CfnCluster
- class aws_cdk.aws_eks.CfnCluster(scope, id, *, resources_vpc_config, role_arn, access_config=None, bootstrap_self_managed_addons=None, encryption_config=None, kubernetes_network_config=None, logging=None, name=None, outpost_config=None, tags=None, version=None)
Bases:
CfnResource
Creates an Amazon EKS control plane.
The Amazon EKS control plane consists of control plane instances that run the Kubernetes software, such as
etcd
and the API server. The control plane runs in an account managed by AWS , and the Kubernetes API is exposed by the Amazon EKS API server endpoint. Each Amazon EKS cluster control plane is single tenant and unique. It runs on its own set of Amazon EC2 instances.The cluster control plane is provisioned across multiple Availability Zones and fronted by an Elastic Load Balancing Network Load Balancer. Amazon EKS also provisions elastic network interfaces in your VPC subnets to provide connectivity from the control plane instances to the nodes (for example, to support
kubectl exec
,logs
, andproxy
data flows).Amazon EKS nodes run in your AWS account and connect to your cluster’s control plane over the Kubernetes API server endpoint and a certificate file that is created for your cluster.
You can use the
endpointPublicAccess
andendpointPrivateAccess
parameters to enable or disable public and private access to your cluster’s Kubernetes API server endpoint. By default, public access is enabled, and private access is disabled. For more information, see Amazon EKS Cluster Endpoint Access Control in the Amazon EKS User Guide .You can use the
logging
parameter to enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren’t exported to CloudWatch Logs. For more information, see Amazon EKS Cluster Control Plane Logs in the Amazon EKS User Guide . .. epigraph:CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see `CloudWatch Pricing <https://docs.aws.amazon.com/cloudwatch/pricing/>`_ .
In most cases, it takes several minutes to create a cluster. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch nodes into your cluster. For more information, see Allowing users to access your cluster and Launching Amazon EKS nodes in the Amazon EKS User Guide .
- See:
http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-eks-cluster.html
- CloudformationResource:
AWS::EKS::Cluster
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks cfn_cluster = eks.CfnCluster(self, "MyCfnCluster", resources_vpc_config=eks.CfnCluster.ResourcesVpcConfigProperty( subnet_ids=["subnetIds"], # the properties below are optional endpoint_private_access=False, endpoint_public_access=False, public_access_cidrs=["publicAccessCidrs"], security_group_ids=["securityGroupIds"] ), role_arn="roleArn", # the properties below are optional access_config=eks.CfnCluster.AccessConfigProperty( authentication_mode="authenticationMode", bootstrap_cluster_creator_admin_permissions=False ), bootstrap_self_managed_addons=False, encryption_config=[eks.CfnCluster.EncryptionConfigProperty( provider=eks.CfnCluster.ProviderProperty( key_arn="keyArn" ), resources=["resources"] )], kubernetes_network_config=eks.CfnCluster.KubernetesNetworkConfigProperty( ip_family="ipFamily", service_ipv4_cidr="serviceIpv4Cidr", service_ipv6_cidr="serviceIpv6Cidr" ), logging=eks.CfnCluster.LoggingProperty( cluster_logging=eks.CfnCluster.ClusterLoggingProperty( enabled_types=[eks.CfnCluster.LoggingTypeConfigProperty( type="type" )] ) ), name="name", outpost_config=eks.CfnCluster.OutpostConfigProperty( control_plane_instance_type="controlPlaneInstanceType", outpost_arns=["outpostArns"], # the properties below are optional control_plane_placement=eks.CfnCluster.ControlPlanePlacementProperty( group_name="groupName" ) ), tags=[CfnTag( key="key", value="value" )], version="version" )
- Parameters:
scope (
Construct
) – Scope in which this resource is defined.id (
str
) – Construct identifier for this resource (unique in its scope).resources_vpc_config (
Union
[IResolvable
,ResourcesVpcConfigProperty
,Dict
[str
,Any
]]) – The VPC configuration that’s used by the cluster control plane. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide . You must specify at least two subnets. You can specify up to five security groups, but we recommend that you use a dedicated security group for your cluster control plane.role_arn (
str
) – The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. For more information, see Amazon EKS Service IAM Role in the Amazon EKS User Guide .access_config (
