernetes deployment</p>
<pre class="lang-js prettyprint-override"><code>      const pausePodDeployment = new k8s.Deployment(
        this,
        pausePodDeploymentName,
        {
          metadata: {
            name: pausePodDeploymentName,
            namespace: namespace.metadata.name,
          },
          spec: {
            replicas: &quot;1&quot;,
            selector: {
              matchLabels: {
                app: pausePodDeploymentName,
              },
            },
            template: {
              metadata: {
                labels: {
                  app: pausePodDeploymentName,
                },
              },
              spec: {
                priorityClassName: priorityClass.metadata.name,
                terminationGracePeriodSeconds: 0,
                container: [
                  {
                    name: &quot;reserve-resources&quot;,
                    image: &quot;k8s.gcr.io/pause&quot;,
                    resources: {
                      requests: {
                        cpu: &quot;1&quot;,
                      },
                    },
                  },
                ],
                toleration: tolerations,
                nodeSelector: {
                  ...nodeGroupLabels,
                },
              },
            },
          },
        }
      );
</code></pre>
<p>and here's the full output from CDK (note that there aren't any tolerations):</p>
<pre><code># kubernetes_deployment.overprovisioner_strick-overprovisioner-pause-pods_B5F26972 (overprovisioner/strick-overprovisioner-pause-pods) will be created
                     + resource &quot;kubernetes_deployment&quot; &quot;overprovisioner_strick-overprovisioner-pause-pods_B5F26972&quot; {
                         + id               = (known after apply)
                         + wait_for_rollout = true

                         + metadata {
                             + generation       = (known after apply)
                             + name             = &quot;strick-overprovisioner-pause-pods&quot;
                             + namespace        = &quot;overprovisioner&quot;
                             + resource_version = (known after apply)
                             + uid              = (known after apply)
                           }

                         + spec {
                             + min_ready_seconds         = 0
                             + paused                    = false
                             + progress_deadline_seconds = 600
                             + replicas                  = &quot;1&quot;
                             + revision_history_limit    = 10

                             + selector {
                                 + match_labels = {
                                     + &quot;app&quot; = &quot;strick-overprovisioner-pause-pods&quot;
                                   }
                               }

                             + strategy {
                                 + type = (known after apply)

                                 + rolling_update {
                                     + max_surge       = (known after apply)
                                     + max_unavailable = (known after apply)
                                   }
                               }

                             + template {
                                 + metadata {
                                     + generation       = (known after apply)
                                     + labels           = {
                                         + &quot;app&quot; = &quot;strick-overprovisioner-pause-pods&quot;
                                       }
                                     + name             = (known after apply)
                                     + resource_version = (known after apply)
                                     + uid              = (known after apply)
                                   }

                                 + spec {
                                     + automount_service_account_token  = true
                                     + dns_policy                       = &quot;ClusterFirst&quot;
                                     + enable_service_links             = true
                                     + host_ipc                         = false
                                     + host_network                     = false
                                     + host_pid                         = false
                                     + hostname                         = (known after apply)
                                     + node_name                        = (known after apply)
                                     + node_selector                    = {
                                         + &quot;diskType&quot; = &quot;ssd&quot;
                                       }
                                     + priority_class_name              = &quot;overprovisioner&quot;
                                     + restart_policy                   = &quot;Always&quot;
                                     + service_account_name             = (known after apply)
                                     + share_process_namespace          = false
                                     + termination_grace_period_seconds = 0

                                     + container {
                                         + image                      = &quot;k8s.gcr.io/pause&quot;
                                         + image_pull_policy          = (known after apply)
                                         + name                       = &quot;reserve-resources&quot;
                                         + stdin                      = false
                                         + stdin_once                 = false
                                         + termination_message_path   = &quot;/dev/termination-log&quot;
                                         + termination_message_policy = (known after apply)
                                         + tty                        = false

                                         + resources {
                                             + limits   = (known after apply)
                                             + requests = {
                                                 + &quot;cpu&quot; = &quot;1&quot;
                                               }
                                           }
                                       }

                                     + image_pull_secrets {
                                         + name = (known after apply)
                                       }

                                     + readiness_gate {
                                         + condition_type = (known after apply)
                                       }

