konokenj.cdk-api-mcp-server 0.48.0__py3-none-any.whl → 0.57.0__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-eks/README.md

@@ -69,12 +69,12 @@ This example defines an Amazon EKS cluster with the following configuration:
 * A Kubernetes pod with a container based on the [paulbouwer/hello-kubernetes](https://github.com/paulbouwer/hello-kubernetes) image.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 // provisioning a cluster
 const cluster = new eks.Cluster(this, 'hello-eks', {
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 
 // apply a kubernetes manifest to the cluster
@@ -139,22 +139,42 @@ A more detailed breakdown of each is provided further down this README.
 Creating a new cluster is done using the `Cluster` or `FargateCluster` constructs. The only required properties are the kubernetes `version` and `kubectlLayer`.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
+});
+```
+
+You can control what happens to the resources created by the cluster construct when they are no longer managed by CloudFormation by specifying a `removalPolicy`.
+
+This can happen in one of three situations:
+- The resource is removed from the template, so CloudFormation stops managing it;
+- A change to the resource is made that requires it to be replaced, so CloudFormation stops managing it;
+- The stack is deleted, so CloudFormation stops managing all resources in it.
+
+This affects the EKS cluster itself, the custom resource that created the cluster, associated IAM roles, node groups, security groups, VPC and any other CloudFormation resources managed by this construct.
+
+```ts
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
+import * as core from 'aws-cdk-lib/core';
+
+new eks.Cluster(this, 'HelloEKS', {
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
+  removalPolicy: core.RemovalPolicy.RETAIN, // Keep all resources created by the construct.
 });
 ```
 
 You can also use `FargateCluster` to provision a cluster that uses only fargate workers.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.FargateCluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -177,13 +197,13 @@ By default, this library will allocate a managed node group with 2 *m5.large* in
 At cluster instantiation time, you can customize the number of instances and their type:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   defaultCapacity: 5,
   defaultCapacityInstance: ec2.InstanceType.of(ec2.InstanceClass.M5, ec2.InstanceSize.SMALL),
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -192,12 +212,12 @@ To access the node group that was created on your behalf, you can use `cluster.d
 Additional customizations are available post instantiation. To apply them, set the default capacity to 0, and use the `cluster.addNodegroupCapacity` method:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   defaultCapacity: 0,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 
 cluster.addNodegroupCapacity('custom-node-group', {
@@ -273,7 +293,7 @@ Node groups are available with IPv6 configured networks.  For custom roles assig
 > For more details visit [Configuring the Amazon VPC CNI plugin for Kubernetes to use IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-role)
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const ipv6Management = new iam.PolicyDocument({
     statements: [new iam.PolicyStatement({
@@ -299,9 +319,9 @@ const eksClusterNodeGroupRole = new iam.Role(this, 'eksClusterNodeGroupRole', {
 });
 
 const cluster = new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   defaultCapacity: 0,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 
 cluster.addNodegroupCapacity('custom-node-group', {
@@ -413,12 +433,12 @@ has been changed. As a workaround, you need to add a temporary policy to the clu
 successful replacement. Consider this example if you are renaming the cluster from `foo` to `bar`:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.Cluster(this, 'cluster-to-rename', {
   clusterName: 'foo', // rename this to 'bar'
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
-  version: eks.KubernetesVersion.V1_33,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
 });
 
 // allow the cluster admin role to delete the cluster 'foo'
@@ -471,11 +491,11 @@ To create an EKS cluster that **only** uses Fargate capacity, you can use `Farga
 The following code defines an Amazon EKS cluster with a default Fargate Profile that matches all pods from the "kube-system" and "default" namespaces. It is also configured to [run CoreDNS on Fargate](https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html#fargate-gs-coredns).
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.FargateCluster(this, 'MyCluster', {
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -551,12 +571,12 @@ To disable bootstrapping altogether (i.e. to fully customize user-data), set `bo
 You can also configure the cluster to use an auto-scaling group as the default capacity:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   defaultCapacityType: eks.DefaultCapacityType.EC2,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -658,12 +678,12 @@ AWS Identity and Access Management (IAM) and native Kubernetes [Role Based Acces
 You can configure the [cluster endpoint access](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html) by using the `endpointAccess` property:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.Cluster(this, 'hello-eks', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   endpointAccess: eks.EndpointAccess.PRIVATE, // No access outside of your VPC.
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -683,31 +703,31 @@ From the docs:
 To deploy the controller on your EKS cluster, configure the `albController` property:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   albController: {
     version: eks.AlbControllerVersion.V2_8_2,
   },
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
 To provide additional Helm chart values supported by `albController` in CDK, use the `additionalHelmChartValues` property. For example, the following code snippet shows how to set the `enableWafV2` flag:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   albController: {