Union
[IResolvable
,AccessConfigProperty
,Dict
[str
,Any
],None
]) – The access configuration for the cluster.bootstrap_self_managed_addons (
Union
[bool
,IResolvable
,None
]) – If you set this value toFalse
when creating a cluster, the default networking add-ons will not be installed. The default networking addons include vpc-cni, coredns, and kube-proxy. Use this option when you plan to install third-party alternative add-ons or self-manage the default networking add-ons.encryption_config (
Union
[IResolvable
,Sequence
[Union
[IResolvable
,EncryptionConfigProperty
,Dict
[str
,Any
]]],None
]) – The encryption configuration for the cluster.kubernetes_network_config (
Union
[IResolvable
,KubernetesNetworkConfigProperty
,Dict
[str
,Any
],None
]) – The Kubernetes network configuration for the cluster.logging (
Union
[IResolvable
,LoggingProperty
,Dict
[str
,Any
],None
]) – The logging configuration for your cluster.name (
Optional
[str
]) – The unique name to give to your cluster.outpost_config (
Union
[IResolvable
,OutpostConfigProperty
,Dict
[str
,Any
],None
]) – An object representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This object isn’t available for clusters on the AWS cloud.tags (
Optional
[Sequence
[Union
[CfnTag
,Dict
[str
,Any
]]]]) – The metadata that you apply to the cluster to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define. Cluster tags don’t propagate to any other resources associated with the cluster. .. epigraph:: You must have theeks:TagResource
andeks:UntagResource
permissions for your IAM principal to manage the AWS CloudFormation stack. If you don’t have these permissions, there might be unexpected behavior with stack-level tags propagating to the resource during resource creation and update.version (
Optional
[str
]) – The desired Kubernetes version for your cluster. If you don’t specify a value here, the default version available in Amazon EKS is used. .. epigraph:: The default version might not be the latest version available.
Methods
- add_deletion_override(path)
Syntactic sugar for
addOverride(path, undefined)
.- Parameters:
path (
str
) – The path of the value to delete.- Return type:
None
- add_dependency(target)
Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
This can be used for resources across stacks (or nested stack) boundaries and the dependency will automatically be transferred to the relevant scope.
- Parameters:
target (
CfnResource
) –- Return type:
None
- add_depends_on(target)
(deprecated) Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
- Parameters:
target (
CfnResource
) –- Deprecated:
use addDependency
- Stability:
deprecated
- Return type:
None
- add_metadata(key, value)
Add a value to the CloudFormation Resource Metadata.
- Parameters:
key (
str
) –value (
Any
) –
- See:
- Return type:
None
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.
- add_override(path, value)
Adds an override to the synthesized CloudFormation resource.
To add a property override, either use
addPropertyOverride
or prefixpath
with “Properties.” (i.e.Properties.TopicName
).If the override is nested, separate each nested level using a dot (.) in the path parameter. If there is an array as part of the nesting, specify the index in the path.
To include a literal
.
in the property name, prefix with a\
. In most programming languages you will need to write this as"\\."
because the\
itself will need to be escaped.For example:
cfn_resource.add_override("Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes", ["myattribute"]) cfn_resource.add_override("Properties.GlobalSecondaryIndexes.1.ProjectionType", "INCLUDE")
would add the overrides Example:
"Properties": { "GlobalSecondaryIndexes": [ { "Projection": { "NonKeyAttributes": [ "myattribute" ] ... } ... }, { "ProjectionType": "INCLUDE" ... }, ] ... }
The
value
argument toaddOverride
will not be processed or translated in any way. Pass raw JSON values in here with the correct capitalization for CloudFormation. If you pass CDK classes or structs, they will be rendered with lowercased key names, and CloudFormation will reject the template.- Parameters:
path (
str
) –The path of the property, you can use dot notation to override values in complex types. Any intermediate keys will be created as needed.
value (
Any
) –The value. Could be primitive or complex.
- Return type:
None
- add_property_deletion_override(property_path)
Adds an override that deletes the value of a property from the resource definition.