                                     + volume {
                                         + name = (known after apply)

                                         + aws_elastic_block_store {
                                             + fs_type   = (known after apply)
                                             + partition = (known after apply)
                                             + read_only = (known after apply)
                                             + volume_id = (known after apply)
                                           }

                                         + azure_disk {
                                             + caching_mode  = (known after apply)
                                             + data_disk_uri = (known after apply)
                                             + disk_name     = (known after apply)
                                             + fs_type       = (known after apply)
                                             + kind          = (known after apply)
                                             + read_only     = (known after apply)
                                           }

                                         + azure_file {
                                             + read_only        = (known after apply)
                                             + secret_name      = (known after apply)
                                             + secret_namespace = (known after apply)
                                             + share_name       = (known after apply)
                                           }

                                         + ceph_fs {
                                             + monitors    = (known after apply)
                                             + path        = (known after apply)
                                             + read_only   = (known after apply)
                                             + secret_file = (known after apply)
                                             + user        = (known after apply)

                                             + secret_ref {
                                                 + name      = (known after apply)
                                                 + namespace = (known after apply)
                                               }
                                           }

                                         + cinder {
                                             + fs_type   = (known after apply)
                                             + read_only = (known after apply)
                                             + volume_id = (known after apply)
                                           }

                                         + config_map {
                                             + default_mode = (known after apply)
                                             + name         = (known after apply)
                                             + optional     = (known after apply)

                                             + items {
                                                 + key  = (known after apply)
                                                 + mode = (known after apply)
                                                 + path = (known after apply)
                                               }
                                           }

                                         + csi {
                                             + driver            = (known after apply)
                                             + fs_type           = (known after apply)
                                             + read_only         = (known after apply)
                                             + volume_attributes = (known after apply)

                                             + node_publish_secret_ref {
                                                 + name = (known after apply)
                                               }
                                           }

                                         + downward_api {
                                             + default_mode = (known after apply)

                                             + items {
                                                 + mode = (known after apply)
                                                 + path = (known after apply)

                                                 + field_ref {
                                                     + api_version = (known after apply)
                                                     + field_path  = (known after apply)
                                                   }

                                                 + resource_field_ref {
                                                     + container_name = (known after apply)
                                                     + divisor        = (known after apply)
                                                     + resource       = (known after apply)
                                                   }
                                               }
                                           }

                                         + empty_dir {
                                             + medium     = (known after apply)
                                             + size_limit = (known after apply)
                                           }

                                         + fc {
                                             + fs_type      = (known after apply)
                                             + lun          = (known after apply)
                                             + read_only    = (known after apply)
                                             + target_ww_ns = (known after apply)
                                           }

                                         + flex_volume {
                                             + driver    = (known after apply)
                                             + fs_type   = (known after apply)
                                             + options   = (known after apply)
                                             + read_only = (known after apply)

                                             + secret_ref {
                                                 + name      = (known after apply)
                                                 + namespace = (known after apply)
                                               }
                                           }

                                         + flocker {
                                             + dataset_name = (known after apply)
                                             + dataset_uuid = (known after apply)
                                           }

                                         + gce_persistent_disk {
                                             + fs_type   = (known after apply)
                                             + partition = (known after apply)
                                             + pd_name   = (known after apply)
                                             + read_only = (known after apply)
                                           }

                                         + git_repo {
                                             + directory  = (known after apply)
                                             + repository = (known after apply)
                                             + revision   = (known after apply)
                                           }

                                         + glusterfs {
                                             + endpoints_name = (known after apply)
                                             + path           = (known after apply)
                                             + read_only      = (known after apply)
                                           }

                                         + host_path {
                                             + path = (known after apply)
                                             + type = (known after apply)
                                           }

                                         + iscsi {
                                             + fs_type         = (known after apply)
                                             + iqn             = (known after apply)
                                             + iscsi_interface = (known after apply)
                                             + lun             = (known after apply)
                                             + read_only       = (known after apply)
                                             + target_portal   = (known after apply)
                                           }

                                         + local {
                                             + path = (known after apply)
                                           }

                                         + nfs {
                                             + path      = (known after apply)
                                             + read_only = (known after apply)
                                             + server    = (known after apply)
                                           }

