aws-cdk-lib.aws_eks.ICluster

ICluster Interface

An EKS cluster.

ICluster

extends

• IResource,
• IConnectable,
• IClusterRef

implemented by

• Cluster,
• FargateCluster

Source

aws-eks/lib/cluster.ts

Type last changed

v2.236.0 · 23 Jan 2026

Properties

authenticationMode?may be undefinedAuthenticationModeauthentication_mode?may be undefinedAuthenticationModeauthenticationMode?may be undefinedAuthenticationModeAuthenticationMode?may be undefinedAuthenticationModeAuthenticationMode?may be undefinedAuthenticationMode= AuthenticationMode.CONFIG_MAP#

The authentication mode for the cluster.

awscliLayer?may be undefinedILayerVersionawscli_layer?may be undefinedILayerVersionawscliLayer?may be undefinedILayerVersionAwscliLayer?may be undefinedILayerVersionAwscliLayer?may be undefinedILayerVersion#

An AWS Lambda layer that contains the `aws` CLI.

If not defined, a default layer will be used containing the AWS CLI 1.x.

clusterArnstringcluster_arnstrclusterArnStringClusterArnstringClusterArn*string#

The unique ARN assigned to the service by AWS in the form of arn:aws:eks:.

clusterCertificateAuthorityDatastringcluster_certificate_authority_datastrclusterCertificateAuthorityDataStringClusterCertificateAuthorityDatastringClusterCertificateAuthorityData*string#

The certificate-authority-data for your cluster.

clusterEncryptionConfigKeyArnstringcluster_encryption_config_key_arnstrclusterEncryptionConfigKeyArnStringClusterEncryptionConfigKeyArnstringClusterEncryptionConfigKeyArn*string#

Amazon Resource Name (ARN) or alias of the customer master key (CMK).

clusterEndpointstringcluster_endpointstrclusterEndpointStringClusterEndpointstringClusterEndpoint*string#

The API Server endpoint URL.

clusterHandlerSecurityGroup?may be undefinedISecurityGroupcluster_handler_security_group?may be undefinedISecurityGroupclusterHandlerSecurityGroup?may be undefinedISecurityGroupClusterHandlerSecurityGroup?may be undefinedISecurityGroupClusterHandlerSecurityGroup?may be undefinedISecurityGroup#

A security group to associate with the Cluster Handler's Lambdas.

Default: No security group.

The Cluster Handler's Lambdas are responsible for calling AWS's EKS API.

Requires placeClusterHandlerInVpc to be set to true.

clusterNamestringcluster_namestrclusterNameStringClusterNamestringClusterName*string#

The physical name of the Cluster.

clusterRefClusterReferencecluster_refClusterReferenceclusterRefClusterReferenceClusterRefClusterReferenceClusterRefClusterReference#

A reference to a Cluster resource.

clusterSecurityGroupISecurityGroupcluster_security_groupISecurityGroupclusterSecurityGroupISecurityGroupClusterSecurityGroupISecurityGroupClusterSecurityGroupISecurityGroup#

The cluster security group that was created by Amazon EKS for the cluster.

clusterSecurityGroupIdstringcluster_security_group_idstrclusterSecurityGroupIdStringClusterSecurityGroupIdstringClusterSecurityGroupId*string#

The id of the cluster security group that was created by Amazon EKS for the cluster.

connectionsConnectionsconnectionsConnectionsconnectionsConnectionsConnectionsConnectionsConnectionsConnections#

The network connections associated with this resource.

eksPodIdentityAgent?may be undefinedIAddoneks_pod_identity_agent?may be undefinedIAddoneksPodIdentityAgent?may be undefinedIAddonEksPodIdentityAgent?may be undefinedIAddonEksPodIdentityAgent?may be undefinedIAddon#

The EKS Pod Identity Agent addon for the EKS cluster.

notes

The EKS Pod Identity Agent is responsible for managing the temporary credentials used by pods in the cluster to access AWS resources. It runs as a DaemonSet on each node and provides the necessary credentials to the pods based on their associated service account.