- Parameters:
property_path (
str
) – The path to the property.- Return type:
None
- add_property_override(property_path, value)
Adds an override to a resource property.
Syntactic sugar for
addOverride("Properties.<...>", value)
.- Parameters:
property_path (
str
) – The path of the property.value (
Any
) – The value.
- Return type:
None
- apply_removal_policy(policy=None, *, apply_to_update_replace_policy=None, default=None)
Sets the deletion policy of the resource based on the removal policy specified.
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you’ve removed it from the CDK application or because you’ve made a change that requires the resource to be replaced.
The resource can be deleted (
RemovalPolicy.DESTROY
), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN
). In some cases, a snapshot can be taken of the resource prior to deletion (RemovalPolicy.SNAPSHOT
). A list of resources that support this policy can be found in the following link:- Parameters:
policy (
Optional
[RemovalPolicy
]) –apply_to_update_replace_policy (
Optional
[bool
]) – Apply the same deletion policy to the resource’s “UpdateReplacePolicy”. Default: truedefault (
Optional
[RemovalPolicy
]) – The default policy to apply in case the removal policy is not defined. Default: - Default value is resource specific. To determine the default value for a resource, please consult that specific resource’s documentation.
- See:
- Return type:
None
- get_att(attribute_name, type_hint=None)
Returns a token for an runtime attribute of this resource.
Ideally, use generated attribute accessors (e.g.
resource.arn
), but this can be used for future compatibility in case there is no generated attribute.- Parameters:
attribute_name (
str
) – The name of the attribute.type_hint (
Optional
[ResolutionTypeHint
]) –
- Return type:
- get_metadata(key)
Retrieve a value value from the CloudFormation Resource Metadata.
- Parameters:
key (
str
) –- See:
- Return type:
Any
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.
- inspect(inspector)
Examines the CloudFormation resource and discloses attributes.
- Parameters:
inspector (
TreeInspector
) – tree inspector to collect and process attributes.- Return type:
None
- obtain_dependencies()
Retrieves an array of resources this resource depends on.
This assembles dependencies on resources across stacks (including nested stacks) automatically.
- Return type:
List
[Union
[Stack
,CfnResource
]]
- obtain_resource_dependencies()
Get a shallow copy of dependencies between this resource and other resources in the same stack.
- Return type:
List
[CfnResource
]
- override_logical_id(new_logical_id)
Overrides the auto-generated logical ID with a specific ID.
- Parameters:
new_logical_id (
str
) – The new logical ID to use for this stack element.- Return type:
None
- remove_dependency(target)
Indicates that this resource no longer depends on another resource.
This can be used for resources across stacks (including nested stacks) and the dependency will automatically be removed from the relevant scope.
- Parameters:
target (
CfnResource
) –- Return type:
None
- replace_dependency(target, new_target)
Replaces one dependency with another.
- Parameters:
target (
CfnResource
) – The dependency to replace.new_target (
CfnResource
) – The new dependency to add.
- Return type:
None
- to_string()
Returns a string representation of this construct.
- Return type:
str
- Returns:
a string representation of this resource
Attributes
- CFN_RESOURCE_TYPE_NAME = 'AWS::EKS::Cluster'
- access_config
The access configuration for the cluster.
- attr_arn
The ARN of the cluster, such as
arn:aws:eks:us-west-2:666666666666:cluster/prod
.- CloudformationAttribute:
Arn
- attr_certificate_authority_data
The
certificate-authority-data
for your cluster.- CloudformationAttribute:
CertificateAuthorityData
- attr_cluster_security_group_id
The cluster security group that was created by Amazon EKS for the cluster.
Managed node groups use this security group for control plane to data plane communication.
This parameter is only returned by Amazon EKS clusters that support managed node groups. For more information, see Managed node groups in the Amazon EKS User Guide .
- CloudformationAttribute:
ClusterSecurityGroupId
- attr_encryption_config_key_arn
Amazon Resource Name (ARN) or alias of the customer master key (CMK).
- CloudformationAttribute:
EncryptionConfigKeyArn
- attr_endpoint
The endpoint for your Kubernetes API server, such as
https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com
.- CloudformationAttribute:
Endpoint
- attr_id
The ID of your local Amazon EKS cluster on an AWS Outpost.
