// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;

namespace Pulumi.Kops
{
    /// <summary>
    /// ## Import
    /// 
    /// You can import an existing cluster by creating a `kops_cluster` configuration
    /// 
    /// ```sh
    ///  $ pulumi import kops:index/cluster:Cluster and running the `terraform import` command
    /// ```
    /// 
    ///  1. Create a terraform configuration:
    /// 
    ///  hcl
    /// 
    ///  provider "kops" {
    /// 
    ///  state_store = "s3://cluster.example.com"
    /// 
    ///  }
    /// 
    ///  resource "kops_cluster" "cluster" {
    /// 
    ///  name
    /// 
    /// = "cluster.example.com"
    /// 
    ///  // ....
    /// 
    ///  }
    /// 
    /// ```sh
    ///  $ pulumi import kops:index/cluster:Cluster
    /// 
    /// Run `terraform import`
    /// ```
    /// 
    /// ```sh
    ///  $ pulumi import kops:index/cluster:Cluster kops_cluster.cluster cluster.example.com
    /// ```
    /// </summary>
    [KopsResourceType("kops:index/cluster:Cluster")]
    public partial class Cluster : global::Pulumi.CustomResource
    {
        /// <summary>
        /// - List(String) - AdditionalNetworkCIDRs is a list of additional CIDR used for the AWS VPC&lt;br /&gt;or otherwise allocated to k8s. This is a real CIDR, not the internal k8s network&lt;br /&gt;On AWS, it maps to any additional CIDRs added to a VPC.
        /// </summary>
        [Output("additionalNetworkCidrs")]
        public Output<ImmutableArray<string>> AdditionalNetworkCidrs { get; private set; } = null!;

        /// <summary>
        /// - Map(String) - Additional policies to add for roles.
        /// </summary>
        [Output("additionalPolicies")]
        public Output<ImmutableDictionary<string, string>?> AdditionalPolicies { get; private set; } = null!;

        /// <summary>
        /// - List(String) - AdditionalSANs adds additional Subject Alternate Names to apiserver cert that kops generates.
        /// </summary>
        [Output("additionalSans")]
        public Output<ImmutableArray<string>> AdditionalSans { get; private set; } = null!;

        /// <summary>
        /// - List(addon_spec) - Additional addons that should be installed on the cluster.
        /// </summary>
        [Output("addons")]
        public Output<ImmutableArray<Outputs.ClusterAddon>> Addons { get; private set; } = null!;

        /// <summary>
        /// - (Sensitive) - String - AdminSshKey defines the cluster admin ssh key.
        /// </summary>
        [Output("adminSshKey")]
        public Output<string?> AdminSshKey { get; private set; } = null!;

        /// <summary>
        /// - Map(String) - Annotations is an unstructured key value map stored with a resource that may be&lt;br /&gt;set by external tools to store and retrieve arbitrary metadata. They are not&lt;br /&gt;queryable and should be preserved when modifying objects.
        /// </summary>
        [Output("annotations")]
        public Output<ImmutableDictionary<string, string>?> Annotations { get; private set; } = null!;

        /// <summary>
        /// - access_spec - API field controls how the API is exposed outside the cluster.
        /// </summary>
        [Output("api")]
        public Output<Outputs.ClusterApi?> Api { get; private set; } = null!;

        /// <summary>
        /// - assets - Assets is alternative locations for files and containers; the API under construction, will remove this comment once this API is fully functional.
        /// </summary>
        [Output("assets")]
        public Output<Outputs.ClusterAssets?> Assets { get; private set; } = null!;

        /// <summary>
        /// - authentication_spec - Authentication field controls how the cluster is configured for authentication.
        /// </summary>
        [Output("authentication")]
        public Output<Outputs.ClusterAuthentication?> Authentication { get; private set; } = null!;

        /// <summary>
        /// - authorization_spec - Authorization field controls how the cluster is configured for authorization.
        /// </summary>
        [Output("authorization")]
        public Output<Outputs.ClusterAuthorization?> Authorization { get; private set; } = null!;

        /// <summary>
        /// - aws_load_balancer_controller_config - AWSLoadbalancerControllerConfig determines the AWS LB controller configuration.
        /// </summary>
        [Output("awsLoadBalancerController")]
        public Output<Outputs.ClusterAwsLoadBalancerController?> AwsLoadBalancerController { get; private set; } = null!;

        /// <summary>
        /// - cert_manager_config - CertManager determines the metrics server configuration.
        /// </summary>
        [Output("certManager")]
        public Output<Outputs.ClusterCertManager?> CertManager { get; private set; } = null!;

        /// <summary>
        /// - String - The Channel we are following.
        /// </summary>
        [Output("channel")]
        public Output<string?> Channel { get; private set; } = null!;

        /// <summary>
        /// - cloud_configuration
        /// </summary>
        [Output("cloudConfig")]
        public Output<Outputs.ClusterCloudConfig?> CloudConfig { get; private set; } = null!;

        /// <summary>
        /// - Map(String) - CloudLabels defines additional tags or labels on cloud provider resources.
        /// </summary>
        [Output("cloudLabels")]
        public Output<ImmutableDictionary<string, string>?> CloudLabels { get; private set; } = null!;

