# Cluster

A Cluster represents a managed Kubernetes Service (EKS).

This is a fully managed cluster of API Servers (control-plane)
The user is still required to create the worker nodes.

Extends: Construct › Resource › Cluster
Implements: IResource, IConnectable, ICluster, IEnvironmentAware, IClusterRef, IConstruct, IDependable
Superclass of: FargateCluster

- CloudFormation: [`AWS::EKS::Cluster`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-eks-cluster.html)
- L1 type: [`CfnCluster`](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.CfnCluster.html)
- Source: [`aws-eks/lib/cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-eks/lib/cluster.ts#L1507)
- Type last changed: v2.238.0 · 9 Feb 2026

## Example

```ts
import { KubectlV36Layer } from '@aws-cdk/lambda-layer-kubectl-v36';

const cluster = new eks.Cluster(this, 'HelloEKS', {
  version: eks.KubernetesVersion.V1_36,
  defaultCapacity: 0,
  kubectlLayer: new KubectlV36Layer(this, 'kubectl'),
});

cluster.addNodegroupCapacity('custom-node-group', {
  instanceTypes: [new ec2.InstanceType('m5.large')],
  minSize: 4,
  diskSize: 100,
});
```

## Initializer

```ts
new Cluster(scope: Construct, id: string, props: ClusterProps)
```

## Construct Props

- `albController`: [AlbControllerOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AlbControllerOptions.html) — Install the AWS Load Balancer Controller onto the cluster.

  **Default:** The controller is not installed.

- `authenticationMode`: [AuthenticationMode](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AuthenticationMode.html) = AuthenticationMode.CONFIG_MAP — The desired authentication mode for the cluster.

- `awscliLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — An AWS Lambda layer that contains the `aws` CLI.

  **Default:** a default layer with the AWS CLI 1.x

  The handler expects the layer to include the following executables:

  ```
  /opt/awscli/aws
  ```

- `bootstrapClusterCreatorAdminPermissions`: boolean = true — Whether or not IAM principal of the cluster creator was set as a cluster admin access entry during cluster creation time.

  Changing this value after the cluster has been created will result in the cluster being replaced.

- `bootstrapSelfManagedAddons`: boolean = true — If you set this value to False when creating a cluster, the default networking add-ons will not be installed.

  The default networking addons include vpc-cni, coredns, and kube-proxy.
  Use this option when you plan to install third-party alternative add-ons or self-manage the default networking add-ons.

  Changing this value after the cluster has been created will result in the cluster being replaced.

- `clusterHandlerEnvironment`: { [key: string]: string } — Custom environment variables when interacting with the EKS endpoint to manage the cluster lifecycle.

  **Default:** No environment variables.

- `clusterHandlerSecurityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — A security group to associate with the Cluster Handler's Lambdas.

  **Default:** No security group.

  The Cluster Handler's Lambdas are responsible for calling AWS's EKS API.

  Requires `placeClusterHandlerInVpc` to be set to true.

- `clusterLogging`: [ClusterLoggingTypes](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.ClusterLoggingTypes.html)[] = none — The cluster log types which you want to enable.

- `clusterName`: string — Name for the cluster.

  **Default:** Automatically generated name

- `controlPlaneScalingTier`: [ControlPlaneScalingTier](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.ControlPlaneScalingTier.html) — The control plane scaling tier for EKS Provisioned Control Plane.

  **Default:** Standard control plane (no provisioned tier)

  Provisioned Control Plane allows you to select a scaling tier to ensure
  high and predictable performance for demanding workloads such as
  AI training/inference, high-performance computing, or large-scale data processing.

- `coreDnsComputeType`: [CoreDnsComputeType](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.CoreDnsComputeType.html) — Controls the "eks.amazonaws.com/compute-type" annotation in the CoreDNS configuration on your cluster to determine which compute type to use for CoreDNS.

  **Default:** CoreDnsComputeType.EC2 (for `FargateCluster` the default is FARGATE)

- `defaultCapacity`: number = 2 — Number of instances to allocate as an initial capacity for this cluster.

  Instance type can be configured through `defaultCapacityInstanceType`,
  which defaults to `m5.large`.

  Use `cluster.addAutoScalingGroupCapacity` to add additional customized capacity. Set this
  to `0` is you wish to avoid the initial capacity allocation.

