feat(eks): support AccessConfig for the Cluster construct

packages/aws-cdk-lib/aws-eks/lib/cluster-resource.ts

@@ -26,6 +26,7 @@ export interface ClusterResourceProps {
   readonly clusterHandlerSecurityGroup?: ec2.ISecurityGroup;
   readonly tags?: { [key: string]: string };
   readonly logging?: { [key: string]: [ { [key: string]: any } ] };
+  readonly accessconfig?: CfnCluster.AccessConfigProperty;
 }
 
 /**
@@ -88,6 +89,7 @@ export class ClusterResource extends Construct {
           },
           tags: props.tags,
           logging: props.logging,
+          accessConfig: props.accessconfig,
         },
         AssumeRoleArn: this.adminRole.roleArn,
 
@@ -96,7 +98,7 @@ export class ClusterResource extends Construct {
         // doesn't contain XXX key in object" (see #8276) by incrementing this
         // number, you will effectively cause a "no-op update" to the cluster
         // which will return the new set of attribute.
-        AttributesRevision: 2,
+        AttributesRevision: 3,
       },
     });
 

packages/aws-cdk-lib/aws-eks/lib/cluster.ts

@@ -809,6 +809,20 @@ export interface ClusterProps extends ClusterOptions {
    */
   readonly kubectlLambdaRole?: iam.IRole;
 
+  /**
+   * The desired authentication mode for the cluster.
+   * @default AuthenticationMode.CONFIG_MAP;
+   */
+  readonly authenticationMode?: AuthenticationMode;
+
+  /**
+   * Whether or not the cluster creator IAM principal was set as a cluster admin access entry
+   * during cluster creation time.
+   *
+   * @default true
+   */
+  readonly bootstrapClusterCreatorAdminPermissions?: boolean;
+
   /**
    * The tags assigned to the EKS cluster
    *
@@ -996,6 +1010,15 @@ export enum IpFamily {
   IP_V6 = 'ipv6',
 }
 
+/**
+ * Authentication mode of the clsuter.
+ */
+export enum AuthenticationMode {
+  CONFIG_MAP = 'CONFIG_MAP',
+  API_AND_CONFIG_MAP = 'API_AND_CONFIG_MAP',
+  API = 'API',
+}
+
 abstract class ClusterBase extends Resource implements ICluster {
   public abstract readonly connections: ec2.Connections;
   public abstract readonly vpc: ec2.IVpc;
@@ -1580,6 +1603,10 @@ export class Cluster extends ClusterBase {
       environment: props.clusterHandlerEnvironment,
       roleArn: this.role.roleArn,
       version: props.version.version,
+      accessconfig: {
+        authenticationMode: props.authenticationMode,
+        bootstrapClusterCreatorAdminPermissions: props.bootstrapClusterCreatorAdminPermissions,
+      },
       resourcesVpcConfig: {
         securityGroupIds: [securityGroup.securityGroupId],
         subnetIds,