ClusterProps
- class aws_cdk.aws_eks.ClusterProps(*, version, cluster_name=None, output_cluster_name=None, output_config_command=None, role=None, security_group=None, vpc=None, vpc_subnets=None, kubectl_layer, alb_controller=None, authentication_mode=None, awscli_layer=None, cluster_handler_environment=None, cluster_handler_security_group=None, cluster_logging=None, core_dns_compute_type=None, endpoint_access=None, ip_family=None, kubectl_environment=None, kubectl_memory=None, masters_role=None, on_event_layer=None, output_masters_role_arn=None, place_cluster_handler_in_vpc=None, prune=None, remote_node_networks=None, remote_pod_networks=None, secrets_encryption_key=None, service_ipv4_cidr=None, bootstrap_cluster_creator_admin_permissions=None, default_capacity=None, default_capacity_instance=None, default_capacity_type=None, kubectl_lambda_role=None, tags=None)
Bases:
ClusterOptions
Common configuration props for EKS clusters.
- Parameters:
version (
KubernetesVersion
) – The Kubernetes version to run in the cluster.cluster_name (
Optional
[str
]) – Name for the cluster. Default: - Automatically generated nameoutput_cluster_name (
Optional
[bool
]) – Determines whether a CloudFormation output with the name of the cluster will be synthesized. Default: falseoutput_config_command (
Optional
[bool
]) – Determines whether a CloudFormation output with theaws eks update-kubeconfig
command will be synthesized. This command will include the cluster name and, if applicable, the ARN of the masters IAM role. Default: truerole (
Optional
[IRole
]) – Role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Default: - A role is automatically created for yousecurity_group (
Optional
[ISecurityGroup
]) – Security Group to use for Control Plane ENIs. Default: - A security group is automatically createdvpc (
Optional
[IVpc
]) – The VPC in which to create the Cluster. Default: - a VPC with default configuration will be created and can be accessed throughcluster.vpc
.vpc_subnets (
Optional
[Sequence
[Union
[SubnetSelection
,Dict
[str
,Any
]]]]) – Where to place EKS Control Plane ENIs. For example, to only select private subnets, supply the following:vpcSubnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }]
Default: - All public and private subnetskubectl_layer (
ILayerVersion
) – An AWS Lambda Layer which includeskubectl
and Helm. This layer is used by the kubectl handler to apply manifests and install helm charts. You must pick an appropriate releases of one of the@aws-cdk/layer-kubectl-vXX
packages, that works with the version of Kubernetes you have chosen. The handler expects the layer to include the following executables:: /opt/helm/helm /opt/kubectl/kubectlalb_controller (
Union
[AlbControllerOptions
,Dict
[str
,Any
],None
]) – Install the AWS Load Balancer Controller onto the cluster. Default: - The controller is not installed.authentication_mode (
Optional
[AuthenticationMode
]) – The desired authentication mode for the cluster. Default: AuthenticationMode.CONFIG_MAPawscli_layer (
Optional
[ILayerVersion
]) – An AWS Lambda layer that contains theaws
CLI. The handler expects the layer to include the following executables:: /opt/awscli/aws Default: - a default layer with the AWS CLI 1.xcluster_handler_environment (
Optional
[Mapping
[str
,str
]]) – Custom environment variables when interacting with the EKS endpoint to manage the cluster lifecycle. Default: - No environment variables.cluster_handler_security_group (
Optional
[ISecurityGroup
]) – A security group to associate with the Cluster Handler’s Lambdas. The Cluster Handler’s Lambdas are responsible for calling AWS’s EKS API. RequiresplaceClusterHandlerInVpc
to be set to true. Default: - No security group.cluster_logging (
Optional
[Sequence
[ClusterLoggingTypes
]]) – The cluster log types which you want to enable. Default: - nonecore_dns_compute_type (
Optional
[CoreDnsComputeType
]) – Controls the “eks.amazonaws.com/compute-type” annotation in the CoreDNS configuration on your cluster to determine which compute type to use for CoreDNS. Default: CoreDnsComputeType.EC2 (forFargateCluster
the default is FARGATE)endpoint_access (
Optional
[EndpointAccess
]) – Configure access to the Kubernetes API server endpoint.. Default: EndpointAccess.PUBLIC_AND_PRIVATEip_family (
Optional
[IpFamily
]) – Specify which IP family is used to assign Kubernetes pod and service IP addresses. Default: - IpFamily.IP_V4kubectl_environment (
Optional
[Mapping
[str
,str
]]) – Environment variables for the kubectl execution. Only relevant for kubectl enabled clusters. Default: - No environment variables.kubectl_memory (
Optional
[Size
]) – Amount of memory to allocate to the provider’s lambda function. Default: Size.gibibytes(1)masters_role (
Optional
[IRole
]) – An IAM role that will be added to thesystem:masters
Kubernetes RBAC group. Default: - no masters role.on_event_layer (
Optional
[ILayerVersion