- `defaultCapacityInstance`: [InstanceType](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.InstanceType.html) = m5.large — The instance type to use for the default capacity.

  This will only be taken
  into account if `defaultCapacity` is > 0.

- `defaultCapacityType`: [DefaultCapacityType](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.DefaultCapacityType.html) = NODEGROUP — The default capacity type for the cluster.

- `deletionProtection`: boolean — The current deletion protection setting for the cluster.

  **Default:** deletion protection is disabled

  When true, deletion protection is enabled and the cluster cannot be deleted until protection is disabled.
  When false, the cluster can be deleted normally. This setting only applies to clusters in an active state.

- `endpointAccess`: [EndpointAccess](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.EndpointAccess.html) — Configure access to the Kubernetes API server endpoint..

  **Default:** EndpointAccess.PUBLIC_AND_PRIVATE

- `ipFamily`: [IpFamily](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.IpFamily.html) = IpFamily.IP_V4 — Specify which IP family is used to assign Kubernetes pod and service IP addresses.

- `kubectlEnvironment`: { [key: string]: string } — Environment variables for the kubectl execution.

  **Default:** No environment variables.

  Only relevant for kubectl enabled clusters.

- `kubectlLambdaRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The IAM role to pass to the Kubectl Lambda Handler.

  **Default:** Default Lambda IAM Execution Role

- `kubectlLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) (required) — An AWS Lambda Layer which includes `kubectl` and Helm.

  This layer is used by the kubectl handler to apply manifests and install
  helm charts. You must pick an appropriate releases of one of the
  `@aws-cdk/layer-kubectl-vXX` packages, that works with the version of
  Kubernetes you have chosen.

  The handler expects the layer to include the following executables:

  ```
  /opt/helm/helm
  /opt/kubectl/kubectl
  ```

- `kubectlMemory`: [Size](/cdk/api/v2/docs/aws-cdk-lib.Size.html) = Size.gibibytes(1) — Amount of memory to allocate to the provider's lambda function.

- `mastersRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — An IAM role that will be added to the `system:masters` Kubernetes RBAC group.

  **Default:** no masters role.

- `onEventLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — An AWS Lambda Layer which includes the NPM dependency `proxy-agent`.

  **Default:** a layer bundled with this module.

  This layer
  is used by the onEvent handler to route AWS SDK requests through a proxy.

  By default, the provider will use the layer included in the
  "aws-lambda-layer-node-proxy-agent" SAR application which is available in all
  commercial regions.

  To deploy the layer locally define it in your app as follows:

  ```ts
  const layer = new lambda.LayerVersion(this, 'proxy-agent-layer', {
    code: lambda.Code.fromAsset(`${__dirname}/layer.zip`),
    compatibleRuntimes: [lambda.Runtime.NODEJS_LATEST],
  });
  ```

- `outputClusterName`: boolean = false — Determines whether a CloudFormation output with the name of the cluster will be synthesized.

- `outputConfigCommand`: boolean = true — Determines whether a CloudFormation output with the `aws eks update-kubeconfig` command will be synthesized.

  This command will include
  the cluster name and the ARN of the masters IAM role.

  Note: If mastersRole is not specified, this property will be ignored and no config command will be emitted.

- `outputMastersRoleArn`: boolean = false — Determines whether a CloudFormation output with the ARN of the "masters" IAM role will be synthesized (if `mastersRole` is specified).

- `placeClusterHandlerInVpc`: boolean = false — If set to true, the cluster handler functions will be placed in the private subnets of the cluster vpc, subject to the `vpcSubnets` selection strategy.

- `prune`: boolean = true — Indicates whether Kubernetes resources added through `addManifest()` can be automatically pruned.

  When this is enabled (default), prune labels will be
  allocated and injected to each resource. These labels will then be used
  when issuing the `kubectl apply` operation with the `--prune` switch.

- `remoteNodeNetworks`: [RemoteNodeNetwork](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.RemoteNodeNetwork.html)[] = none — IPv4 CIDR blocks defining the expected address range of hybrid nodes that will join the cluster.

- `remotePodNetworks`: [RemotePodNetwork](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.RemotePodNetwork.html)[] = none — IPv4 CIDR blocks for Pods running Kubernetes webhooks on hybrid nodes.

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) — The removal policy applied to all CloudFormation resources created by this construct when they are no longer managed by CloudFormation.

