# FargateCluster

Defines an EKS cluster that runs entirely on AWS Fargate.

The cluster is created with a default Fargate Profile that matches the
"default" and "kube-system" namespaces. You can add additional profiles using
`addFargateProfile`.

Extends: Construct › Resource › Cluster › FargateCluster
Implements: IResource, IConnectable, ICluster, IEnvironmentAware, IClusterRef, IConstruct, IDependable

- Source: [`aws-eks-v2/lib/fargate-cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-eks-v2/lib/fargate-cluster.ts#L28)
- Type last changed: v2.240.0 · 23 Feb 2026

## Example

```ts
const cluster = new eks.FargateCluster(this, 'FargateCluster', {
  version: eks.KubernetesVersion.V1_36,
});
```

## Initializer

```ts
new FargateCluster(scope: Construct, id: string, props: FargateClusterProps)
```

## Construct Props

- `albController`: [AlbControllerOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.AlbControllerOptions.html) — Install the AWS Load Balancer Controller onto the cluster.

  **Default:** The controller is not installed.

- `clusterLogging`: [ClusterLoggingTypes](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.ClusterLoggingTypes.html)[] = none — The cluster log types which you want to enable.

- `clusterName`: string — Name for the cluster.

  **Default:** Automatically generated name

- `controlPlaneScalingTier`: [ControlPlaneScalingTier](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.ControlPlaneScalingTier.html) — The scaling tier for the cluster's provisioned control plane.

  **Default:** Standard control plane (no provisioned tier)

  Provisioned Control Plane allows you to select a scaling tier to ensure
  high and predictable performance for demanding workloads such as
  AI training/inference, high-performance computing, or large-scale data processing.

- `coreDnsComputeType`: [CoreDnsComputeType](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.CoreDnsComputeType.html) — Controls the "eks.amazonaws.com/compute-type" annotation in the CoreDNS configuration on your cluster to determine which compute type to use for CoreDNS.

  **Default:** CoreDnsComputeType.EC2 (for `FargateCluster` the default is FARGATE)

- `defaultProfile`: [FargateProfileOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.FargateProfileOptions.html) — Fargate Profile to create along with the cluster.

  **Default:** A profile called "default" with 'default' and 'kube-system' selectors will be created if this is left undefined.

- `endpointAccess`: [EndpointAccess](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.EndpointAccess.html) — Configure access to the Kubernetes API server endpoint..

  **Default:** EndpointAccess.PUBLIC_AND_PRIVATE

- `ipFamily`: [IpFamily](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.IpFamily.html) = IpFamily.IP_V4 — Specify which IP family is used to assign Kubernetes pod and service IP addresses.

- `kubectlProviderOptions`: [KubectlProviderOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.KubectlProviderOptions.html) — Options for creating the kubectl provider - a lambda function that executes `kubectl` and `helm` against the cluster.

  **Default:** kubectl provider will not be created

  If defined, `kubectlLayer` is a required property.

- `mastersRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — An IAM role that will be added to the `system:masters` Kubernetes RBAC group.

  **Default:** no masters role.

- `prune`: boolean = true — Indicates whether Kubernetes resources added through `addManifest()` can be automatically pruned.

  When this is enabled (default), prune labels will be
  allocated and injected to each resource. These labels will then be used
  when issuing the `kubectl apply` operation with the `--prune` switch.

- `remoteNodeNetworks`: [RemoteNodeNetwork](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.RemoteNodeNetwork.html)[] = none — IPv4 CIDR blocks defining the expected address range of hybrid nodes that will join the cluster.

- `remotePodNetworks`: [RemotePodNetwork](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.RemotePodNetwork.html)[] = none — IPv4 CIDR blocks for Pods running Kubernetes webhooks on hybrid nodes.

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) — The removal policy applied to all CloudFormation resources created by this construct when they are no longer managed by CloudFormation.

  **Default:** Resources will be deleted.

  This can happen in one of three situations:
  - The resource is removed from the template, so CloudFormation stops managing it;
  - A change to the resource is made that requires it to be replaced, so CloudFormation stops managing it;
  - The stack is deleted, so CloudFormation stops managing all resources in it.

  This affects the EKS cluster itself, associated IAM roles, node groups, security groups, VPC
  and any other CloudFormation resources managed by this construct.

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — Role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.

  **Default:** A role is automatically created for you

- `secretsEncryptionKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — KMS secret for envelope encryption for Kubernetes secrets.

  **Default:** By default, Kubernetes stores all secret object data within etcd and all etcd volumes used by Amazon EKS are encrypted at the disk-level using AWS-Managed encryption keys.