]) – An AWS Lambda Layer which includes the NPM dependencyproxy-agent
. This layer is used by the onEvent handler to route AWS SDK requests through a proxy. By default, the provider will use the layer included in the “aws-lambda-layer-node-proxy-agent” SAR application which is available in all commercial regions. To deploy the layer locally define it in your app as follows:: const layer = new lambda.LayerVersion(this, ‘proxy-agent-layer’, { code: lambda.Code.fromAsset(${__dirname}/layer.zip), compatibleRuntimes: [lambda.Runtime.NODEJS_LATEST], }); Default: - a layer bundled with this module.output_masters_role_arn (
Optional
[bool
]) – Determines whether a CloudFormation output with the ARN of the “masters” IAM role will be synthesized (ifmastersRole
is specified). Default: falseplace_cluster_handler_in_vpc (
Optional
[bool
]) – If set to true, the cluster handler functions will be placed in the private subnets of the cluster vpc, subject to thevpcSubnets
selection strategy. Default: falseprune (
Optional
[bool
]) – Indicates whether Kubernetes resources added throughaddManifest()
can be automatically pruned. When this is enabled (default), prune labels will be allocated and injected to each resource. These labels will then be used when issuing thekubectl apply
operation with the--prune
switch. Default: trueremote_node_networks (
Optional
[Sequence
[Union
[RemoteNodeNetwork
,Dict
[str
,Any
]]]]) – IPv4 CIDR blocks defining the expected address range of hybrid nodes that will join the cluster. Default: - noneremote_pod_networks (
Optional
[Sequence
[Union
[RemotePodNetwork
,Dict
[str
,Any
]]]]) – IPv4 CIDR blocks for Pods running Kubernetes webhooks on hybrid nodes. Default: - nonesecrets_encryption_key (
Optional
[IKey
]) – KMS secret for envelope encryption for Kubernetes secrets. Default: - By default, Kubernetes stores all secret object data within etcd and all etcd volumes used by Amazon EKS are encrypted at the disk-level using AWS-Managed encryption keys.service_ipv4_cidr (
Optional
[str
]) – The CIDR block to assign Kubernetes service IP addresses from. Default: - Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocksbootstrap_cluster_creator_admin_permissions (
Optional
[bool
]) – Whether or not IAM principal of the cluster creator was set as a cluster admin access entry during cluster creation time. Changing this value after the cluster has been created will result in the cluster being replaced. Default: truedefault_capacity (
Union
[int
,float
,None
]) – Number of instances to allocate as an initial capacity for this cluster. Instance type can be configured throughdefaultCapacityInstanceType
, which defaults tom5.large
. Usecluster.addAutoScalingGroupCapacity
to add additional customized capacity. Set this to0
is you wish to avoid the initial capacity allocation. Default: 2default_capacity_instance (
Optional
[InstanceType
]) – The instance type to use for the default capacity. This will only be taken into account ifdefaultCapacity
is > 0. Default: m5.largedefault_capacity_type (
Optional
[DefaultCapacityType
]) – The default capacity type for the cluster. Default: NODEGROUPkubectl_lambda_role (
Optional
[IRole
]) – The IAM role to pass to the Kubectl Lambda Handler. Default: - Default Lambda IAM Execution Roletags (
Optional
[Mapping
[str
,str
]]) – The tags assigned to the EKS cluster. Default: - none
- ExampleMetadata:
infused
Example:
from aws_cdk.lambda_layer_kubectl_v32 import KubectlV32Layer # or # vpc: ec2.Vpc eks.Cluster(self, "MyCluster", kubectl_memory=Size.gibibytes(4), version=eks.KubernetesVersion.V1_32, kubectl_layer=KubectlV32Layer(self, "kubectl") ) eks.Cluster.from_cluster_attributes(self, "MyCluster", kubectl_memory=Size.gibibytes(4), vpc=vpc, cluster_name="cluster-name" )
Attributes
- alb_controller
Install the AWS Load Balancer Controller onto the cluster.
- Default:
The controller is not installed.
- See:
https://kubernetes-sigs.github.io/aws-load-balancer-controller
- authentication_mode
The desired authentication mode for the cluster.
- Default:
AuthenticationMode.CONFIG_MAP
- awscli_layer
An AWS Lambda layer that contains the
aws
CLI.The handler expects the layer to include the following executables:
/opt/awscli/aws
- Default:
a default layer with the AWS CLI 1.x
- bootstrap_cluster_creator_admin_permissions
Whether or not IAM principal of the cluster creator was set as a cluster admin access entry during cluster creation time.
Changing this value after the cluster has been created will result in the cluster being replaced.
- Default:
true
- cluster_handler_environment
Custom environment variables when interacting with the EKS endpoint to manage the cluster lifecycle.
- Default:
No environment variables.
- cluster_handler_security_group
A security group to associate with the Cluster Handler’s Lambdas.
The Cluster Handler’s Lambdas are responsible for calling AWS’s EKS API.
Requires
placeClusterHandlerInVpc
to be set to true.- Default:
No security group.
