# ClusterAttributes

Attributes for EKS clusters.

- Source: [`aws-eks/lib/cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-eks/lib/cluster.ts#L287)
- Type last changed: v2.179.0 · 18 Feb 2025

## Example

```ts
declare const cluster: eks.Cluster;
declare const asg: autoscaling.AutoScalingGroup;
const importedCluster = eks.Cluster.fromClusterAttributes(this, 'ImportedCluster', {
  clusterName: cluster.clusterName,
  clusterSecurityGroupId: cluster.clusterSecurityGroupId,
});

importedCluster.connectAutoScalingGroupCapacity(asg, {});
```

## Properties

- `awscliLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — An AWS Lambda layer that contains the `aws` CLI.

  **Default:** a default layer with the AWS CLI 1.x

  The handler expects the layer to include the following executables:

  ```
  /opt/awscli/aws
  ```

- `clusterCertificateAuthorityData`: string — The certificate-authority-data for your cluster.

  **Default:** if not specified `cluster.clusterCertificateAuthorityData` will throw an error

- `clusterEncryptionConfigKeyArn`: string — Amazon Resource Name (ARN) or alias of the customer master key (CMK).

  **Default:** if not specified `cluster.clusterEncryptionConfigKeyArn` will throw an error

- `clusterEndpoint`: string — The API Server endpoint URL.

  **Default:** if not specified `cluster.clusterEndpoint` will throw an error.

- `clusterHandlerSecurityGroupId`: string — A security group id to associate with the Cluster Handler's Lambdas.

  **Default:** No security group.

  The Cluster Handler's Lambdas are responsible for calling AWS's EKS API.

- `clusterName`: string (required) — The physical name of the Cluster.

- `clusterSecurityGroupId`: string — The cluster security group that was created by Amazon EKS for the cluster.

  **Default:** if not specified `cluster.clusterSecurityGroupId` will throw an error

- `ipFamily`: [IpFamily](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.IpFamily.html) = IpFamily.IP_V4 — Specify which IP family is used to assign Kubernetes pod and service IP addresses.

- `kubectlEnvironment`: { [key: string]: string } — Environment variables to use when running `kubectl` against this cluster.

  **Default:** no additional variables

- `kubectlLambdaRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — An IAM role that can perform kubectl operations against this cluster.

  **Default:** if not specified, the default role created by a lambda function will be used.

  The role should be mapped to the `system:masters` Kubernetes RBAC role.

  This role is directly passed to the lambda handler that sends Kube Ctl commands
  to the cluster.

- `kubectlLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — An AWS Lambda Layer which includes `kubectl` and Helm.

  **Default:** No default layer will be provided

  This layer is used by the kubectl handler to apply manifests and install
  helm charts. You must pick an appropriate releases of one of the
  `@aws-cdk/layer-kubectl-vXX` packages, that works with the version of
  Kubernetes you have chosen.

  The handler expects the layer to include the following executables:

  ```
  /opt/helm/helm
  /opt/kubectl/kubectl
  ```

- `kubectlMemory`: [Size](/cdk/api/v2/docs/aws-cdk-lib.Size.html) = Size.gibibytes(1) — Amount of memory to allocate to the provider's lambda function.

- `kubectlPrivateSubnetIds`: string[] — Subnets to host the `kubectl` compute resources.

  **Default:** k8s endpoint is expected to be accessible publicly

  If not specified, the k8s
  endpoint is expected to be accessible publicly.

- `kubectlProvider`: [IKubectlProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_eks.IKubectlProvider.html) — KubectlProvider for issuing kubectl commands.

  **Default:** Default CDK provider

- `kubectlRoleArn`: string — An IAM role with cluster administrator and "system:masters" permissions.

  **Default:** if not specified, it not be possible to issue `kubectl` commands against an imported cluster.

- `kubectlSecurityGroupId`: string — A security group to use for `kubectl` execution.

  **Default:** k8s endpoint is expected to be accessible publicly

  If not specified, the k8s
  endpoint is expected to be accessible publicly.

- `onEventLayer`: [ILayerVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.ILayerVersion.html) — An AWS Lambda Layer which includes the NPM dependency `proxy-agent`.

  **Default:** a layer bundled with this module.

  This layer
  is used by the onEvent handler to route AWS SDK requests through a proxy.

  The handler expects the layer to include the following node_modules:

     proxy-agent

- `openIdConnectProvider`: [IOpenIdConnectProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IOpenIdConnectProvider.html) — An Open ID Connect provider for this cluster that can be used to configure service accounts.

  **Default:** if not specified `cluster.openIdConnectProvider` and `cluster.addServiceAccount` will throw an error.

  You can either import an existing provider using `iam.OpenIdConnectProvider.fromProviderArn`,
  or create a new provider using `new eks.OpenIdConnectProvider`

- `prune`: boolean = true — Indicates whether Kubernetes resources added through `addManifest()` can be automatically pruned.

  When this is enabled (default), prune labels will be
  allocated and injected to each resource. These labels will then be used
  when issuing the `kubectl apply` operation with the `--prune` switch.

- `securityGroupIds`: string[] — Additional security groups associated with this cluster.

  **Default:** if not specified, no additional security groups will be considered in `cluster.connections`.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) — The VPC in which this Cluster was created.

  **Default:** if not specified `cluster.vpc` will throw an error