This property isn’t available for an Amazon EKS cluster on the AWS cloud.
- CloudformationAttribute:
Id
- attr_kubernetes_network_config_service_ipv6_cidr
The CIDR block that Kubernetes Service IP addresses are assigned from if you created a
1.21
or later cluster with version>1.10.1
or later of the Amazon VPC CNI add-on and specifiedipv6
for ipFamily when you created the cluster. Kubernetes assigns Service addresses from the unique local address range (fc00::/7
) because you can’t specify a customIPv6
CIDR block when you create the cluster.- CloudformationAttribute:
KubernetesNetworkConfig.ServiceIpv6Cidr
- attr_open_id_connect_issuer_url
The issuer URL for the OIDC identity provider of the cluster, such as
https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E
. If you need to removehttps://
from this output value, you can include the following code in your template.!Select [1, !Split ["//", !GetAtt EKSCluster.OpenIdConnectIssuerUrl]]
- CloudformationAttribute:
OpenIdConnectIssuerUrl
- bootstrap_self_managed_addons
If you set this value to
False
when creating a cluster, the default networking add-ons will not be installed.
- cfn_options
Options for this resource, such as condition, update policy etc.
- cfn_resource_type
AWS resource type.
- creation_stack
return:
the stack trace of the point where this Resource was created from, sourced from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most node +internal+ entries filtered.
- encryption_config
The encryption configuration for the cluster.
- kubernetes_network_config
The Kubernetes network configuration for the cluster.
- logging
The logging configuration for your cluster.
- logical_id
The logical ID for this CloudFormation stack element.
The logical ID of the element is calculated from the path of the resource node in the construct tree.
To override this value, use
overrideLogicalId(newLogicalId)
.- Returns:
the logical ID as a stringified token. This value will only get resolved during synthesis.
- name
The unique name to give to your cluster.
- node
The tree node.
- outpost_config
An object representing the configuration of your local Amazon EKS cluster on an AWS Outpost.
- ref
Return a string that will be resolved to a CloudFormation
{ Ref }
for this element.If, by any chance, the intrinsic reference of a resource is not a string, you could coerce it to an IResolvable through
Lazy.any({ produce: resource.ref })
.
- resources_vpc_config
The VPC configuration that’s used by the cluster control plane.
- role_arn
The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.
- stack
The stack in which this element is defined.
CfnElements must be defined within a stack scope (directly or indirectly).
- tags
Tag Manager which manages the tags for this resource.
- tags_raw
The metadata that you apply to the cluster to assist with categorization and organization.
- version
The desired Kubernetes version for your cluster.
Static Methods
- classmethod is_cfn_element(x)
Returns
true
if a construct is a stack element (i.e. part of the synthesized cloudformation template).Uses duck-typing instead of
instanceof
to allow stack elements from different versions of this library to be included in the same stack.- Parameters:
x (
Any
) –- Return type:
bool
- Returns:
The construct as a stack element or undefined if it is not a stack element.
- classmethod is_cfn_resource(x)
Check whether the given object is a CfnResource.
- Parameters:
x (
Any
) –- Return type:
bool
- classmethod is_construct(x)
Checks if
x
is a construct.Use this method instead of
instanceof
to properly detectConstruct
instances, even when the construct library is symlinked.Explanation: in JavaScript, multiple copies of the
constructs
library on disk are seen as independent, completely different libraries. As a consequence, the classConstruct
in each copy of theconstructs
library is seen as a different class, and an instance of one class will not test asinstanceof
the other class.npm install
will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of theconstructs
library can be accidentally installed, andinstanceof
will behave unpredictably. It is safest to avoid usinginstanceof
, and using this type-testing method instead.- Parameters:
x (
Any
) – Any object.- Return type:
bool
- Returns:
true if
x
is an object created from a class which extendsConstruct
.
AccessConfigProperty
- class CfnCluster.AccessConfigProperty(*, authentication_mode=None, bootstrap_cluster_creator_admin_permissions=None)
Bases:
object
The access configuration for the cluster.