This property returns the CfnAddon resource representing the EKS Pod Identity Agent addon. If the addon has not been created yet, it will be created and returned.

envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironment#

The environment this resource belongs to.

notes

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

ipFamily?may be undefinedIpFamilyip_family?may be undefinedIpFamilyipFamily?may be undefinedIpFamilyIpFamily?may be undefinedIpFamilyIpFamily?may be undefinedIpFamily= IpFamily.IP_V4#

Specify which IP family is used to assign Kubernetes pod and service IP addresses.

kubectlEnvironment?may be undefined{ [key: string]: string }kubectl_environment?may be undefinedtyping.Mapping[str, str]kubectlEnvironment?may be undefinedMap<String, String>KubectlEnvironment?may be undefinedIDictionary<string, string>KubectlEnvironment?may be undefined*map[string]*string#

Custom environment variables when running `kubectl` against this cluster.

kubectlLambdaRole?may be undefinedIRolekubectl_lambda_role?may be undefinedIRolekubectlLambdaRole?may be undefinedIRoleKubectlLambdaRole?may be undefinedIRoleKubectlLambdaRole?may be undefinedIRole#

An IAM role that can perform kubectl operations against this cluster.

The role should be mapped to the system:masters Kubernetes RBAC role.

This role is directly passed to the lambda handler that sends Kube Ctl commands to the cluster.

kubectlLayer?may be undefinedILayerVersionkubectl_layer?may be undefinedILayerVersionkubectlLayer?may be undefinedILayerVersionKubectlLayer?may be undefinedILayerVersionKubectlLayer?may be undefinedILayerVersion#

An AWS Lambda layer that includes `kubectl` and `helm`.

kubectlMemory?may be undefinedSizekubectl_memory?may be undefinedSizekubectlMemory?may be undefinedSizeKubectlMemory?may be undefinedSizeKubectlMemory?may be undefinedSize#

Amount of memory to allocate to the provider's lambda function.

kubectlPrivateSubnets?may be undefinedISubnet[]kubectl_private_subnets?may be undefinedtyping.List[ISubnet]kubectlPrivateSubnets?may be undefinedList<ISubnet>KubectlPrivateSubnets?may be undefinedISubnet[]KubectlPrivateSubnets?may be undefined*[]ISubnet#

Subnets to host the `kubectl` compute resources.

If this is undefined, the k8s endpoint is expected to be accessible publicly.

kubectlProvider?may be undefinedIKubectlProviderkubectl_provider?may be undefinedIKubectlProviderkubectlProvider?may be undefinedIKubectlProviderKubectlProvider?may be undefinedIKubectlProviderKubectlProvider?may be undefinedIKubectlProvider#

Kubectl Provider for issuing kubectl commands against it.

If not defined, a default provider will be used

kubectlRole?may be undefinedIRolekubectl_role?may be undefinedIRolekubectlRole?may be undefinedIRoleKubectlRole?may be undefinedIRoleKubectlRole?may be undefinedIRole#

An IAM role that can perform kubectl operations against this cluster.

The role should be mapped to the system:masters Kubernetes RBAC role.

kubectlSecurityGroup?may be undefinedISecurityGroupkubectl_security_group?may be undefinedISecurityGroupkubectlSecurityGroup?may be undefinedISecurityGroupKubectlSecurityGroup?may be undefinedISecurityGroupKubectlSecurityGroup?may be undefinedISecurityGroup#

A security group to use for `kubectl` execution.

If this is undefined, the k8s endpoint is expected to be accessible publicly.

nodeNodenodeNodenodeNodeNodeNodeNodeNode#

The tree node.

onEventLayer?may be undefinedILayerVersionon_event_layer?may be undefinedILayerVersiononEventLayer?may be undefinedILayerVersionOnEventLayer?may be undefinedILayerVersionOnEventLayer?may be undefinedILayerVersion#

An AWS Lambda layer that includes the NPM dependency `proxy-agent`.

If not defined, a default layer will be used.

openIdConnectProviderIOpenIdConnectProvideropen_id_connect_providerIOpenIdConnectProvideropenIdConnectProviderIOpenIdConnectProviderOpenIdConnectProviderIOpenIdConnectProviderOpenIdConnectProviderIOpenIdConnectProvider#

The Open ID Connect Provider of the cluster used to configure Service Accounts.

prunebooleanpruneboolpruneBooleanPruneboolPrune*bool#

Indicates whether Kubernetes resources can be automatically pruned.

When this is enabled (default), prune labels will be allocated and injected to each resource. These labels will then be used when issuing the kubectl apply operation with the --prune switch.

stackStackstackStackstackStackStackStackStackStack#

The stack in which this resource is defined.

vpcIVpcvpcIVpcvpcIVpcVpcIVpcVpcIVpc#

The VPC in which this Cluster was created.