  **Default:** Resources will be deleted.

  This can happen in one of three situations:
  - The resource is removed from the template, so CloudFormation stops managing it;
  - A change to the resource is made that requires it to be replaced, so CloudFormation stops managing it;
  - The stack is deleted, so CloudFormation stops managing all resources in it.

  This affects the EKS cluster itself, associated IAM roles, node groups, security groups, VPC
  and any other CloudFormation resources managed by this construct.

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — Role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.

  **Default:** A role is automatically created for you

- `secretsEncryptionKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — KMS secret for envelope encryption for Kubernetes secrets.

  **Default:** By default, Kubernetes stores all secret object data within etcd and all etcd volumes used by Amazon EKS are encrypted at the disk-level using AWS-Managed encryption keys.

- `securityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — Security Group to use for Control Plane ENIs.

  **Default:** A security group is automatically created

- `serviceIpv4Cidr`: string — The CIDR block to assign Kubernetes service IP addresses from.

  **Default:** Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks

- `tags`: { [key: string]: string } = none — The tags assigned to the EKS cluster.

- `version`: [KubernetesVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.KubernetesVersion.html) (required) — The Kubernetes version to run in the cluster.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) — The VPC in which to create the Cluster.

  **Default:** a VPC with default configuration will be created and can be accessed through `cluster.vpc`.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html)[] — Where to place EKS Control Plane ENIs.

  **Default:** All public and private subnets

  For example, to only select private subnets, supply the following:

  `vpcSubnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }]`

## Properties

- `adminRole`: [Role](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.Role.html) (required) — An IAM role with administrative permissions to create or update the cluster.

  This role also has `systems:master` permissions.

- `albController`: [AlbController](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AlbController.html) — The ALB Controller construct defined for this cluster.

  Will be undefined if `albController` wasn't configured.

- `authenticationMode`: [AuthenticationMode](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AuthenticationMode.html) = CONFIG_MAP. — The authentication mode for the Amazon EKS cluster.

  The authentication mode determines how users and applications authenticate to the Kubernetes API server.

- `awsAuth`: [AwsAuth](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AwsAuth.html) (required) — Lazily creates the AwsAuth resource, which manages AWS authentication mapping.

- `awscliLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — An AWS Lambda layer that contains the `aws` CLI.

  If not defined, a default layer will be used containing the AWS CLI 1.x.

- `clusterArn`: string (required) — The unique ARN assigned to the service by AWS in the form of arn:aws:eks:.

- `clusterCertificateAuthorityData`: string (required) — The certificate-authority-data for your cluster.

- `clusterEncryptionConfigKeyArn`: string (required) — Amazon Resource Name (ARN) or alias of the customer master key (CMK).

- `clusterEndpoint`: string (required) — The endpoint URL for the Cluster.

  This is the URL inside the kubeconfig file to use with kubectl

  For example, `https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com`

- `clusterHandlerSecurityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — A security group to associate with the Cluster Handler's Lambdas.

  **Default:** No security group.

  The Cluster Handler's Lambdas are responsible for calling AWS's EKS API.

  Requires `placeClusterHandlerInVpc` to be set to true.

- `clusterName`: string (required) — The physical name of the Cluster.

- `clusterOpenIdConnectIssuer`: string (required) — If this cluster is kubectl-enabled, returns the OpenID Connect issuer.

  This is because the values is only be retrieved by the API and not exposed
  by CloudFormation. If this cluster is not kubectl-enabled (i.e. uses the
  stock `CfnCluster`), this is `undefined`.

- `clusterOpenIdConnectIssuerUrl`: string (required) — If this cluster is kubectl-enabled, returns the OpenID Connect issuer url.

  This is because the values is only be retrieved by the API and not exposed
  by CloudFormation. If this cluster is not kubectl-enabled (i.e. uses the
  stock `CfnCluster`), this is `undefined`.

- `clusterRef`: [ClusterReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_eks.ClusterReference.html) (required) — A reference to a Cluster resource.

- `clusterSecurityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) (required) — The cluster security group that was created by Amazon EKS for the cluster.

- `clusterSecurityGroupId`: string (required) — The id of the cluster security group that was created by Amazon EKS for the cluster.

- `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) (required) — Manages connection rules (Security Group Rules) for the cluster.