- Parameters:
authentication_mode (
Optional
[str
]) – The desired authentication mode for the cluster. If you create a cluster by using the EKS API, AWS SDKs, or AWS CloudFormation , the default isCONFIG_MAP
. If you create the cluster by using the AWS Management Console , the default value isAPI_AND_CONFIG_MAP
.bootstrap_cluster_creator_admin_permissions (
Union
[bool
,IResolvable
,None
]) – Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time. The default value istrue
.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks access_config_property = eks.CfnCluster.AccessConfigProperty( authentication_mode="authenticationMode", bootstrap_cluster_creator_admin_permissions=False )
Attributes
- authentication_mode
The desired authentication mode for the cluster.
If you create a cluster by using the EKS API, AWS SDKs, or AWS CloudFormation , the default is
CONFIG_MAP
. If you create the cluster by using the AWS Management Console , the default value isAPI_AND_CONFIG_MAP
.
- bootstrap_cluster_creator_admin_permissions
Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time.
The default value is
true
.
ClusterLoggingProperty
- class CfnCluster.ClusterLoggingProperty(*, enabled_types=None)
Bases:
object
The cluster control plane logging configuration for your cluster.
When updating a resource, you must include this
ClusterLogging
property if the previous CloudFormation template of the resource had it.- Parameters:
enabled_types (
Union
[IResolvable
,Sequence
[Union
[IResolvable
,LoggingTypeConfigProperty
,Dict
[str
,Any
]]],None
]) – The enabled control plane logs for your cluster. All log types are disabled if the array is empty. .. epigraph:: When updating a resource, you must include thisEnabledTypes
property if the previous CloudFormation template of the resource had it.- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks cluster_logging_property = eks.CfnCluster.ClusterLoggingProperty( enabled_types=[eks.CfnCluster.LoggingTypeConfigProperty( type="type" )] )
Attributes
- enabled_types
The enabled control plane logs for your cluster. All log types are disabled if the array is empty.
When updating a resource, you must include this
EnabledTypes
property if the previous CloudFormation template of the resource had it.
ControlPlanePlacementProperty
- class CfnCluster.ControlPlanePlacementProperty(*, group_name=None)
Bases:
object
The placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost.
For more information, see Capacity considerations in the Amazon EKS User Guide.
- Parameters:
group_name (
Optional
[str
]) – The name of the placement group for the Kubernetes control plane instances. This property is only used for a local cluster on an AWS Outpost.- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks control_plane_placement_property = eks.CfnCluster.ControlPlanePlacementProperty( group_name="groupName" )
Attributes
- group_name
The name of the placement group for the Kubernetes control plane instances.
This property is only used for a local cluster on an AWS Outpost.
EncryptionConfigProperty
- class CfnCluster.EncryptionConfigProperty(*, provider=None, resources=None)
Bases:
object
The encryption configuration for the cluster.
- Parameters:
provider (
Union
[IResolvable
,ProviderProperty
,Dict
[str
,Any
],None
]) – The encryption provider for the cluster.resources (
Optional
[Sequence
[str
]]) – Specifies the resources to be encrypted. The only supported value issecrets
.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks encryption_config_property = eks.CfnCluster.EncryptionConfigProperty( provider=eks.CfnCluster.ProviderProperty( key_arn="keyArn" ), resources=["resources"] )
Attributes
- provider
The encryption provider for the cluster.
- resources
Specifies the resources to be encrypted.
The only supported value is
secrets
.
KubernetesNetworkConfigProperty
- class CfnCluster.KubernetesNetworkConfigProperty(*, ip_family=None, service_ipv4_cidr=None, service_ipv6_cidr=None)
Bases:
object
The Kubernetes network configuration for the cluster.