     version: eks.AlbControllerVersion.V2_8_2,
     additionalHelmChartValues: {
       enableWafv2: false
     }
   },
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -744,15 +764,15 @@ if (cluster.albController) {
 You can specify the VPC of the cluster using the `vpc` and `vpcSubnets` properties:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 declare const vpc: ec2.Vpc;
 
 new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   vpc,
   vpcSubnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }],
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -795,11 +815,11 @@ The `ClusterHandler` is a set of Lambda functions (`onEventHandler`, `isComplete
 You can configure the environment of the Cluster Handler functions by specifying it at cluster instantiation. For example, this can be useful in order to configure an http proxy:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 declare const proxyInstanceSecurityGroup: ec2.SecurityGroup;
 const cluster = new eks.Cluster(this, 'hello-eks', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   clusterHandlerEnvironment: {
     https_proxy: 'http://proxy.myproxy.com',
   },
@@ -808,7 +828,7 @@ const cluster = new eks.Cluster(this, 'hello-eks', {
    * Cluster Handler Lambdas so that it can reach the proxy.
    */
   clusterHandlerSecurityGroup: proxyInstanceSecurityGroup,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -817,7 +837,7 @@ const cluster = new eks.Cluster(this, 'hello-eks', {
 You can optionally choose to configure your cluster to use IPv6 using the [`ipFamily`](https://docs.aws.amazon.com/eks/latest/APIReference/API_KubernetesNetworkConfigRequest.html#AmazonEKS-Type-KubernetesNetworkConfigRequest-ipFamily) definition for your cluster.  Note that this will require the underlying subnets to have an associated IPv6 CIDR.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 declare const vpc: ec2.Vpc;
 
 function associateSubnetWithV6Cidr(vpc: ec2.Vpc, count: number, subnet: ec2.ISubnet) {
@@ -843,11 +863,11 @@ for (let subnet of subnets) {
 }
 
 const cluster = new eks.Cluster(this, 'hello-eks', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   vpc: vpc,
   ipFamily: eks.IpFamily.IP_V6,
   vpcSubnets: [{ subnets: vpc.publicSubnets }],
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -878,14 +898,14 @@ const cluster = eks.Cluster.fromClusterAttributes(this, 'Cluster', {
 You can configure the environment of this function by specifying it at cluster instantiation. For example, this can be useful in order to configure an http proxy:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.Cluster(this, 'hello-eks', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   kubectlEnvironment: {
     'http_proxy': 'http://proxy.myproxy.com',
   },
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -902,11 +922,11 @@ Depending on which version of kubernetes you're targeting, you will need to use
 the `@aws-cdk/lambda-layer-kubectl-vXY` packages.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.Cluster(this, 'hello-eks', {
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -941,7 +961,7 @@ const cluster1 = new eks.Cluster(this, 'MyCluster', {
   kubectlLayer: layer,
   vpc,
   clusterName: 'cluster-name',
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
 });
 
 // or
@@ -957,12 +977,12 @@ const cluster2 = eks.Cluster.fromClusterAttributes(this, 'MyCluster', {
 By default, the kubectl provider is configured with 1024MiB of memory. You can use the `kubectlMemory` option to specify the memory size for the AWS Lambda function:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.Cluster(this, 'MyCluster', {
   kubectlMemory: Size.gibibytes(4),
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 
 // or
@@ -999,13 +1019,13 @@ cluster.addAutoScalingGroupCapacity('self-ng-arm', {
 When you create a cluster, you can specify a `mastersRole`. The `Cluster` construct will associate this role with the `system:masters` [RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) group, giving it super-user access to the cluster.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 declare const role: iam.Role;
 new eks.Cluster(this, 'HelloEKS', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   mastersRole: role,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -1051,26 +1071,26 @@ You can use the `secretsEncryptionKey` to configure which key the cluster will u
 > This setting can only be specified when the cluster is created and cannot be updated.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const secretsKey = new kms.Key(this, 'SecretsKey');
 const cluster = new eks.Cluster(this, 'MyCluster', {
   secretsEncryptionKey: secretsKey,
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
 You can also use a similar configuration for running a cluster built using the FargateCluster construct.
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const secretsKey = new kms.Key(this, 'SecretsKey');
 const cluster = new eks.FargateCluster(this, 'MyFargateCluster', {
   secretsEncryptionKey: secretsKey,
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -1088,11 +1108,11 @@ When you create an Amazon EKS cluster, you can configure it to leverage the [EKS
 Once you have identified the on-premises node and pod (optional) CIDRs you will use for your hybrid nodes and the workloads running on them, you can specify them during cluster creation using the `remoteNodeNetworks` and `remotePodNetworks` (optional) properties:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.Cluster(this, 'Cluster', {
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'KubectlLayer'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'KubectlLayer'),
   remoteNodeNetworks: [
     {
       cidrs: ['10.0.0.0/16'],
@@ -1145,7 +1165,7 @@ To access the Kubernetes resources from the console, make sure your viewing prin
 in the `aws-auth` ConfigMap. Some options to consider:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 declare const cluster: eks.Cluster;
 declare const your_current_role: iam.Role;
 declare const vpc: ec2.Vpc;
@@ -1165,7 +1185,7 @@ your_current_role.addToPolicy(new iam.PolicyStatement({
 