        /// <summary>
        /// - cloud_provider_spec - CloudProvider configures the cloud provider to use.
        /// </summary>
        [Output("cloudProvider")]
        public Output<Outputs.ClusterCloudProvider> CloudProvider { get; private set; } = null!;

        /// <summary>
        /// - cluster_autoscaler_config - ClusterAutoscaler defines the cluster autoscaler configuration.
        /// </summary>
        [Output("clusterAutoscaler")]
        public Output<Outputs.ClusterClusterAutoscaler?> ClusterAutoscaler { get; private set; } = null!;

        /// <summary>
        /// - String - ClusterDNSDomain is the suffix we use for internal DNS names (normally cluster.local).
        /// </summary>
        [Output("clusterDnsDomain")]
        public Output<string?> ClusterDnsDomain { get; private set; } = null!;

        /// <summary>
        /// - (Computed) - String - ConfigBase is the path where we store configuration for the cluster&lt;br /&gt;This might be different than the location where the cluster spec itself is stored,&lt;br /&gt;both because this must be accessible to the cluster,&lt;br /&gt;and because it might be on a different cloud or storage system (etcd vs S3).
        /// </summary>
        [Output("configBase")]
        public Output<string> ConfigBase { get; private set; } = null!;

        /// <summary>
        /// - String - ConfigStore is the VFS path to where the configuration (Cluster, InstanceGroups etc) is stored.
        /// </summary>
        [Output("configStore")]
        public Output<string?> ConfigStore { get; private set; } = null!;

        /// <summary>
        /// - String - Container runtime to use for Kubernetes.
        /// </summary>
        [Output("containerRuntime")]
        public Output<string?> ContainerRuntime { get; private set; } = null!;

        /// <summary>
        /// - containerd_config - Component configurations.
        /// </summary>
        [Output("containerd")]
        public Output<Outputs.ClusterContainerd?> Containerd { get; private set; } = null!;

        /// <summary>
        /// - String - DNSZone is the DNS zone we should use when configuring DNS&lt;br /&gt;This is because some clouds let us define a managed zone foo.bar, and then have&lt;br /&gt;kubernetes.dev.foo.bar, without needing to define dev.foo.bar as a hosted zone.&lt;br /&gt;DNSZone will probably be a suffix of the MasterPublicName and MasterInternalName&lt;br /&gt;Note that DNSZone can either by the host name of the zone (containing dots),&lt;br /&gt;or can be an identifier for the zone.
        /// </summary>
        [Output("dnsZone")]
        public Output<string?> DnsZone { get; private set; } = null!;

        /// <summary>
        /// - docker_config
        /// </summary>
        [Output("docker")]
        public Output<Outputs.ClusterDocker?> Docker { get; private set; } = null!;

        /// <summary>
        /// - egress_proxy_spec - HTTPProxy defines connection information to support use of a private cluster behind an forward HTTP Proxy.
        /// </summary>
        [Output("egressProxy")]
        public Output<Outputs.ClusterEgressProxy?> EgressProxy { get; private set; } = null!;

        /// <summary>
        /// - Bool - EncryptionConfig controls if encryption is enabled.
        /// </summary>
        [Output("encryptionConfig")]
        public Output<bool?> EncryptionConfig { get; private set; } = null!;

        /// <summary>
        /// - List(etcd_cluster_spec) - EtcdClusters stores the configuration for each cluster.
        /// </summary>
        [Output("etcdClusters")]
        public Output<ImmutableArray<Outputs.ClusterEtcdCluster>> EtcdClusters { get; private set; } = null!;

        /// <summary>
        /// - cloud_controller_manager_config
        /// </summary>
        [Output("externalCloudControllerManager")]
        public Output<Outputs.ClusterExternalCloudControllerManager?> ExternalCloudControllerManager { get; private set; } = null!;

        /// <summary>
        /// - external_dns_config
        /// </summary>
        [Output("externalDns")]
        public Output<Outputs.ClusterExternalDns?> ExternalDns { get; private set; } = null!;

        /// <summary>
        /// - Map(List(String)) - ExternalPolicies allows the insertion of pre-existing managed policies on IG Roles.
        /// </summary>
        [Output("externalPolicies")]
        public Output<ImmutableArray<Outputs.ClusterExternalPolicy>> ExternalPolicies { get; private set; } = null!;

        /// <summary>
        /// - List(file_asset_spec) - A collection of files assets for deployed cluster wide.
        /// </summary>
        [Output("fileAssets")]
        public Output<ImmutableArray<Outputs.ClusterFileAsset>> FileAssets { get; private set; } = null!;

        /// <summary>
        /// - List(hook_spec) - Hooks for custom actions e.g. on first installation.
        /// </summary>
        [Output("hooks")]
        public Output<ImmutableArray<Outputs.ClusterHook>> Hooks { get; private set; } = null!;

        /// <summary>
        /// - (Computed) - iam_spec - IAM field adds control over the IAM security policies applied to resources.
        /// </summary>
        [Output("iam")]
        public Output<Outputs.ClusterIam> Iam { get; private set; } = null!;

