feat(eks): deprecate "kubectlEnabled: false"

packages/@aws-cdk/aws-eks/README.md

@@ -304,10 +304,6 @@ replicaset.apps/coredns-5cb4fb54c7   2         2         2       23m
 For your convenience, an AWS CloudFormation output will automatically be
 included in your template and will be printed when running `cdk deploy`.
 
-**NOTE**: if the cluster is configured with `kubectlEnabled: false`, it
-will be created with the role/user that created the AWS CloudFormation
-stack. See [Kubectl Support](#kubectl-support) for details.
-
 ### Kubernetes Resources
 
 The `KubernetesResource` construct or `cluster.addResource` method can be used
@@ -455,8 +451,6 @@ Furthermore, when auto-scaling capacity is added to the cluster (through
 of the auto-scaling group will be automatically mapped to RBAC so nodes can
 connect to the cluster. No manual mapping is required any longer.
 
-> NOTE: `cluster.awsAuth` will throw an error if your cluster is created with `kubectlEnabled: false`.
-
 For example, let's say you want to grant an IAM user administrative privileges
 on your cluster:
 
@@ -511,68 +505,6 @@ If you want to SSH into nodes in a private subnet, you should set up a
 bastion host in a public subnet. That setup is recommended, but is
 unfortunately beyond the scope of this documentation.
 
-### kubectl Support
-
-When you create an Amazon EKS cluster, the IAM entity user or role, such as a
-[federated user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html)
-that creates the cluster, is automatically granted `system:masters` permissions
-in the cluster's RBAC configuration.
-
-In order to allow programmatically defining **Kubernetes resources** in your AWS
-CDK app and provisioning them through AWS CloudFormation, we will need to assume
-this "masters" role every time we want to issue `kubectl` operations against your
-cluster.
-
-At the moment, the [AWS::EKS::Cluster](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-eks-cluster.html)
-AWS CloudFormation resource does not support this behavior, so in order to
-support "programmatic kubectl", such as applying manifests
-and mapping IAM roles from within your CDK application, the Amazon EKS
-construct library uses a custom resource for provisioning the cluster.
-This custom resource is executed with an IAM role that we can then use
-to issue `kubectl` commands.
-
-The default behavior of this library is to use this custom resource in order
-to retain programmatic control over the cluster. In other words: to allow
-you to define Kubernetes resources in your CDK code instead of having to
-manage your Kubernetes applications through a separate system.
-
-One of the implications of this design is that, by default, the user who
-provisioned the AWS CloudFormation stack (executed `cdk deploy`) will
-not have administrative privileges on the EKS cluster.
-
-1. Additional resources will be synthesized into your template (the AWS Lambda
-   function, the role and policy).
-2. As described in [Interacting with Your Cluster](#interacting-with-your-cluster),
-   if you wish to be able to manually interact with your cluster, you will need
-   to map an IAM role or user to the `system:masters` group. This can be either
-   done by specifying a `mastersRole` when the cluster is defined, calling
-   `cluster.awsAuth.addMastersRole` or explicitly mapping an IAM role or IAM user to the
-   relevant Kubernetes RBAC groups using `cluster.addRoleMapping` and/or
-   `cluster.addUserMapping`.
-
-If you wish to disable the programmatic kubectl behavior and use the standard
-AWS::EKS::Cluster resource, you can specify `kubectlEnabled: false` when you define
-the cluster:
-
-```ts
-new eks.Cluster(this, 'cluster', {
-  kubectlEnabled: false
-});
-```
-
-**Take care**: a change in this property will cause the cluster to be destroyed
-and a new cluster to be created.
-
-When kubectl is disabled, you should be aware of the following:
-
-1. When you log-in to your cluster, you don't need to specify `--role-arn` as
-   long as you are using the same user that created the cluster.
-2. As described in the Amazon EKS User Guide, you will need to manually
-   edit the [aws-auth ConfigMap](https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html)
-   when you add capacity in order to map the IAM instance role to RBAC to allow nodes to join the cluster.
-3. Any `eks.Cluster` APIs that depend on programmatic kubectl support will fail
-   with an error: `cluster.addResource`, `cluster.addChart`, `cluster.awsAuth`, `props.mastersRole`.
-
 ### Helm Charts
 
 The `HelmChart` construct or `cluster.addChart` method can be used