Add note about deleting nodegroups

userdocs/src/usage/access-entries.md

@@ -22,7 +22,7 @@ e.g.
 
 ```yaml
 accessConfig:
-  authenticationMode: <> 
+  authenticationMode: <>
 ```
 
 When creating a new cluster with access entries, using `eksctl`, if `authenticationMode` is not provided by the user, it is automatically set to `API_AND_CONFIG_MAP`. Thus, the access entries API will be enabled by default. If instead you want to use access entries on an already existing, non-eksctl created, cluster, where `CONFIG_MAP` option is used, the user will need to first set `authenticationMode` to `API_AND_CONFIG_MAP`. For that, `eksctl` has introduced a new command for updating the cluster authentication mode, which works both with CLI flags e.g.
@@ -85,6 +85,9 @@ Each access entry has a type. For authorizing self-managed nodegroups, `eksctl`
 
 When creating your own access entries, you can also specify `EC2_LINUX` (for an IAM role used with Linux or Bottlerocket self-managed nodes), `EC2_WINDOWS` (for an IAM roles used with Windows self-managed nodes), `FARGATE_LINUX` (for an IAM roles used with AWS Fargate (Fargate)), or `STANDARD` as a type. If you don't specify a type, the default type is set to `STANDARD`.
 
+???+ note
+    When deleting a nodegroup created with a pre-existing `instanceRoleARN`, it is the user's responsibility to delete the corresponding access entry when no more nodegroups are associated with it.
+
 ## Managing access entries
 
 ### Create access entries