- cluster_logging
The cluster log types which you want to enable.
- Default:
none
- cluster_name
Name for the cluster.
- Default:
Automatically generated name
- core_dns_compute_type
Controls the “eks.amazonaws.com/compute-type” annotation in the CoreDNS configuration on your cluster to determine which compute type to use for CoreDNS.
- Default:
CoreDnsComputeType.EC2 (for
FargateCluster
the default is FARGATE)
- default_capacity
Number of instances to allocate as an initial capacity for this cluster.
Instance type can be configured through
defaultCapacityInstanceType
, which defaults tom5.large
.Use
cluster.addAutoScalingGroupCapacity
to add additional customized capacity. Set this to0
is you wish to avoid the initial capacity allocation.- Default:
2
- default_capacity_instance
The instance type to use for the default capacity.
This will only be taken into account if
defaultCapacity
is > 0.- Default:
m5.large
- default_capacity_type
The default capacity type for the cluster.
- Default:
NODEGROUP
- endpoint_access
Configure access to the Kubernetes API server endpoint..
- Default:
EndpointAccess.PUBLIC_AND_PRIVATE
- See:
https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html
- ip_family
Specify which IP family is used to assign Kubernetes pod and service IP addresses.
- kubectl_environment
Environment variables for the kubectl execution.
Only relevant for kubectl enabled clusters.
- Default:
No environment variables.
- kubectl_lambda_role
The IAM role to pass to the Kubectl Lambda Handler.
- Default:
Default Lambda IAM Execution Role
- kubectl_layer
An AWS Lambda Layer which includes
kubectl
and Helm.This layer is used by the kubectl handler to apply manifests and install helm charts. You must pick an appropriate releases of one of the
@aws-cdk/layer-kubectl-vXX
packages, that works with the version of Kubernetes you have chosen.The handler expects the layer to include the following executables:
/opt/helm/helm /opt/kubectl/kubectl
- kubectl_memory
Amount of memory to allocate to the provider’s lambda function.
- Default:
Size.gibibytes(1)
- masters_role
An IAM role that will be added to the
system:masters
Kubernetes RBAC group.- Default:
no masters role.
- See:
https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings
- on_event_layer
An AWS Lambda Layer which includes the NPM dependency
proxy-agent
.This layer is used by the onEvent handler to route AWS SDK requests through a proxy.
By default, the provider will use the layer included in the “aws-lambda-layer-node-proxy-agent” SAR application which is available in all commercial regions.
To deploy the layer locally define it in your app as follows:
layer = lambda_.LayerVersion(self, "proxy-agent-layer", code=lambda_.Code.from_asset(f"{__dirname}/layer.zip"), compatible_runtimes=[lambda_.Runtime.NODEJS_LATEST] )
- Default:
a layer bundled with this module.
- output_cluster_name
Determines whether a CloudFormation output with the name of the cluster will be synthesized.
- Default:
false
- output_config_command
Determines whether a CloudFormation output with the
aws eks update-kubeconfig
command will be synthesized.This command will include the cluster name and, if applicable, the ARN of the masters IAM role.
- Default:
true
- output_masters_role_arn
Determines whether a CloudFormation output with the ARN of the “masters” IAM role will be synthesized (if
mastersRole
is specified).- Default:
false
- place_cluster_handler_in_vpc
If set to true, the cluster handler functions will be placed in the private subnets of the cluster vpc, subject to the
vpcSubnets
selection strategy.- Default:
false
- prune
Indicates whether Kubernetes resources added through
addManifest()
can be automatically pruned.When this is enabled (default), prune labels will be allocated and injected to each resource. These labels will then be used when issuing the
kubectl apply
operation with the--prune
switch.- Default:
true
- remote_node_networks
IPv4 CIDR blocks defining the expected address range of hybrid nodes that will join the cluster.
- Default:
none
- remote_pod_networks
IPv4 CIDR blocks for Pods running Kubernetes webhooks on hybrid nodes.
- Default:
none
- role
Role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.
- Default:
A role is automatically created for you
- secrets_encryption_key
KMS secret for envelope encryption for Kubernetes secrets.
- Default:
By default, Kubernetes stores all secret object data within etcd and
all etcd volumes used by Amazon EKS are encrypted at the disk-level using AWS-Managed encryption keys.
- security_group
Security Group to use for Control Plane ENIs.
- Default:
A security group is automatically created
- service_ipv4_cidr
The CIDR block to assign Kubernetes service IP addresses from.
- Default:
Kubernetes assigns addresses from either the
10.100.0.0/16 or 172.20.0.0/16 CIDR blocks
- tags
The tags assigned to the EKS cluster.
- Default:
none
- version
The Kubernetes version to run in the cluster.
- vpc
The VPC in which to create the Cluster.
- Default:
a VPC with default configuration will be created and can be accessed through
cluster.vpc
.
- vpc_subnets
Where to place EKS Control Plane ENIs.
For example, to only select private subnets, supply the following:
vpcSubnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }]
- Default:
All public and private subnets