- Parameters:
ip_family (
Optional
[str
]) – Specify which IP family is used to assign Kubernetes pod and service IP addresses. If you don’t specify a value,ipv4
is used by default. You can only specify an IP family when you create a cluster and can’t change this value once the cluster is created. If you specifyipv6
, the VPC and subnets that you specify for cluster creation must have bothIPv4
andIPv6
CIDR blocks assigned to them. You can’t specifyipv6
for clusters in China Regions. You can only specifyipv6
for1.21
and later clusters that use version1.10.1
or later of the Amazon VPC CNI add-on. If you specifyipv6
, then ensure that your VPC meets the requirements listed in the considerations listed in Assigning IPv6 addresses to pods and services in the Amazon EKS User Guide. Kubernetes assigns servicesIPv6
addresses from the unique local address range(fc00::/7)
. You can’t specify a customIPv6
CIDR block. Pod addresses are assigned from the subnet’sIPv6
CIDR.service_ipv4_cidr (
Optional
[str
]) – Don’t specify a value if you selectipv6
for ipFamily . The CIDR block to assign Kubernetes service IP addresses from. If you don’t specify a block, Kubernetes assigns addresses from either the10.100.0.0/16
or172.20.0.0/16
CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. The block must meet the following requirements: - Within one of the following private IP address blocks:10.0.0.0/8
,172.16.0.0/12
, or192.168.0.0/16
. - Doesn’t overlap with any CIDR block assigned to the VPC that you selected for VPC. - Between/24
and/12
. .. epigraph:: You can only specify a custom CIDR block when you create a cluster. You can’t change this value after the cluster is created.service_ipv6_cidr (
Optional
[str
]) – The CIDR block that Kubernetes pod and service IP addresses are assigned from if you created a 1.21 or later cluster with version 1.10.1 or later of the Amazon VPC CNI add-on and specifiedipv6
for ipFamily when you created the cluster. Kubernetes assigns service addresses from the unique local address range (fc00::/7
) because you can’t specify a custom IPv6 CIDR block when you create the cluster.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks kubernetes_network_config_property = eks.CfnCluster.KubernetesNetworkConfigProperty( ip_family="ipFamily", service_ipv4_cidr="serviceIpv4Cidr", service_ipv6_cidr="serviceIpv6Cidr" )
Attributes
- ip_family
Specify which IP family is used to assign Kubernetes pod and service IP addresses.
If you don’t specify a value,
ipv4
is used by default. You can only specify an IP family when you create a cluster and can’t change this value once the cluster is created. If you specifyipv6
, the VPC and subnets that you specify for cluster creation must have bothIPv4
andIPv6
CIDR blocks assigned to them. You can’t specifyipv6
for clusters in China Regions.You can only specify
ipv6
for1.21
and later clusters that use version1.10.1
or later of the Amazon VPC CNI add-on. If you specifyipv6
, then ensure that your VPC meets the requirements listed in the considerations listed in Assigning IPv6 addresses to pods and services in the Amazon EKS User Guide. Kubernetes assigns servicesIPv6
addresses from the unique local address range(fc00::/7)
. You can’t specify a customIPv6
CIDR block. Pod addresses are assigned from the subnet’sIPv6
CIDR.
- service_ipv4_cidr
Don’t specify a value if you select
ipv6
for ipFamily .The CIDR block to assign Kubernetes service IP addresses from. If you don’t specify a block, Kubernetes assigns addresses from either the
10.100.0.0/16
or172.20.0.0/16
CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. The block must meet the following requirements:Within one of the following private IP address blocks:
10.0.0.0/8
,172.16.0.0/12
, or192.168.0.0/16
.Doesn’t overlap with any CIDR block assigned to the VPC that you selected for VPC.
Between
/24
and/12
.
You can only specify a custom CIDR block when you create a cluster. You can’t change this value after the cluster is created.
- service_ipv6_cidr
The CIDR block that Kubernetes pod and service IP addresses are assigned from if you created a 1.21 or later cluster with version 1.10.1 or later of the Amazon VPC CNI add-on and specified
ipv6
for ipFamily when you created the cluster. Kubernetes assigns service addresses from the unique local address range (fc00::/7
) because you can’t specify a custom IPv6 CIDR block when you create the cluster.
LoggingProperty
- class CfnCluster.LoggingProperty(*, cluster_logging=None)
Bases:
object
Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs.
By default, cluster control plane logs aren’t exported to CloudWatch Logs. For more information, see Amazon EKS Cluster control plane logs in the Amazon EKS User Guide . .. epigraph:
When updating a resource, you must include this ``Logging`` property if the previous CloudFormation template of the resource had it. > CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see `CloudWatch Pricing <https://docs.aws.amazon.com/cloudwatch/pricing/>`_ .