                                         + persistent_volume_claim {
                                             + claim_name = (known after apply)
                                             + read_only  = (known after apply)
                                           }

                                         + photon_persistent_disk {
                                             + fs_type = (known after apply)
                                             + pd_id   = (known after apply)
                                           }

                                         + projected {
                                             + default_mode = (known after apply)

                                             + sources {
                                                 + config_map {
                                                     + name     = (known after apply)
                                                     + optional = (known after apply)

                                                     + items {
                                                         + key  = (known after apply)
                                                         + mode = (known after apply)
                                                         + path = (known after apply)
                                                       }
                                                   }

                                                 + downward_api {
                                                     + items {
                                                         + mode = (known after apply)
                                                         + path = (known after apply)

                                                         + field_ref {
                                                             + api_version = (known after apply)
                                                             + field_path  = (known after apply)
                                                           }

                                                         + resource_field_ref {
                                                             + container_name = (known after apply)
                                                             + divisor        = (known after apply)
                                                             + resource       = (known after apply)
                                                           }
                                                       }
                                                   }

                                                 + secret {
                                                     + name     = (known after apply)
                                                     + optional = (known after apply)

                                                     + items {
                                                         + key  = (known after apply)
                                                         + mode = (known after apply)
                                                         + path = (known after apply)
                                                       }
                                                   }

                                                 + service_account_token {
                                                     + audience           = (known after apply)
                                                     + expiration_seconds = (known after apply)
                                                     + path               = (known after apply)
                                                   }
                                               }
                                           }

                                         + quobyte {
                                             + group     = (known after apply)
                                             + read_only = (known after apply)
                                             + registry  = (known after apply)
                                             + user      = (known after apply)
                                             + volume    = (known after apply)
                                           }

                                         + rbd {
                                             + ceph_monitors = (known after apply)
                                             + fs_type       = (known after apply)
                                             + keyring       = (known after apply)
                                             + rados_user    = (known after apply)
                                             + rbd_image     = (known after apply)
                                             + rbd_pool      = (known after apply)
                                             + read_only     = (known after apply)

                                             + secret_ref {
                                                 + name      = (known after apply)
                                                 + namespace = (known after apply)
                                               }
                                           }

                                         + secret {
                                             + default_mode = (known after apply)
                                             + optional     = (known after apply)
                                             + secret_name  = (known after apply)

                                             + items {
                                                 + key  = (known after apply)
                                                 + mode = (known after apply)
                                                 + path = (known after apply)
                                               }
                                           }

                                         + vsphere_volume {
                                             + fs_type     = (known after apply)
                                             + volume_path = (known after apply)
                                           }
                                       }
                                   }
                               }
                           }
</code></pre>
<p>How can I dynamically iterate over the taints of a nodegroup to construct the correct pod tolerations for that node group?</p>

<p>This is due to the <a href="https://developer.hashicorp.com/terraform/cdktf/concepts/tokens" rel="nofollow noreferrer">Token System</a> powering CDKTF. Instead of real run-time values accessing <code>ssdEksNodeGroupPublicLargeSubnet.taint</code> gives you a token that is a reference to the taints. This reference is later used by Terraform for e.g. ordering the deployments of the individual resources.</p>
<p>If your input is static you can use the input directly by accessing <code>ssdEksNodeGroupPublicLargeSubnet.taintInput</code>.</p>
<p>If you want to loop over the taints on the terraform side instead of during synthetisation you can use <a href="https://developer.hashicorp.com/terraform/cdktf/concepts/iterators#using-iterators-for-list-attributes" rel="nofollow noreferrer">dynamic blocks</a>, e.g.</p>
<pre><code>const iterator = TerraformIterator.fromList(ssdEksNodeGroupPublicLargeSubnet.taint);
const tolerations = iterator.dynamic({
  key: cdktf.propertyAccess(iterator.value, &quot;key&quot;),
  value: cdktf.propertyAccess(iterator.value, &quot;value&quot;),
  effect: cdktf.propertyAccess(iterator.value, &quot;effect&quot;),
  operator: &quot;Equal&quot;
})
</code></pre>