- `securityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — Security Group to use for Control Plane ENIs.

  **Default:** A security group is automatically created

- `serviceIpv4Cidr`: string — The CIDR block to assign Kubernetes service IP addresses from.

  **Default:** Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks

- `tags`: { [key: string]: string } = none — The tags assigned to the EKS cluster.

- `version`: [KubernetesVersion](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.KubernetesVersion.html) (required) — The Kubernetes version to run in the cluster.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) — The VPC in which to create the Cluster.

  **Default:** a VPC with default configuration will be created and can be accessed through `cluster.vpc`.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html)[] — Where to place EKS Control Plane ENIs.

  **Default:** All public and private subnets

  For example, to only select private subnets, supply the following:

  `vpcSubnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }]`

## Properties

- `albController`: [AlbController](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.AlbController.html) — The ALB Controller construct defined for this cluster.

  Will be undefined if `albController` wasn't configured.

- `clusterArn`: string — The AWS generated ARN for the Cluster resource.

  For example, `arn:aws:eks:us-west-2:666666666666:cluster/prod`

- `clusterCertificateAuthorityData`: string — The certificate-authority-data for your cluster.

- `clusterEncryptionConfigKeyArn`: string — Amazon Resource Name (ARN) or alias of the customer master key (CMK).

- `clusterEndpoint`: string — The endpoint URL for the Cluster.

  This is the URL inside the kubeconfig file to use with kubectl

  For example, `https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com`

- `clusterName`: string — The Name of the created EKS Cluster.

- `clusterOpenIdConnectIssuerUrl`: string — If this cluster is kubectl-enabled, returns the OpenID Connect issuer url.

  If this cluster is not kubectl-enabled (i.e. uses the
  stock `CfnCluster`), this is `undefined`.

- `clusterRef`: [ClusterReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_eks.ClusterReference.html) — A reference to a Cluster resource.

- `clusterSecurityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — The cluster security group that was created by Amazon EKS for the cluster.

- `clusterSecurityGroupId`: string — The id of the cluster security group that was created by Amazon EKS for the cluster.

- `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) — Manages connection rules (Security Group Rules) for the cluster.

- `defaultCapacity`: [AutoScalingGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_autoscaling.AutoScalingGroup.html) — The auto scaling group that hosts the default capacity for this cluster.

  This will be `undefined` if the `defaultCapacityType` is not `EC2` or
  `defaultCapacityType` is `EC2` but default capacity is set to 0.

- `defaultNodegroup`: [Nodegroup](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.Nodegroup.html) — The node group that hosts the default capacity for this cluster.

  This will be `undefined` if the `defaultCapacityType` is `EC2` or
  `defaultCapacityType` is `NODEGROUP` but default capacity is set to 0.

- `defaultProfile`: [FargateProfile](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.FargateProfile.html) — Fargate Profile that was created with the cluster.

- `eksPodIdentityAgent`: [IAddon](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.IAddon.html) — Retrieves the EKS Pod Identity Agent addon for the EKS cluster.

  The EKS Pod Identity Agent is responsible for managing the temporary credentials
  used by pods in the cluster to access AWS resources. It runs as a DaemonSet on
  each node and provides the necessary credentials to the pods based on their
  associated service account.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `ipFamily`: [IpFamily](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.IpFamily.html) = IpFamily.IP_V4 — Specify which IP family is used to assign Kubernetes pod and service IP addresses.

- `kubectlProvider`: [IKubectlProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.IKubectlProvider.html) — KubectlProvider for issuing kubectl commands.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `openIdConnectProvider`: [IOpenIdConnectProvider](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IOpenIdConnectProvider.html) — An `OpenIdConnectProvider` resource associated with this cluster, and which can be used to link this cluster to AWS IAM.

  A provider will only be defined if this property is accessed (lazy initialization).

- `PROPERTY_INJECTION_ID`: string (static) — Uniquely identifies this class.

- `prune`: boolean — Determines if Kubernetes resources can be pruned automatically.

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — IAM role assumed by the EKS Control Plane.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this resource is defined.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) — The VPC in which this Cluster was created.

## Methods

- `addAutoScalingGroupCapacity(id: string, options: AutoScalingGroupCapacityOptions): AutoScalingGroup` — Add nodes to this EKS cluster.

  The nodes will automatically be configured with the right VPC and AMI
  for the instance type and Kubernetes version.

  Note that if you specify `updateType: RollingUpdate` or `updateType: ReplacingUpdate`, your nodes might be replaced at deploy
  time without notice in case the recommended AMI for your machine image type has been updated by AWS.
  The default behavior for `updateType` is `None`, which means only new instances will be launched using the new AMI.