        /// <summary>
        /// - Bool - IsolateMasters determines whether we should lock down masters so that they are not on the pod network.&lt;br /&gt;true is the kube-up behaviour, but it is very surprising: it means that daemonsets only work on the master&lt;br /&gt;if they have hostNetwork=true.&lt;br /&gt;false is now the default, and it will:&lt;br /&gt; * give the master a normal PodCIDR&lt;br /&gt; * run kube-proxy on the master&lt;br /&gt; * enable debugging handlers on the master, so kubectl logs works.
        /// </summary>
        [Output("isolateMasters")]
        public Output<bool?> IsolateMasters { get; private set; } = null!;

        /// <summary>
        /// - karpenter_config - Karpenter defines the Karpenter configuration.
        /// </summary>
        [Output("karpenter")]
        public Output<Outputs.ClusterKarpenter?> Karpenter { get; private set; } = null!;

        /// <summary>
        /// - String - KeyStore is the VFS path to where SSL keys and certificates are stored.
        /// </summary>
        [Output("keyStore")]
        public Output<string?> KeyStore { get; private set; } = null!;

        /// <summary>
        /// - kube_api_server_config
        /// </summary>
        [Output("kubeApiServer")]
        public Output<Outputs.ClusterKubeApiServer?> KubeApiServer { get; private set; } = null!;

        /// <summary>
        /// - kube_controller_manager_config
        /// </summary>
        [Output("kubeControllerManager")]
        public Output<Outputs.ClusterKubeControllerManager?> KubeControllerManager { get; private set; } = null!;

        /// <summary>
        /// - kube_dns_config
        /// </summary>
        [Output("kubeDns")]
        public Output<Outputs.ClusterKubeDns?> KubeDns { get; private set; } = null!;

        /// <summary>
        /// - kube_proxy_config
        /// </summary>
        [Output("kubeProxy")]
        public Output<Outputs.ClusterKubeProxy?> KubeProxy { get; private set; } = null!;

        /// <summary>
        /// - kube_scheduler_config
        /// </summary>
        [Output("kubeScheduler")]
        public Output<Outputs.ClusterKubeScheduler?> KubeScheduler { get; private set; } = null!;

        /// <summary>
        /// - kubelet_config_spec - Kubelet is the kubelet configuration for nodes not belonging to the control plane.&lt;br /&gt;It can be overridden by the kubelet configuration specified in the instance group.
        /// </summary>
        [Output("kubelet")]
        public Output<Outputs.ClusterKubelet?> Kubelet { get; private set; } = null!;

        /// <summary>
        /// - List(String) - KubernetesAPIAccess is a list of the CIDRs that can access the Kubernetes API endpoint (master HTTPS).
        /// </summary>
        [Output("kubernetesApiAccesses")]
        public Output<ImmutableArray<string>> KubernetesApiAccesses { get; private set; } = null!;

        /// <summary>
        /// - String - The version of kubernetes to install (optional, and can be a "spec" like stable).
        /// </summary>
        [Output("kubernetesVersion")]
        public Output<string?> KubernetesVersion { get; private set; } = null!;

        /// <summary>
        /// - Map(String) - Map of string keys and values that can be used to organize and categorize&lt;br /&gt;(scope and select) objects. May match selectors of replication controllers&lt;br /&gt;and services.
        /// </summary>
        [Output("labels")]
        public Output<ImmutableDictionary<string, string>?> Labels { get; private set; } = null!;

        /// <summary>
        /// - (Computed) - String - MasterInternalName is the internal DNS name for the master nodes.
        /// </summary>
        [Output("masterInternalName")]
        public Output<string> MasterInternalName { get; private set; } = null!;

        /// <summary>
        /// - kubelet_config_spec - MasterKubelet is the kubelet configuration for nodes belonging to the control plane&lt;br /&gt;It can be overridden by the kubelet configuration specified in the instance group.
        /// </summary>
        [Output("masterKubelet")]
        public Output<Outputs.ClusterMasterKubelet?> MasterKubelet { get; private set; } = null!;

        /// <summary>
        /// - (Computed) - String - MasterPublicName is the external DNS name for the master nodes.
        /// </summary>
        [Output("masterPublicName")]
        public Output<string> MasterPublicName { get; private set; } = null!;

        /// <summary>
        /// - metrics_server_config - MetricsServer determines the metrics server configuration.
        /// </summary>
        [Output("metricsServer")]
        public Output<Outputs.ClusterMetricsServer?> MetricsServer { get; private set; } = null!;

        /// <summary>
        /// - (Force new) - String - Name defines the cluster name.
        /// </summary>
        [Output("name")]
        public Output<string> Name { get; private set; } = null!;

        /// <summary>
        /// - (Computed) - String - NetworkCIDR is the CIDR used for the AWS VPC / DO/ GCE Network, or otherwise allocated to k8s&lt;br /&gt;This is a real CIDR, not the internal k8s network&lt;br /&gt;On AWS, it maps to the VPC CIDR.  It is not required on GCE.&lt;br /&gt;On DO, it maps to the VPC CIDR.
        /// </summary>
        [Output("networkCidr")]
        public Output<string> NetworkCidr { get; private set; } = null!;