- Parameters:
cluster_logging (
Union
[IResolvable
,ClusterLoggingProperty
,Dict
[str
,Any
],None
]) – The cluster control plane logging configuration for your cluster.- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks logging_property = eks.CfnCluster.LoggingProperty( cluster_logging=eks.CfnCluster.ClusterLoggingProperty( enabled_types=[eks.CfnCluster.LoggingTypeConfigProperty( type="type" )] ) )
Attributes
- cluster_logging
The cluster control plane logging configuration for your cluster.
LoggingTypeConfigProperty
- class CfnCluster.LoggingTypeConfigProperty(*, type=None)
Bases:
object
The enabled logging type.
For a list of the valid logging types, see the
`types
property ofLogSetup
<https://docs.aws.amazon.com/eks/latest/APIReference/API_LogSetup.html#AmazonEKS-Type-LogSetup-types>`_ in the Amazon EKS API Reference .- Parameters:
type (
Optional
[str
]) – The name of the log type.- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks logging_type_config_property = eks.CfnCluster.LoggingTypeConfigProperty( type="type" )
Attributes
OutpostConfigProperty
- class CfnCluster.OutpostConfigProperty(*, control_plane_instance_type, outpost_arns, control_plane_placement=None)
Bases:
object
The configuration of your local Amazon EKS cluster on an AWS Outpost.
Before creating a cluster on an Outpost, review Creating a local cluster on an Outpost in the Amazon EKS User Guide . This API isn’t available for Amazon EKS clusters on the AWS cloud.
- Parameters:
control_plane_instance_type (
str
) –The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. Choose an instance type based on the number of nodes that your cluster will have. For more information, see Capacity considerations in the Amazon EKS User Guide . The instance type that you specify is used for all Kubernetes control plane instances. The instance type can’t be changed after cluster creation. The control plane is not automatically scaled by Amazon EKS.
outpost_arns (
Sequence
[str
]) – The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. Only a single Outpost ARN is supported.control_plane_placement (
Union
[IResolvable
,ControlPlanePlacementProperty
,Dict
[str
,Any
],None
]) –An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost. For more information, see Capacity considerations in the Amazon EKS User Guide .
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks outpost_config_property = eks.CfnCluster.OutpostConfigProperty( control_plane_instance_type="controlPlaneInstanceType", outpost_arns=["outpostArns"], # the properties below are optional control_plane_placement=eks.CfnCluster.ControlPlanePlacementProperty( group_name="groupName" ) )
Attributes
- control_plane_instance_type
The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts.
Choose an instance type based on the number of nodes that your cluster will have. For more information, see Capacity considerations in the Amazon EKS User Guide .
The instance type that you specify is used for all Kubernetes control plane instances. The instance type can’t be changed after cluster creation. The control plane is not automatically scaled by Amazon EKS.
- control_plane_placement
An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost.
For more information, see Capacity considerations in the Amazon EKS User Guide .
- outpost_arns
The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts.
Only a single Outpost ARN is supported.
ProviderProperty
- class CfnCluster.ProviderProperty(*, key_arn=None)
Bases:
object
Identifies the AWS Key Management Service ( AWS KMS ) key used to encrypt the secrets.
- Parameters:
key_arn (
Optional
[str
]) –Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric and created in the same AWS Region as the cluster. If the KMS key was created in a different account, the IAM principal must have access to the KMS key. For more information, see Allowing users in other accounts to use a KMS key in the AWS Key Management Service Developer Guide .
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks provider_property = eks.CfnCluster.ProviderProperty( key_arn="keyArn" )
Attributes
- key_arn
Amazon Resource Name (ARN) or alias of the KMS key.
The KMS key must be symmetric and created in the same AWS Region as the cluster. If the KMS key was created in a different account, the IAM principal must have access to the KMS key. For more information, see Allowing users in other accounts to use a KMS key in the AWS Key Management Service Developer Guide .
ResourcesVpcConfigProperty
- class CfnCluster.ResourcesVpcConfigProperty(*, subnet_ids, endpoint_private_access=None, endpoint_public_access=None, public_access_cidrs=None, security_group_ids=None)
Bases:
object
An object representing the VPC configuration to use for an Amazon EKS cluster.