- `addCdk8sChart(id: string, chart: Construct, options?: KubernetesManifestOptions): KubernetesManifest` — Defines a CDK8s chart in this cluster.

  **Parameters**

  - `id` — logical id of this chart.
  - `chart` — the cdk8s chart.

  **Returns:** a `KubernetesManifest` construct representing the chart.

- `addFargateProfile(id: string, options: FargateProfileOptions): FargateProfile` — Adds a Fargate profile to this cluster.

  **Parameters**

  - `id` — the id of this profile.
  - `options` — profile options.

- `addHelmChart(id: string, options: HelmChartOptions): HelmChart` — Defines a Helm chart in this cluster.

  **Parameters**

  - `id` — logical id of this chart.
  - `options` — options of this chart.

  **Returns:** a `HelmChart` construct

- `addManifest(id: string, ...manifest: { [key: string]: any }[]): KubernetesManifest` — Defines a Kubernetes resource in this cluster.

  The manifest will be applied/deleted using kubectl as needed.

  **Parameters**

  - `id` — logical id of this manifest.
  - `manifest` — a list of Kubernetes resource specifications.

  **Returns:** a `KubernetesResource` object.

- `addNodegroupCapacity(id: string, options?: NodegroupOptions): Nodegroup` — Add managed nodegroup to this Amazon EKS cluster.

  This method will create a new managed nodegroup and add into the capacity.

  **Parameters**

  - `id` — The ID of the nodegroup.
  - `options` — options for creating a new nodegroup.

- `addServiceAccount(id: string, options?: ServiceAccountOptions): ServiceAccount` — Creates a new service account with corresponding IAM Role (IRSA).

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `connectAutoScalingGroupCapacity(autoScalingGroup: AutoScalingGroup, options: AutoScalingGroupOptions): void` — Connect capacity in the form of an existing AutoScalingGroup to the EKS cluster.

  The AutoScalingGroup must be running an EKS-optimized AMI containing the
  /etc/eks/bootstrap.sh script. This method will configure Security Groups,
  add the right policies to the instance role, apply the right tags, and add
  the required user data to the instance's launch configuration.

  Prefer to use `addAutoScalingGroupCapacity` if possible.

  **Parameters**

  - `autoScalingGroup` — [disable-awslint:ref-via-interface].
  - `options` — options for adding auto scaling groups, like customizing the bootstrap script.

- `fromClusterAttributes(scope: Construct, id: string, attrs: ClusterAttributes): ICluster` (static) — Import an existing cluster.

  **Parameters**

  - `scope` — the construct scope, in most cases 'this'.
  - `id` — the id or name to import as.
  - `attrs` — the cluster properties to use for importing information.

- `getIngressLoadBalancerAddress(ingressName: string, options?: IngressLoadBalancerAddressOptions): string` — Fetch the load balancer address of an ingress backed by a load balancer.

  **Parameters**

  - `ingressName` — The name of the ingress.
  - `options` — Additional operation options.

- `getServiceLoadBalancerAddress(serviceName: string, options?: ServiceLoadBalancerAddressOptions): string` — Fetch the load balancer address of a service of type 'LoadBalancer'.

  **Parameters**

  - `serviceName` — The name of the service.
  - `options` — Additional operation options.

- `grantAccess(id: string, principal: string, accessPolicies: IAccessPolicy[], options?: GrantAccessOptions): void` — Grants the specified IAM principal access to the EKS cluster based on the provided access policies.

  This method creates an `AccessEntry` construct that grants the specified IAM principal the access permissions
  defined by the provided `IAccessPolicy` array. This allows the IAM principal to perform the actions permitted
  by the access policies within the EKS cluster.
  [disable-awslint:no-grants]

  **Parameters**

  - `id` — - The ID of the `AccessEntry` construct to be created.
  - `principal` — - The IAM principal (role or user) to be granted access to the EKS cluster.
  - `accessPolicies` — - An array of `IAccessPolicy` objects that define the access permissions to be granted to the IAM principal.
  - `options` — - Additional options for granting access.

- `grantClusterAdmin(id: string, principal: string): AccessEntry` — Grants the specified IAM principal cluster admin access to the EKS cluster.

  This method creates an `AccessEntry` construct that grants the specified IAM principal the cluster admin
  access permissions. This allows the IAM principal to perform the actions permitted
  by the cluster admin access.
  [disable-awslint:no-grants]

  **Parameters**

  - `id` — - The ID of the `AccessEntry` construct to be created.
  - `principal` — - The IAM principal (role or user) to be granted access to the EKS cluster.

  **Returns:** the access entry construct

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.