        /// <summary>
        /// - String - NetworkID is an identifier of a network, if we want to reuse/share an existing network (e.g. an AWS VPC).
        /// </summary>
        [Output("networkId")]
        public Output<string> NetworkId { get; private set; } = null!;

        /// <summary>
        /// - networking_spec - Networking configuration.
        /// </summary>
        [Output("networking")]
        public Output<Outputs.ClusterNetworking> Networking { get; private set; } = null!;

        /// <summary>
        /// - node_authorization_spec - NodeAuthorization defined the custom node authorization configuration.
        /// </summary>
        [Output("nodeAuthorization")]
        public Output<Outputs.ClusterNodeAuthorization?> NodeAuthorization { get; private set; } = null!;

        /// <summary>
        /// - List(String) - NodePortAccess is a list of the CIDRs that can access the node ports range (30000-32767).
        /// </summary>
        [Output("nodePortAccesses")]
        public Output<ImmutableArray<string>> NodePortAccesses { get; private set; } = null!;

        /// <summary>
        /// - node_problem_detector_config - NodeProblemDetector determines the node problem detector configuration.
        /// </summary>
        [Output("nodeProblemDetector")]
        public Output<Outputs.ClusterNodeProblemDetector?> NodeProblemDetector { get; private set; } = null!;

        /// <summary>
        /// - node_termination_handler_config - NodeTerminationHandler determines the node termination handler configuration.
        /// </summary>
        [Output("nodeTerminationHandler")]
        public Output<Outputs.ClusterNodeTerminationHandler?> NodeTerminationHandler { get; private set; } = null!;

        /// <summary>
        /// - (Computed) - String - NonMasqueradeCIDR is the CIDR for the internal k8s network (on which pods &amp; services live)&lt;br /&gt;It cannot overlap ServiceClusterIPRange.
        /// </summary>
        [Output("nonMasqueradeCidr")]
        public Output<string> NonMasqueradeCidr { get; private set; } = null!;

        /// <summary>
        /// - ntp_config
        /// </summary>
        [Output("ntp")]
        public Output<Outputs.ClusterNtp?> Ntp { get; private set; } = null!;

        /// <summary>
        /// - String - PodCIDR is the CIDR from which we allocate IPs for pods.
        /// </summary>
        [Output("podCidr")]
        public Output<string?> PodCidr { get; private set; } = null!;

        /// <summary>
        /// - pod_identity_webhook_config - PodIdentityWebhook determines the EKS Pod Identity Webhook configuration.
        /// </summary>
        [Output("podIdentityWebhook")]
        public Output<Outputs.ClusterPodIdentityWebhook?> PodIdentityWebhook { get; private set; } = null!;

        /// <summary>
        /// - String - Project is the cloud project we should use, required on GCE.
        /// </summary>
        [Output("project")]
        public Output<string?> Project { get; private set; } = null!;

        /// <summary>
        /// - Int - Revision is incremented every time the resource changes, this is useful for triggering cluster updater.
        /// </summary>
        [Output("revision")]
        public Output<int> Revision { get; private set; } = null!;

        /// <summary>
        /// - rolling_update - RollingUpdate defines the default rolling-update settings for instance groups.
        /// </summary>
        [Output("rollingUpdate")]
        public Output<Outputs.ClusterRollingUpdate?> RollingUpdate { get; private set; } = null!;

        /// <summary>
        /// - String - SecretStore is the VFS path to where secrets are stored.
        /// </summary>
        [Output("secretStore")]
        public Output<string?> SecretStore { get; private set; } = null!;

        /// <summary>
        /// - cluster_secrets - Secrets defines the cluster secret.
        /// </summary>
        [Output("secrets")]
        public Output<Outputs.ClusterSecrets?> Secrets { get; private set; } = null!;

        /// <summary>
        /// - service_account_issuer_discovery_config - ServiceAccountIssuerDiscovery configures the OIDC Issuer for ServiceAccounts.
        /// </summary>
        [Output("serviceAccountIssuerDiscovery")]
        public Output<Outputs.ClusterServiceAccountIssuerDiscovery?> ServiceAccountIssuerDiscovery { get; private set; } = null!;

        /// <summary>
        /// - String - ServiceClusterIPRange is the CIDR, from the internal network, where we allocate IPs for services.
        /// </summary>
        [Output("serviceClusterIpRange")]
        public Output<string?> ServiceClusterIpRange { get; private set; } = null!;

        /// <summary>
        /// - snapshot_controller_config - SnapshotController defines the CSI Snapshot Controller configuration.
        /// </summary>
        [Output("snapshotController")]
        public Output<Outputs.ClusterSnapshotController?> SnapshotController { get; private set; } = null!;

        /// <summary>
        /// - List(String) - SSHAccess is a list of the CIDRs that can access SSH.
        /// </summary>
        [Output("sshAccesses")]
        public Output<ImmutableArray<string>> SshAccesses { get; private set; } = null!;

        /// <summary>
        /// - String - SSHKeyName specifies a preexisting SSH key to use.
        /// </summary>
        [Output("sshKeyName")]
        public Output<string?> SshKeyName { get; private set; } = null!;