- `defaultCapacity`: [AutoScalingGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_autoscaling.AutoScalingGroup.html) — The auto scaling group that hosts the default capacity for this cluster.

  This will be `undefined` if the `defaultCapacityType` is not `EC2` or
  `defaultCapacityType` is `EC2` but default capacity is set to 0.

- `defaultNodegroup`: [Nodegroup](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.Nodegroup.html) — The node group that hosts the default capacity for this cluster.

  This will be `undefined` if the `defaultCapacityType` is `EC2` or
  `defaultCapacityType` is `NODEGROUP` but default capacity is set to 0.

- `eksPodIdentityAgent`: [IAddon](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.IAddon.html) — Retrieves the EKS Pod Identity Agent addon for the EKS cluster.

  The EKS Pod Identity Agent is responsible for managing the temporary credentials
  used by pods in the cluster to access AWS resources. It runs as a DaemonSet on
  each node and provides the necessary credentials to the pods based on their
  associated service account.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) (required) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `ipFamily`: [IpFamily](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.IpFamily.html) = IpFamily.IP_V4 — Specify which IP family is used to assign Kubernetes pod and service IP addresses.

- `kubectlEnvironment`: { [key: string]: string } — Custom environment variables when running `kubectl` against this cluster.

- `kubectlLambdaRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — An IAM role that can perform kubectl operations against this cluster.

  **Default:** if not specified, the default role created by a lambda function will be used.

  The role should be mapped to the `system:masters` Kubernetes RBAC role.

  This role is directly passed to the lambda handler that sends Kube Ctl commands to the cluster.

- `kubectlLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — An AWS Lambda layer that includes `kubectl` and `helm`.

- `kubectlMemory`: [Size](/cdk/api/v2/docs/aws-cdk-lib.Size.html) — The amount of memory allocated to the kubectl provider's lambda function.

- `kubectlPrivateSubnets`: [ISubnet](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISubnet.html)[] — Subnets to host the `kubectl` compute resources.

  **Default:** If not specified, the k8s endpoint is expected to be accessible publicly.

- `kubectlRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — An IAM role that can perform kubectl operations against this cluster.

  The role should be mapped to the `system:masters` Kubernetes RBAC role.

- `kubectlSecurityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — A security group to use for `kubectl` execution.

  **Default:** If not specified, the k8s endpoint is expected to be accessible publicly.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) (required) — The tree node.

- `onEventLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — The AWS Lambda layer that contains the NPM dependency `proxy-agent`.

  If
  undefined, a SAR app that contains this layer will be used.

- `openIdConnectProvider`: [IOpenIdConnectProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IOpenIdConnectProvider.html) (required) — An `OpenIdConnectProvider` resource associated with this cluster, and which can be used to link this cluster to AWS IAM.

  A provider will only be defined if this property is accessed (lazy initialization).

- `PROPERTY_INJECTION_ID`: string (required) (static) — Uniquely identifies this class.

- `prune`: boolean (required) — Determines if Kubernetes resources can be pruned automatically.

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) (required) — IAM role assumed by the EKS Control Plane.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) (required) — The stack in which this resource is defined.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — The VPC in which this Cluster was created.

## Methods

- `addAutoScalingGroupCapacity(id: string, options: AutoScalingGroupCapacityOptions): AutoScalingGroup` — Add nodes to this EKS cluster.

  The nodes will automatically be configured with the right VPC and AMI
  for the instance type and Kubernetes version.

  Note that if you specify `updateType: RollingUpdate` or `updateType: ReplacingUpdate`, your nodes might be replaced at deploy
  time without notice in case the recommended AMI for your machine image type has been updated by AWS.
  The default behavior for `updateType` is `None`, which means only new instances will be launched using the new AMI.

  Spot instances will be labeled `lifecycle=Ec2Spot` and tainted with `PreferNoSchedule`.
  In addition, the [spot interrupt handler](https://github.com/awslabs/ec2-spot-labs/tree/master/ec2-spot-eks-solution/spot-termination-handler)
  daemon will be installed on all spot instances to handle
  [EC2 Spot Instance Termination Notices](https://aws.amazon.com/blogs/aws/new-ec2-spot-instance-termination-notices/).

- `addCdk8sChart(id: string, chart: Construct, options?: KubernetesManifestOptions): KubernetesManifest` — Defines a CDK8s chart in this cluster.