 ```ts
 // Option 2: create your custom mastersRole with scoped assumeBy arn as the Cluster prop. Switch to this role from the AWS console.
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 declare const vpc: ec2.Vpc;
 
 
@@ -1175,8 +1195,8 @@ const mastersRole = new iam.Role(this, 'MastersRole', {
 
 const cluster = new eks.Cluster(this, 'EksCluster', {
   vpc,
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'KubectlLayer'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'KubectlLayer'),
   mastersRole,
 });
 
@@ -1220,13 +1240,13 @@ AWS IAM principals from both Amazon EKS access entry APIs and the aws-auth confi
 To specify the `authenticationMode`:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 declare const vpc: ec2.Vpc;
 
 new eks.Cluster(this, 'Cluster', {
   vpc,
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'KubectlLayer'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'KubectlLayer'),
   authenticationMode: eks.AuthenticationMode.API_AND_CONFIG_MAP,
 });
 ```
@@ -1271,7 +1291,7 @@ eks.AccessPolicy.fromAccessPolicyName('AmazonEKSAdminPolicy', {
 Use `grantAccess()` to grant the AccessPolicy to an IAM principal:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 declare const vpc: ec2.Vpc;
 
 const clusterAdminRole = new iam.Role(this, 'ClusterAdminRole', {
@@ -1289,8 +1309,8 @@ const eksAdminViewRole = new iam.Role(this, 'EKSAdminViewRole', {
 const cluster = new eks.Cluster(this, 'Cluster', {
   vpc,
   mastersRole: clusterAdminRole,
-  version: eks.KubernetesVersion.V1_33,
-  kubectlLayer: new KubectlV33Layer(this, 'KubectlLayer'),
+  version: eks.KubernetesVersion.V1_34,
+  kubectlLayer: new KubectlV34Layer(this, 'KubectlLayer'),
   authenticationMode: eks.AuthenticationMode.API_AND_CONFIG_MAP,
 });
 
@@ -1622,12 +1642,12 @@ Pruning is enabled by default but can be disabled through the `prune` option
 when a cluster is defined:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 new eks.Cluster(this, 'MyCluster', {
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   prune: false,
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 
@@ -2030,17 +2050,17 @@ You can enable logging for each one separately using the `clusterLogging`
 property. For example:
 
 ```ts
-import { KubectlV33Layer } from '@aws-cdk/lambda-layer-kubectl-v33';
+import { KubectlV34Layer } from '@aws-cdk/lambda-layer-kubectl-v34';
 