        /// <summary>
        /// - List(cluster_subnet_spec) - Configuration of subnets we are targeting.
        /// </summary>
        [Output("subnets")]
        public Output<ImmutableArray<Outputs.ClusterSubnet>> Subnets { get; private set; } = null!;

        /// <summary>
        /// - List(String) - SysctlParameters will configure kernel parameters using sysctl(8). When&lt;br /&gt;specified, each parameter must follow the form variable=value, the way&lt;br /&gt;it would appear in sysctl.conf.
        /// </summary>
        [Output("sysctlParameters")]
        public Output<ImmutableArray<string>> SysctlParameters { get; private set; } = null!;

        /// <summary>
        /// - Bool(Nullable) - TagSubnets controls if tags are added to subnets to enable use by load balancers (AWS only). Default: true.
        /// </summary>
        [Output("tagSubnets")]
        public Output<Outputs.ClusterTagSubnets?> TagSubnets { get; private set; } = null!;

        /// <summary>
        /// - topology_spec - Topology defines the type of network topology to use on the cluster - default public&lt;br /&gt;This is heavily weighted towards AWS for the time being, but should also be agnostic enough&lt;br /&gt;to port out to GCE later if needed.
        /// </summary>
        [Output("topology")]
        public Output<Outputs.ClusterTopology> Topology { get; private set; } = null!;

        /// <summary>
        /// - String - UpdatePolicy determines the policy for applying upgrades automatically.&lt;br /&gt;Valid values:&lt;br /&gt;  'automatic' (default): apply updates automatically (apply OS security upgrades, avoiding rebooting when possible)&lt;br /&gt;  'external': do not apply updates automatically; they are applied manually or by an external system.
        /// </summary>
        [Output("updatePolicy")]
        public Output<string?> UpdatePolicy { get; private set; } = null!;

        /// <summary>
        /// - Bool - UseHostCertificates will mount /etc/ssl/certs to inside needed containers.&lt;br /&gt;This is needed if some APIs do have self-signed certs.
        /// </summary>
        [Output("useHostCertificates")]
        public Output<bool?> UseHostCertificates { get; private set; } = null!;

        /// <summary>
        /// - warm_pool_spec - WarmPool defines the default warm pool settings for instance groups (AWS only).
        /// </summary>
        [Output("warmPool")]
        public Output<Outputs.ClusterWarmPool?> WarmPool { get; private set; } = null!;


        /// <summary>
        /// Create a Cluster resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public Cluster(string name, ClusterArgs args, CustomResourceOptions? options = null)
            : base("kops:index/cluster:Cluster", name, args ?? new ClusterArgs(), MakeResourceOptions(options, ""))
        {
        }

        private Cluster(string name, Input<string> id, ClusterState? state = null, CustomResourceOptions? options = null)
            : base("kops:index/cluster:Cluster", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing Cluster resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static Cluster Get(string name, Input<string> id, ClusterState? state = null, CustomResourceOptions? options = null)
        {
            return new Cluster(name, id, state, options);
        }
    }

    public sealed class ClusterArgs : global::Pulumi.ResourceArgs
    {
        [Input("additionalNetworkCidrs")]
        private InputList<string>? _additionalNetworkCidrs;

        /// <summary>
        /// - List(String) - AdditionalNetworkCIDRs is a list of additional CIDR used for the AWS VPC&lt;br /&gt;or otherwise allocated to k8s. This is a real CIDR, not the internal k8s network&lt;br /&gt;On AWS, it maps to any additional CIDRs added to a VPC.
        /// </summary>
        public InputList<string> AdditionalNetworkCidrs
        {
            get => _additionalNetworkCidrs ?? (_additionalNetworkCidrs = new InputList<string>());
            set => _additionalNetworkCidrs = value;
        }

        [Input("additionalPolicies")]
        private InputMap<string>? _additionalPolicies;

        /// <summary>
        /// - Map(String) - Additional policies to add for roles.
        /// </summary>
        public InputMap<string> AdditionalPolicies
        {
            get => _additionalPolicies ?? (_additionalPolicies = new InputMap<string>());
            set => _additionalPolicies = value;
        }

        [Input("additionalSans")]
        private InputList<string>? _additionalSans;

        /// <summary>
        /// - List(String) - AdditionalSANs adds additional Subject Alternate Names to apiserver cert that kops generates.
        /// </summary>
        public InputList<string> AdditionalSans
        {
            get => _additionalSans ?? (_additionalSans = new InputList<string>());
            set => _additionalSans = value;
        }

        [Input("addons")]
        private InputList<Inputs.ClusterAddonArgs>? _addons;

        /// <summary>
        /// - List(addon_spec) - Additional addons that should be installed on the cluster.
        /// </summary>
        public InputList<Inputs.ClusterAddonArgs> Addons
        {
            get => _addons ?? (_addons = new InputList<Inputs.ClusterAddonArgs>());
            set => _addons = value;
        }

        /// <summary>
        /// - (Sensitive) - String - AdminSshKey defines the cluster admin ssh key.
        /// </summary>
        [Input("adminSshKey")]
        public Input<string>? AdminSshKey { get; set; }

