pulumi · flostadler · Dec 16, 2024 · Dec 6, 2024 · Dec 6, 2024 · Dec 6, 2024
diff --git a/.github/workflows/eks-cron.yml b/.github/workflows/eks-cron.yml
@@ -23,7 +23,7 @@ env:
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
   GOVERSION: "1.21.x"
   DOTNETVERSION: "6.x"
-  PYTHONVERSION: "3.8"
+  PYTHONVERSION: "3.12"
   JAVAVERSION: "11"
 jobs:
   lint:

diff --git a/.github/workflows/eks-record.yml b/.github/workflows/eks-record.yml
@@ -35,7 +35,7 @@ env:
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
   GOVERSION: "1.21.x"
   DOTNETVERSION: "6.x"
-  PYTHONVERSION: "3.8"
+  PYTHONVERSION: "3.12"
   JAVAVERSION: "11"
 
 jobs:

diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
@@ -23,7 +23,7 @@ env:
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
   GOVERSION: "1.21.x"
   DOTNETVERSION: "6.x"
-  PYTHONVERSION: "3.8"
+  PYTHONVERSION: "3.12"
   JAVAVERSION: "11"
 jobs:
   lint:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ env:
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
   GOVERSION: "1.21.x"
   DOTNETVERSION: "6.x"
-  PYTHONVERSION: "3.8"
+  PYTHONVERSION: "3.12"
   JAVAVERSION: "11"
 jobs:
   lint:

diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
@@ -27,7 +27,7 @@ env:
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
   GOVERSION: "1.21.x"
   DOTNETVERSION: "6.x"
-  PYTHONVERSION: "3.8"
+  PYTHONVERSION: "3.12"
   JAVAVERSION: "11"
 jobs:
   comment-notification:

diff --git a/examples/eks-auto-mode/Pulumi.yaml b/examples/eks-auto-mode/Pulumi.yaml
@@ -0,0 +1,3 @@
+name: eks-auto-mode
+description: EKS Cluster in auto mode
+runtime: nodejs
diff --git a/examples/eks-auto-mode/README.md b/examples/eks-auto-mode/README.md
@@ -0,0 +1,5 @@
+# EKS Auto Mode
+
+EKS Auto Mode fully automates compute, storage, and networking management for Kubernetes clusters.
+In this example we use it to deploy a webserver (nginx) and expose it via a load balancer.
+EKS Auto mode manages all necessary infrastructure for this.
diff --git a/examples/eks-auto-mode/index.ts b/examples/eks-auto-mode/index.ts
@@ -0,0 +1,131 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as awsx from "@pulumi/awsx";
+import * as eks from "@pulumi/eks";
+import * as k8s from "@pulumi/kubernetes";
+import { SubnetType } from "@pulumi/awsx/ec2";
+
+const config = new pulumi.Config();
+const clusterName = config.require("clusterName");
+
+const eksVpc = new awsx.ec2.Vpc("eks-auto-mode", {
+    enableDnsHostnames: true,
+    cidrBlock: "10.0.0.0/16",
+    subnetSpecs: [
+        // Necessary tags for EKS Auto Mode to identify the subnets for the load balancers.
+        // See: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.1/deploy/subnet_discovery/
+        {type: SubnetType.Public, tags: {[`kubernetes.io/cluster/${clusterName}`]: "shared", "kubernetes.io/role/elb": "1"}},
+        {type: SubnetType.Private, tags: {[`kubernetes.io/cluster/${clusterName}`]: "shared", "kubernetes.io/role/internal-elb": "1"}},
+    ],
+    subnetStrategy: "Auto"
+});
+
+const cluster = new eks.Cluster("eks-auto-mode", {
+    name: clusterName,
+    // EKS Auto Mode requires Access Entries, use either the `Api` or `ApiAndConfigMap` authentication mode.
+    authenticationMode: eks.AuthenticationMode.Api,
+    vpcId: eksVpc.vpcId,
+    publicSubnetIds: eksVpc.publicSubnetIds,
+    privateSubnetIds: eksVpc.privateSubnetIds,
+
+    // Enables compute, storage and load balancing for the cluster.
+    autoMode: {
+        enabled: true,
+    }
+});
+
+const appName = "nginx";
+const ns = new k8s.core.v1.Namespace(appName, {
+    metadata: { name: appName },
+}, { provider: cluster.provider });
+
+const configMap = new k8s.core.v1.ConfigMap(appName, {
+    metadata: {
+        namespace: ns.metadata.name,
+    },
+    data: {
+        "index.html": "<html><body><h1>Hello, Pulumi!</h1></body></html>",
+    },
+}, { provider: cluster.provider });
+
+const deployment = new k8s.apps.v1.Deployment(appName, {
+    metadata: {
+        namespace: ns.metadata.name
+    },
+    spec: {
+        selector: { matchLabels: { app: appName } },
+        replicas: 3,
+        template: {
+            metadata: { labels: { app: appName } },
+            spec: {
+                containers: [{
+                    name: appName,
+                    image: appName,
+                    ports: [{ containerPort: 80 }],
+                    volumeMounts: [{ name: "nginx-index", mountPath: "/usr/share/nginx/html" }],
+                }],
+                volumes: [{
+                    name: "nginx-index",
+                    configMap: { name: configMap.metadata.name },
+                }],
+            },
+        },
+    },
+}, { provider: cluster.provider });
+
+const service = new k8s.core.v1.Service(appName, {
+    metadata: {
+        name: appName,
+        namespace: ns.metadata.name
+    },
+    spec: {
+        selector: { app: appName },
+        ports: [{ port: 80, targetPort: 80 }],
+    },
+}, { provider: cluster.provider, dependsOn: [deployment] });
+
+const ingressClass = new k8s.networking.v1.IngressClass("alb", {
+    metadata: {
+        namespace: ns.metadata.name,
+        labels: {
+            "app.kubernetes.io/name": "LoadBalancerController",
+        },
+        name: "alb",
+    },
+    spec: {
+        controller: "eks.amazonaws.com/alb",
+    }
+}, { provider: cluster.provider });
+
+const ingress = new k8s.networking.v1.Ingress(appName, {
+    metadata: {
+        namespace: ns.metadata.name,
+        // Annotations for EKS Auto Mode to identify the Ingress as internet-facing and target-type as IP.
+        annotations: {
+            "alb.ingress.kubernetes.io/scheme": "internet-facing",
+            "alb.ingress.kubernetes.io/target-type": "ip",
+        }
+    },
+    spec: {
+        ingressClassName: ingressClass.metadata.name,
+        rules: [{
+            http: {
+                paths: [{
+                    path: "/",
+                    pathType: "Prefix",
+                    backend: {
+                        service: {
+                            name: service.metadata.name,
+                            port: {
+                                number: 80,
+                            },
+                        },
+                    },
+                }],
+            },
+        }],
+    }
+}, { provider: cluster.provider });
+
+export const defaultNodeGroup = cluster.defaultNodeGroupAsgName;
+export const nodeRoleName = cluster.autoModeNodeRoleName;
+export const url = ingress.status.loadBalancer.ingress[0].hostname.apply(h => `http://${h}:80`);
diff --git a/examples/eks-auto-mode/package.json b/examples/eks-auto-mode/package.json
@@ -0,0 +1,13 @@
+{
+    "name": "eks-auto-mode",
+    "devDependencies": {
+        "typescript": "^4.0.0",
+        "@types/node": "latest"
+    },
+    "dependencies": {
+        "@pulumi/pulumi": "^3.0.0",
+        "@pulumi/kubernetes": "^4.18.3",
+        "@pulumi/awsx": "^2.0.2",
+        "@pulumi/eks": "latest"
+    }
+}
diff --git a/examples/eks-auto-mode/tsconfig.json b/examples/eks-auto-mode/tsconfig.json
@@ -0,0 +1,24 @@
+{
+    "compilerOptions": {
+        "outDir": "bin",
+        "target": "es6",
+        "lib": [
+            "es6"
+        ],
+        "module": "commonjs",
+        "moduleResolution": "node",
+        "declaration": true,
+        "sourceMap": true,
+        "stripInternal": true,
+        "experimentalDecorators": true,
+        "pretty": true,
+        "noFallthroughCasesInSwitch": true,
+        "noImplicitAny": true,
+        "noImplicitReturns": true,
+        "forceConsistentCasingInFileNames": true,
+        "strictNullChecks": true
+    },
+    "files": [
+        "index.ts"
+    ]
+}
diff --git a/go.mod b/go.mod
@@ -13,9 +13,10 @@ require (
 	github.com/pulumi/providertest v0.0.15
 	github.com/pulumi/pulumi-aws/sdk/v6 v6.41.0
 	github.com/pulumi/pulumi-eks/sdk/v3 v3.0.0-alpha.6
-	github.com/pulumi/pulumi/pkg/v3 v3.138.0
-	github.com/pulumi/pulumi/sdk/v3 v3.138.0
+	github.com/pulumi/pulumi/pkg/v3 v3.143.0
+	github.com/pulumi/pulumi/sdk/v3 v3.143.0
 	github.com/stretchr/testify v1.9.0
+	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8
 	golang.org/x/mod v0.20.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.29.3
@@ -183,14 +184,13 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	gocloud.dev v0.37.0 // indirect
 	gocloud.dev/secrets/hashivault v0.37.0 // indirect
-	golang.org/x/crypto v0.26.0 // indirect
-	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect
+	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/net v0.28.0 // indirect
 	golang.org/x/oauth2 v0.22.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.24.0 // indirect
-	golang.org/x/term v0.23.0 // indirect
-	golang.org/x/text v0.17.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.22.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect

diff --git a/go.sum b/go.sum
@@ -391,10 +391,10 @@ github.com/pulumi/pulumi-aws/sdk/v6 v6.41.0 h1:Mjp2495ZjQBKnZAAcgHfdaHvsJDMPwbFZ
 github.com/pulumi/pulumi-aws/sdk/v6 v6.41.0/go.mod h1:cV2EBfrvaS/YUKr9L0ua93vrSuAihpkhokzyYjj6NkQ=
 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.9.1 h1:dgazi5bI3Vxz+aLuH+DxRqKxPWGaFIkT3fIepHr7h0g=
 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.9.1/go.mod h1:O8hanLXCEXiyzA8gIeME5o/SmJ39Vyy9wLcBYCFpOp0=
-github.com/pulumi/pulumi/pkg/v3 v3.138.0 h1:a+MMvCrvsju4YFVYEwPBtcW7XqsEIV3B+FMblisxEkM=
-github.com/pulumi/pulumi/pkg/v3 v3.138.0/go.mod h1:xpaeNeKmM2KLafWwm8TlvJGbWtwEwlrK88U6FvXucpY=
-github.com/pulumi/pulumi/sdk/v3 v3.138.0 h1:1feN0YU1dHnbNw+cHaenmx3AgU0DEiKQbvjxaGQuShk=
-github.com/pulumi/pulumi/sdk/v3 v3.138.0/go.mod h1:PvKsX88co8XuwuPdzolMvew5lZV+4JmZfkeSjj7A6dI=
+github.com/pulumi/pulumi/pkg/v3 v3.143.0 h1:diAlaNVZSRc59ePqbMuvuf/AwecpZyjhh1pGvmLEUwg=
+github.com/pulumi/pulumi/pkg/v3 v3.143.0/go.mod h1:XzjN1uQI2HWXYolT2L4RIXzvLEnWTSOzFgFFIUfFEa8=
+github.com/pulumi/pulumi/sdk/v3 v3.143.0 h1:z1m8Fc6l723eU2J/bP7UHE5t6WbBu4iIDAl1WaalQk4=
+github.com/pulumi/pulumi/sdk/v3 v3.143.0/go.mod h1:OFpZabILGxrFqzcABFpMCksrHGVp4ymRM2BkKjlazDY=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -501,8 +501,8 @@ golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 h1:LoYXNGAShUG3m/ehNk4iFctuhGX/+R1ZpfJ4/ia80JM=
 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
@@ -552,8 +552,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -581,8 +581,8 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
-golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -592,8 +592,8 @@ golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -604,8 +604,8 @@ golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

diff --git a/nodejs/eks/cluster.test.ts b/nodejs/eks/cluster.test.ts
@@ -0,0 +1,64 @@
+// Copyright 2016-2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import * as aws from "@pulumi/aws";
+import { ClusterOptions, createCore } from "./cluster";
+
+describe("createCore", () => {
+    const name = "test-cluster";
+
+    it("should throw an error if both instanceRole and instanceRoles are set", () => {
+        const rawArgs = {
+            instanceRole: new aws.iam.Role("test-role", { assumeRolePolicy: "{}" }),
+            instanceRoles: [new aws.iam.Role("test-role-1", { assumeRolePolicy: "{}" })],
+        };
+
+        expect(() => createCore(name, rawArgs, undefined as any)).toThrow(
+            "instanceRole and instanceRoles are mutually exclusive, and cannot both be set.",
+        );
+    });
+
+    it("should throw an error if both subnetIds and publicSubnetIds/privateSubnetIds are set", () => {
+        const rawArgs = {
+            subnetIds: ["subnet-123"],
+            publicSubnetIds: ["subnet-456"],
+        };
+
+        expect(() => createCore(name, rawArgs, undefined as any)).toThrow(
+            "subnetIds, and the use of publicSubnetIds and/or privateSubnetIds are mutually exclusive. Choose a single approach.",
+        );
+    });
+
+    it("should throw an error if both nodeGroupOptions and singular node group options are set", () => {
+        const rawArgs = {
+            nodeGroupOptions: {},
+            nodeSubnetIds: ["subnet-123"],
+        };
+
+        expect(() => createCore(name, rawArgs, undefined as any)).toThrow(
+            "Setting nodeGroupOptions, and any set of singular node group option(s) on the cluster, is mutually exclusive. Choose a single approach.",
+        );
+    });
+
+    it("should throw an error if autoMode is enabled and authentication mode does not support access entries", () => {
+        const rawArgs = {
+            autoMode: { enabled: true },
+            authenticationMode: "CONFIG_MAP",
+        } satisfies ClusterOptions;
+
+        expect(() => createCore(name, rawArgs, undefined as any)).toThrow(
+            "Access entries are required when using EKS Auto Mode. Use the authentication mode 'API' or 'API_AND_CONFIG_MAP'.",
+        );
+    });
+});