Methods

addCdk8sChart(id: string, chart: Construct, options?: KubernetesManifestOptions): KubernetesManifestdef add_cdk8s_chart(self, id: str, chart: Construct, options: typing.Optional[KubernetesManifestOptions] = None) -> KubernetesManifestpublic KubernetesManifest addCdk8sChart(String id, Construct chart, KubernetesManifestOptions options)public KubernetesManifest AddCdk8sChart(string id, Construct chart, KubernetesManifestOptions? options = null)func AddCdk8sChart(Id *string, Chart Construct, Options KubernetesManifestOptions) KubernetesManifest#

Defines a CDK8s chart in this cluster.

2 parameters · returns

Parameters

• ididididId — logical id of this chart.
• chartchartchartchartChart — the cdk8s chart.

Returns: a KubernetesManifest construct representing the chart.

addHelmChart(id: string, options: HelmChartOptions): HelmChartdef add_helm_chart(self, id: str, options: HelmChartOptions) -> HelmChartpublic HelmChart addHelmChart(String id, HelmChartOptions options)public HelmChart AddHelmChart(string id, HelmChartOptions options)func AddHelmChart(Id *string, Options HelmChartOptions) HelmChart#

Defines a Helm chart in this cluster.

2 parameters · returns

Parameters

• ididididId — logical id of this chart.
• optionsoptionsoptionsoptionsOptions — options of this chart.

Returns: a HelmChart construct

addManifest(id: string, ...manifest: { [key: string]: any }[]): KubernetesManifestdef add_manifest(self, id: str, manifest: typing.Mapping[str, Any]) -> KubernetesManifestpublic KubernetesManifest addManifest(String id, Map<String, Object> manifest)public KubernetesManifest AddManifest(string id, IDictionary<string, object> manifest)func AddManifest(Id *string, Manifest *map[string]interface{}) KubernetesManifest#

Defines a Kubernetes resource in this cluster.

The manifest will be applied/deleted using kubectl as needed.

2 parameters · returns

Parameters

• ididididId — logical id of this manifest.
• manifestmanifestmanifestmanifestManifest — a list of Kubernetes resource specifications.

Returns: a KubernetesManifest object.

addServiceAccount(id: string, options?: ServiceAccountOptions): ServiceAccountdef add_service_account(self, id: str, options: typing.Optional[ServiceAccountOptions] = None) -> ServiceAccountpublic ServiceAccount addServiceAccount(String id, ServiceAccountOptions options)public ServiceAccount AddServiceAccount(string id, ServiceAccountOptions? options = null)func AddServiceAccount(Id *string, Options ServiceAccountOptions) ServiceAccount#

Creates a new service account with corresponding IAM Role (IRSA).

2 parameters

Parameters

• ididididId — logical id of service account.
• optionsoptionsoptionsoptionsOptions — service account options.

applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#

Apply the given removal policy to this resource.

notes

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

connectAutoScalingGroupCapacity(autoScalingGroup: AutoScalingGroup, options: AutoScalingGroupOptions): voiddef connect_auto_scaling_group_capacity(self, auto_scaling_group: AutoScalingGroup, options: AutoScalingGroupOptions) -> Nonepublic void connectAutoScalingGroupCapacity(AutoScalingGroup autoScalingGroup, AutoScalingGroupOptions options)public void ConnectAutoScalingGroupCapacity(AutoScalingGroup autoScalingGroup, AutoScalingGroupOptions options)func ConnectAutoScalingGroupCapacity(AutoScalingGroup AutoScalingGroup, Options AutoScalingGroupOptions)#

Connect capacity in the form of an existing AutoScalingGroup to the EKS cluster.

notes · 2 parameters

The AutoScalingGroup must be running an EKS-optimized AMI containing the /etc/eks/bootstrap.sh script. This method will configure Security Groups, add the right policies to the instance role, apply the right tags, and add the required user data to the instance's launch configuration.

Spot instances will be labeled lifecycle=Ec2Spot and tainted with PreferNoSchedule. If kubectl is enabled, the spot interrupt handler daemon will be installed on all spot instances to handle EC2 Spot Instance Termination Notices.

Prefer to use addAutoScalingGroupCapacity if possible.

Parameters

• autoScalingGroupauto_scaling_groupautoScalingGroupautoScalingGroupAutoScalingGroup — [disable-awslint:ref-via-interface].
• optionsoptionsoptionsoptionsOptions — options for adding auto scaling groups, like customizing the bootstrap script.

with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited.

1 parameter · returns

Parameters

• mixinsmixinsmixinsmixinsMixins — The mixins to apply.

Returns: This construct for chaining