        [Input("annotations")]
        private InputMap<string>? _annotations;

        /// <summary>
        /// - Map(String) - Annotations is an unstructured key value map stored with a resource that may be&lt;br /&gt;set by external tools to store and retrieve arbitrary metadata. They are not&lt;br /&gt;queryable and should be preserved when modifying objects.
        /// </summary>
        public InputMap<string> Annotations
        {
            get => _annotations ?? (_annotations = new InputMap<string>());
            set => _annotations = value;
        }

        /// <summary>
        /// - access_spec - API field controls how the API is exposed outside the cluster.
        /// </summary>
        [Input("api")]
        public Input<Inputs.ClusterApiArgs>? Api { get; set; }

        /// <summary>
        /// - assets - Assets is alternative locations for files and containers; the API under construction, will remove this comment once this API is fully functional.
        /// </summary>
        [Input("assets")]
        public Input<Inputs.ClusterAssetsArgs>? Assets { get; set; }

        /// <summary>
        /// - authentication_spec - Authentication field controls how the cluster is configured for authentication.
        /// </summary>
        [Input("authentication")]
        public Input<Inputs.ClusterAuthenticationArgs>? Authentication { get; set; }

        /// <summary>
        /// - authorization_spec - Authorization field controls how the cluster is configured for authorization.
        /// </summary>
        [Input("authorization")]
        public Input<Inputs.ClusterAuthorizationArgs>? Authorization { get; set; }

        /// <summary>
        /// - aws_load_balancer_controller_config - AWSLoadbalancerControllerConfig determines the AWS LB controller configuration.
        /// </summary>
        [Input("awsLoadBalancerController")]
        public Input<Inputs.ClusterAwsLoadBalancerControllerArgs>? AwsLoadBalancerController { get; set; }

        /// <summary>
        /// - cert_manager_config - CertManager determines the metrics server configuration.
        /// </summary>
        [Input("certManager")]
        public Input<Inputs.ClusterCertManagerArgs>? CertManager { get; set; }

        /// <summary>
        /// - String - The Channel we are following.
        /// </summary>
        [Input("channel")]
        public Input<string>? Channel { get; set; }

        /// <summary>
        /// - cloud_configuration
        /// </summary>
        [Input("cloudConfig")]
        public Input<Inputs.ClusterCloudConfigArgs>? CloudConfig { get; set; }

        [Input("cloudLabels")]
        private InputMap<string>? _cloudLabels;

        /// <summary>
        /// - Map(String) - CloudLabels defines additional tags or labels on cloud provider resources.
        /// </summary>
        public InputMap<string> CloudLabels
        {
            get => _cloudLabels ?? (_cloudLabels = new InputMap<string>());
            set => _cloudLabels = value;
        }

        /// <summary>
        /// - cloud_provider_spec - CloudProvider configures the cloud provider to use.
        /// </summary>
        [Input("cloudProvider", required: true)]
        public Input<Inputs.ClusterCloudProviderArgs> CloudProvider { get; set; } = null!;

        /// <summary>
        /// - cluster_autoscaler_config - ClusterAutoscaler defines the cluster autoscaler configuration.
        /// </summary>
        [Input("clusterAutoscaler")]
        public Input<Inputs.ClusterClusterAutoscalerArgs>? ClusterAutoscaler { get; set; }

        /// <summary>
        /// - String - ClusterDNSDomain is the suffix we use for internal DNS names (normally cluster.local).
        /// </summary>
        [Input("clusterDnsDomain")]
        public Input<string>? ClusterDnsDomain { get; set; }

        /// <summary>
        /// - (Computed) - String - ConfigBase is the path where we store configuration for the cluster&lt;br /&gt;This might be different than the location where the cluster spec itself is stored,&lt;br /&gt;both because this must be accessible to the cluster,&lt;br /&gt;and because it might be on a different cloud or storage system (etcd vs S3).
        /// </summary>
        [Input("configBase")]
        public Input<string>? ConfigBase { get; set; }

        /// <summary>
        /// - String - ConfigStore is the VFS path to where the configuration (Cluster, InstanceGroups etc) is stored.
        /// </summary>
        [Input("configStore")]
        public Input<string>? ConfigStore { get; set; }

        /// <summary>
        /// - String - Container runtime to use for Kubernetes.
        /// </summary>
        [Input("containerRuntime")]
        public Input<string>? ContainerRuntime { get; set; }

        /// <summary>
        /// - containerd_config - Component configurations.
        /// </summary>
        [Input("containerd")]
        public Input<Inputs.ClusterContainerdArgs>? Containerd { get; set; }

        /// <summary>
        /// - String - DNSZone is the DNS zone we should use when configuring DNS&lt;br /&gt;This is because some clouds let us define a managed zone foo.bar, and then have&lt;br /&gt;kubernetes.dev.foo.bar, without needing to define dev.foo.bar as a hosted zone.&lt;br /&gt;DNSZone will probably be a suffix of the MasterPublicName and MasterInternalName&lt;br /&gt;Note that DNSZone can either by the host name of the zone (containing dots),&lt;br /&gt;or can be an identifier for the zone.
        /// </summary>
        [Input("dnsZone")]
        public Input<string>? DnsZone { get; set; }