 const cluster = new eks.Cluster(this, 'Cluster', {
   // ...
-  version: eks.KubernetesVersion.V1_33,
+  version: eks.KubernetesVersion.V1_34,
   clusterLogging: [
     eks.ClusterLoggingTypes.API,
     eks.ClusterLoggingTypes.AUTHENTICATOR,
     eks.ClusterLoggingTypes.SCHEDULER,
   ],
-  kubectlLayer: new KubectlV33Layer(this, 'kubectl'),
+  kubectlLayer: new KubectlV34Layer(this, 'kubectl'),
 });
 ```
 

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-eks/integ.eks-al2023-nodegroup.ts

@@ -27,7 +27,7 @@ class EksClusterStack extends Stack {
       vpc: this.vpc,
       mastersRole,
       defaultCapacity: 0,
-      ...getClusterVersionConfig(this, eks.KubernetesVersion.V1_33),
+      ...getClusterVersionConfig(this, eks.KubernetesVersion.V1_34),
     });
 
     // create nodegroup with AL2023_X86_64_STANDARD

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-eks/integ.eks-cluster-removal-policy.ts

@@ -0,0 +1,31 @@
+/// !cdk-integ pragma:disable-update-workflow
+import { App, RemovalPolicy, Stack, StackProps } from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { getClusterVersionConfig } from './integ-tests-kubernetes-version';
+import * as eks from 'aws-cdk-lib/aws-eks';
+
+/**
+ * This test just checks that all resources can be deployed with a removal policy.
+ * We use the DESTROY policy here to avoid leaving orphaned resources behind, but if it works for DESTROY, it should work for other values as well.
+ */
+class EksClusterRemovalPolicyStack extends Stack {
+  constructor(scope: App, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    new eks.Cluster(this, 'Cluster', {
+      ...getClusterVersionConfig(this, eks.KubernetesVersion.V1_32),
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+  }
+}
+
+const app = new App();
+
+const stack = new EksClusterRemovalPolicyStack(app, 'EksClusterRemovalPolicyStack');
+
+new integ.IntegTest(app, 'eks-cluster-removal-policy-integ', {
+  testCases: [stack],
+  diffAssets: false,
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-eks/integ.fargate-cluster.ts

@@ -17,7 +17,7 @@ class EksFargateClusterStack extends Stack {
     this.node.setContext(EC2_RESTRICT_DEFAULT_SECURITY_GROUP, false);
     this.vpc = props?.vpc ?? this.createDummyVpc();
     new eks.FargateCluster(this, 'FargateCluster', {
-      ...getClusterVersionConfig(this, eks.KubernetesVersion.V1_33),
+      ...getClusterVersionConfig(this, eks.KubernetesVersion.V1_34),
       prune: false,
       authenticationMode: props?.authMode,
       vpc: this.vpc,

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2/README.md

@@ -338,17 +338,13 @@ Balancers:
 ```ts
 declare const vpc: ec2.Vpc;
 declare const asg: autoscaling.AutoScalingGroup;
-declare const sg1: ec2.ISecurityGroup;
-declare const sg2: ec2.ISecurityGroup;
 
 // Create the load balancer in a VPC. 'internetFacing' is 'false'
 // by default, which creates an internal load balancer.
 const lb = new elbv2.NetworkLoadBalancer(this, 'LB', {
   vpc,
   internetFacing: true,
-  securityGroups: [sg1],
 });
-lb.addSecurityGroup(sg2);
 
 // Add a listener on a particular port.
 const listener = lb.addListener('Listener', {
@@ -362,6 +358,40 @@ listener.addTargets('AppFleet', {
 });
 ```
 
+### Security Groups for Network Load Balancer
+
+By default, Network Load Balancers (NLB) have a security group associated with them.
+This is controlled by the feature flag `@aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault`.
+When this flag is enabled (the default for new projects), a security group will be automatically created and attached to the NLB unless you explicitly provide your own security groups via the `securityGroups` property.
+
+If you wish to create an NLB without any security groups, you can set the `disableSecurityGroups` property to `true`. When this property is set, no security group will be associated with the NLB, regardless of the feature flag.
+
+```ts
+declare const vpc: ec2.IVpc;
+
+const nlb = new elbv2.NetworkLoadBalancer(this, 'LB', {
+  vpc,
+  // To disable security groups for this NLB
+  disableSecurityGroups: true,
+});
+```
+
+If you want to use your own security groups, provide them via the `securityGroups` property:
+
+```ts
+declare const vpc: ec2.IVpc;
+declare const sg1: ec2.ISecurityGroup;
+declare const sg2: ec2.ISecurityGroup;
+
+const nlb = new elbv2.NetworkLoadBalancer(this, 'LB', {
+  vpc,
+  // Provide your own security groups
+  securityGroups: [sg1],
+});
+// Add another security group to the NLB
+nlb.addSecurityGroup(sg2);
+```
+
 ### Enforce security group inbound rules on PrivateLink traffic for a Network Load Balancer
 
 You can indicate whether to evaluate inbound security group rules for traffic

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2/integ.alb-lambda-multi-value-headers.ts

@@ -19,7 +19,7 @@ const vpc = new ec2.Vpc(stack, 'VPC', {
 });
 
 const fn = new lambda.Function(stack, 'Function', {
-  runtime: lambda.Runtime.NODEJS_18_X,
+  runtime: lambda.Runtime.NODEJS_20_X,
   handler: 'index.handler',
   code: lambda.Code.fromInline(`
     exports.handler = async (event) => {

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-elasticloadbalancingv2/integ.alb.oidc.ts

@@ -186,7 +186,7 @@ const signinFunction = new lambda.Function(testCase, 'Signin', {
   functionName: 'cdk-integ-alb-oidc-signin-handler',
   code: lambda.Code.fromAsset('alb-oidc-signin-handler', { exclude: ['*.ts'] }),
   handler: 'index.handler',
-  runtime: lambda.Runtime.NODEJS_18_X,
+  runtime: lambda.Runtime.NODEJS_20_X,
   environment: {
     TEST_USERNAME: testUser.username,
     TEST_PASSWORD: testUser.password,