When updating a resource, you must include these properties if the previous CloudFormation template of the resource had them:
EndpointPublicAccess
EndpointPrivateAccess
PublicAccessCidrs
- Parameters:
subnet_ids (
Sequence
[str
]) – Specify subnets for your Amazon EKS nodes. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your nodes and the Kubernetes control plane.endpoint_private_access (
Union
[bool
,IResolvable
,None
]) –Set this value to
true
to enable private access for your cluster’s Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster’s VPC use the private VPC endpoint. The default value for this parameter isfalse
, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or AWS Fargate pods in the cluster, then ensure thatpublicAccessCidrs
includes the necessary CIDR blocks for communication with the nodes or Fargate pods. For more information, see Amazon EKS cluster endpoint access control in the Amazon EKS User Guide .endpoint_public_access (
Union
[bool
,IResolvable
,None
]) –Set this value to
false
to disable public access to your cluster’s Kubernetes API server endpoint. If you disable public access, your cluster’s Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter istrue
, which enables public access for your Kubernetes API server. For more information, see Amazon EKS cluster endpoint access control in the Amazon EKS User Guide .public_access_cidrs (
Optional
[Sequence
[str
]]) –The CIDR blocks that are allowed access to your cluster’s public Kubernetes API server endpoint. Communication to the endpoint from addresses outside of the CIDR blocks that you specify is denied. The default value is
0.0.0.0/0
. If you’ve disabled private endpoint access, make sure that you specify the necessary CIDR blocks for every node and AWS FargatePod
in the cluster. For more information, see Amazon EKS cluster endpoint access control in the Amazon EKS User Guide .security_group_ids (
Optional
[Sequence
[str
]]) – Specify one or more security groups for the cross-account elastic network interfaces that Amazon EKS creates to use that allow communication between your nodes and the Kubernetes control plane. If you don’t specify any security groups, then familiarize yourself with the difference between Amazon EKS defaults for clusters deployed with Kubernetes. For more information, see Amazon EKS security group considerations in the Amazon EKS User Guide .
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_eks as eks resources_vpc_config_property = eks.CfnCluster.ResourcesVpcConfigProperty( subnet_ids=["subnetIds"], # the properties below are optional endpoint_private_access=False, endpoint_public_access=False, public_access_cidrs=["publicAccessCidrs"], security_group_ids=["securityGroupIds"] )
Attributes
- endpoint_private_access
Set this value to
true
to enable private access for your cluster’s Kubernetes API server endpoint.If you enable private access, Kubernetes API requests from within your cluster’s VPC use the private VPC endpoint. The default value for this parameter is
false
, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or AWS Fargate pods in the cluster, then ensure thatpublicAccessCidrs
includes the necessary CIDR blocks for communication with the nodes or Fargate pods. For more information, see Amazon EKS cluster endpoint access control in the Amazon EKS User Guide .
- endpoint_public_access
Set this value to
false
to disable public access to your cluster’s Kubernetes API server endpoint.If you disable public access, your cluster’s Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter is
true
, which enables public access for your Kubernetes API server. For more information, see Amazon EKS cluster endpoint access control in the Amazon EKS User Guide .
- public_access_cidrs
The CIDR blocks that are allowed access to your cluster’s public Kubernetes API server endpoint.
Communication to the endpoint from addresses outside of the CIDR blocks that you specify is denied. The default value is
0.0.0.0/0
. If you’ve disabled private endpoint access, make sure that you specify the necessary CIDR blocks for every node and AWS FargatePod
in the cluster. For more information, see Amazon EKS cluster endpoint access control in the Amazon EKS User Guide .
- security_group_ids
Specify one or more security groups for the cross-account elastic network interfaces that Amazon EKS creates to use that allow communication between your nodes and the Kubernetes control plane.
If you don’t specify any security groups, then familiarize yourself with the difference between Amazon EKS defaults for clusters deployed with Kubernetes. For more information, see Amazon EKS security group considerations in the Amazon EKS User Guide .
- subnet_ids
Specify subnets for your Amazon EKS nodes.
Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your nodes and the Kubernetes control plane.