        /// <summary>
        /// - docker_config
        /// </summary>
        [Input("docker")]
        public Input<Inputs.ClusterDockerArgs>? Docker { get; set; }

        /// <summary>
        /// - egress_proxy_spec - HTTPProxy defines connection information to support use of a private cluster behind an forward HTTP Proxy.
        /// </summary>
        [Input("egressProxy")]
        public Input<Inputs.ClusterEgressProxyArgs>? EgressProxy { get; set; }

        /// <summary>
        /// - Bool - EncryptionConfig controls if encryption is enabled.
        /// </summary>
        [Input("encryptionConfig")]
        public Input<bool>? EncryptionConfig { get; set; }

        [Input("etcdClusters", required: true)]
        private InputList<Inputs.ClusterEtcdClusterArgs>? _etcdClusters;

        /// <summary>
        /// - List(etcd_cluster_spec) - EtcdClusters stores the configuration for each cluster.
        /// </summary>
        public InputList<Inputs.ClusterEtcdClusterArgs> EtcdClusters
        {
            get => _etcdClusters ?? (_etcdClusters = new InputList<Inputs.ClusterEtcdClusterArgs>());
            set => _etcdClusters = value;
        }

        /// <summary>
        /// - cloud_controller_manager_config
        /// </summary>
        [Input("externalCloudControllerManager")]
        public Input<Inputs.ClusterExternalCloudControllerManagerArgs>? ExternalCloudControllerManager { get; set; }

        /// <summary>
        /// - external_dns_config
        /// </summary>
        [Input("externalDns")]
        public Input<Inputs.ClusterExternalDnsArgs>? ExternalDns { get; set; }

        [Input("externalPolicies")]
        private InputList<Inputs.ClusterExternalPolicyArgs>? _externalPolicies;

        /// <summary>
        /// - Map(List(String)) - ExternalPolicies allows the insertion of pre-existing managed policies on IG Roles.
        /// </summary>
        public InputList<Inputs.ClusterExternalPolicyArgs> ExternalPolicies
        {
            get => _externalPolicies ?? (_externalPolicies = new InputList<Inputs.ClusterExternalPolicyArgs>());
            set => _externalPolicies = value;
        }

        [Input("fileAssets")]
        private InputList<Inputs.ClusterFileAssetArgs>? _fileAssets;

        /// <summary>
        /// - List(file_asset_spec) - A collection of files assets for deployed cluster wide.
        /// </summary>
        public InputList<Inputs.ClusterFileAssetArgs> FileAssets
        {
            get => _fileAssets ?? (_fileAssets = new InputList<Inputs.ClusterFileAssetArgs>());
            set => _fileAssets = value;
        }

        [Input("hooks")]
        private InputList<Inputs.ClusterHookArgs>? _hooks;

        /// <summary>
        /// - List(hook_spec) - Hooks for custom actions e.g. on first installation.
        /// </summary>
        public InputList<Inputs.ClusterHookArgs> Hooks
        {
            get => _hooks ?? (_hooks = new InputList<Inputs.ClusterHookArgs>());
            set => _hooks = value;
        }

        /// <summary>
        /// - (Computed) - iam_spec - IAM field adds control over the IAM security policies applied to resources.
        /// </summary>
        [Input("iam")]
        public Input<Inputs.ClusterIamArgs>? Iam { get; set; }

        /// <summary>
        /// - Bool - IsolateMasters determines whether we should lock down masters so that they are not on the pod network.&lt;br /&gt;true is the kube-up behaviour, but it is very surprising: it means that daemonsets only work on the master&lt;br /&gt;if they have hostNetwork=true.&lt;br /&gt;false is now the default, and it will:&lt;br /&gt; * give the master a normal PodCIDR&lt;br /&gt; * run kube-proxy on the master&lt;br /&gt; * enable debugging handlers on the master, so kubectl logs works.
        /// </summary>
        [Input("isolateMasters")]
        public Input<bool>? IsolateMasters { get; set; }

        /// <summary>
        /// - karpenter_config - Karpenter defines the Karpenter configuration.
        /// </summary>
        [Input("karpenter")]
        public Input<Inputs.ClusterKarpenterArgs>? Karpenter { get; set; }

        /// <summary>
        /// - String - KeyStore is the VFS path to where SSL keys and certificates are stored.
        /// </summary>
        [Input("keyStore")]
        public Input<string>? KeyStore { get; set; }

        /// <summary>
        /// - kube_api_server_config
        /// </summary>
        [Input("kubeApiServer")]
        public Input<Inputs.ClusterKubeApiServerArgs>? KubeApiServer { get; set; }

        /// <summary>
        /// - kube_controller_manager_config
        /// </summary>
        [Input("kubeControllerManager")]
        public Input<Inputs.ClusterKubeControllerManagerArgs>? KubeControllerManager { get; set; }

        /// <summary>
        /// - kube_dns_config
        /// </summary>
        [Input("kubeDns")]
        public Input<Inputs.ClusterKubeDnsArgs>? KubeDns { get; set; }

