EKS IdentifyProviderConfig: Associate will never be called again when failing the first time

[MisterMX]

What happened?

The EKS IdentityProviderConfig controller checks if status.atProvider.status != "CREATING" to determine whether it should call client.AssociateIdentityProviderConfig. This field is set during observe only when the external resource exists.

Now, if the creation of the external resource fails it will be garbage collected and removed so DescribeIdentityProviderConfig will result in a not found which will trigger a creation. But since status.atProvider.status is still set to CREATING and is never updated, nothing will happen in create and the association will never be tried again.

How can we reproduce it?

Create an IdentityProviderConfig for a cluster that is not ready.6

What environment did it happen in?

provider-aws: v0.29.0