  **Parameters**

  - `id` — logical id of this chart.
  - `chart` — the cdk8s chart.

  **Returns:** a `KubernetesManifest` construct representing the chart.

- `addFargateProfile(id: string, options: FargateProfileOptions): FargateProfile` — Adds a Fargate profile to this cluster.

  **Parameters**

  - `id` — the id of this profile.
  - `options` — profile options.

- `addHelmChart(id: string, options: HelmChartOptions): HelmChart` — Defines a Helm chart in this cluster.

  **Parameters**

  - `id` — logical id of this chart.
  - `options` — options of this chart.

  **Returns:** a `HelmChart` construct

- `addManifest(id: string, ...manifest: { [key: string]: any }[]): KubernetesManifest` — Defines a Kubernetes resource in this cluster.

  The manifest will be applied/deleted using kubectl as needed.

  **Parameters**

  - `id` — logical id of this manifest.
  - `manifest` — a list of Kubernetes resource specifications.

  **Returns:** a `KubernetesResource` object.

- `addNodegroupCapacity(id: string, options?: NodegroupOptions): Nodegroup` — Add managed nodegroup to this Amazon EKS cluster.

  This method will create a new managed nodegroup and add into the capacity.

  **Parameters**

  - `id` — The ID of the nodegroup.
  - `options` — options for creating a new nodegroup.

- `addServiceAccount(id: string, options?: ServiceAccountOptions): ServiceAccount` — Creates a new service account with corresponding IAM Role (IRSA).

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `connectAutoScalingGroupCapacity(autoScalingGroup: AutoScalingGroup, options: AutoScalingGroupOptions): void` — Connect capacity in the form of an existing AutoScalingGroup to the EKS cluster.

  The AutoScalingGroup must be running an EKS-optimized AMI containing the
  /etc/eks/bootstrap.sh script. This method will configure Security Groups,
  add the right policies to the instance role, apply the right tags, and add
  the required user data to the instance's launch configuration.

  Spot instances will be labeled `lifecycle=Ec2Spot` and tainted with `PreferNoSchedule`.
  If kubectl is enabled, the
  [spot interrupt handler](https://github.com/awslabs/ec2-spot-labs/tree/master/ec2-spot-eks-solution/spot-termination-handler)
  daemon will be installed on all spot instances to handle
  [EC2 Spot Instance Termination Notices](https://aws.amazon.com/blogs/aws/new-ec2-spot-instance-termination-notices/).

  Prefer to use `addAutoScalingGroupCapacity` if possible.

  **Parameters**

  - `autoScalingGroup` — [disable-awslint:ref-via-interface].
  - `options` — options for adding auto scaling groups, like customizing the bootstrap script.

- `fromClusterAttributes(scope: Construct, id: string, attrs: ClusterAttributes): ICluster` (static) — Import an existing cluster.

  **Parameters**

  - `scope` — the construct scope, in most cases 'this'.
  - `id` — the id or name to import as.
  - `attrs` — the cluster properties to use for importing information.

- `getIngressLoadBalancerAddress(ingressName: string, options?: IngressLoadBalancerAddressOptions): string` — Fetch the load balancer address of an ingress backed by a load balancer.

  **Parameters**

  - `ingressName` — The name of the ingress.
  - `options` — Additional operation options.

- `getServiceLoadBalancerAddress(serviceName: string, options?: ServiceLoadBalancerAddressOptions): string` — Fetch the load balancer address of a service of type 'LoadBalancer'.

  **Parameters**

  - `serviceName` — The name of the service.
  - `options` — Additional operation options.

- `grantAccess(id: string, principal: string, accessPolicies: IAccessPolicy[], options?: GrantAccessOptions): void` — Grants the specified IAM principal access to the EKS cluster based on the provided access policies.

  This method creates an `AccessEntry` construct that grants the specified IAM principal the access permissions
  defined by the provided `IAccessPolicy` array. This allows the IAM principal to perform the actions permitted
  by the access policies within the EKS cluster.

  **Parameters**

  - `id` — - The ID of the `AccessEntry` construct to be created.
  - `principal` — - The IAM principal (role or user) to be granted access to the EKS cluster.
  - `accessPolicies` — - An array of `IAccessPolicy` objects that define the access permissions to be granted to the IAM principal.
  - `options` — - Additional options for granting access.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.