        /// <summary>
        /// - kube_proxy_config
        /// </summary>
        [Input("kubeProxy")]
        public Input<Inputs.ClusterKubeProxyArgs>? KubeProxy { get; set; }

        /// <summary>
        /// - kube_scheduler_config
        /// </summary>
        [Input("kubeScheduler")]
        public Input<Inputs.ClusterKubeSchedulerArgs>? KubeScheduler { get; set; }

        /// <summary>
        /// - kubelet_config_spec - Kubelet is the kubelet configuration for nodes not belonging to the control plane.&lt;br /&gt;It can be overridden by the kubelet configuration specified in the instance group.
        /// </summary>
        [Input("kubelet")]
        public Input<Inputs.ClusterKubeletArgs>? Kubelet { get; set; }

        [Input("kubernetesApiAccesses")]
        private InputList<string>? _kubernetesApiAccesses;

        /// <summary>
        /// - List(String) - KubernetesAPIAccess is a list of the CIDRs that can access the Kubernetes API endpoint (master HTTPS).
        /// </summary>
        public InputList<string> KubernetesApiAccesses
        {
            get => _kubernetesApiAccesses ?? (_kubernetesApiAccesses = new InputList<string>());
            set => _kubernetesApiAccesses = value;
        }

        /// <summary>
        /// - String - The version of kubernetes to install (optional, and can be a "spec" like stable).
        /// </summary>
        [Input("kubernetesVersion")]
        public Input<string>? KubernetesVersion { get; set; }

        [Input("labels")]
        private InputMap<string>? _labels;

        /// <summary>
        /// - Map(String) - Map of string keys and values that can be used to organize and categorize&lt;br /&gt;(scope and select) objects. May match selectors of replication controllers&lt;br /&gt;and services.
        /// </summary>
        public InputMap<string> Labels
        {
            get => _labels ?? (_labels = new InputMap<string>());
            set => _labels = value;
        }

        /// <summary>
        /// - (Computed) - String - MasterInternalName is the internal DNS name for the master nodes.
        /// </summary>
        [Input("masterInternalName")]
        public Input<string>? MasterInternalName { get; set; }

        /// <summary>
        /// - kubelet_config_spec - MasterKubelet is the kubelet configuration for nodes belonging to the control plane&lt;br /&gt;It can be overridden by the kubelet configuration specified in the instance group.
        /// </summary>
        [Input("masterKubelet")]
        public Input<Inputs.ClusterMasterKubeletArgs>? MasterKubelet { get; set; }

        /// <summary>
        /// - (Computed) - String - MasterPublicName is the external DNS name for the master nodes.
        /// </summary>
        [Input("masterPublicName")]
        public Input<string>? MasterPublicName { get; set; }

        /// <summary>
        /// - metrics_server_config - MetricsServer determines the metrics server configuration.
        /// </summary>
        [Input("metricsServer")]
        public Input<Inputs.ClusterMetricsServerArgs>? MetricsServer { get; set; }

        /// <summary>
        /// - (Force new) - String - Name defines the cluster name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// - (Computed) - String - NetworkCIDR is the CIDR used for the AWS VPC / DO/ GCE Network, or otherwise allocated to k8s&lt;br /&gt;This is a real CIDR, not the internal k8s network&lt;br /&gt;On AWS, it maps to the VPC CIDR.  It is not required on GCE.&lt;br /&gt;On DO, it maps to the VPC CIDR.
        /// </summary>
        [Input("networkCidr")]
        public Input<string>? NetworkCidr { get; set; }

        /// <summary>
        /// - String - NetworkID is an identifier of a network, if we want to reuse/share an existing network (e.g. an AWS VPC).
        /// </summary>
        [Input("networkId", required: true)]
        public Input<string> NetworkId { get; set; } = null!;

        /// <summary>
        /// - networking_spec - Networking configuration.
        /// </summary>
        [Input("networking", required: true)]
        public Input<Inputs.ClusterNetworkingArgs> Networking { get; set; } = null!;

        /// <summary>
        /// - node_authorization_spec - NodeAuthorization defined the custom node authorization configuration.
        /// </summary>
        [Input("nodeAuthorization")]
        public Input<Inputs.ClusterNodeAuthorizationArgs>? NodeAuthorization { get; set; }

        [Input("nodePortAccesses")]
        private InputList<string>? _nodePortAccesses;

        /// <summary>
        /// - List(String) - NodePortAccess is a list of the CIDRs that can access the node ports range (30000-32767).
        /// </summary>
        public InputList<string> NodePortAccesses
        {
            get => _nodePortAccesses ?? (_nodePortAccesses = new InputList<string>());
            set => _nodePortAccesses = value;
        }

        /// <summary>
        /// - node_problem_detector_config - NodeProblemDetector determines the node problem detector configuration.
        /// </summary>
        [Input("nodeProblemDetector")]
        public Input<Inputs.ClusterNodeProblemDetectorArgs>? NodeProblemDetector { get; set; }

        /// <summary>
        /// - node_termination_handler_config - NodeTerminationHandler determines the node termination handler configuration.
        /// </summary>
        [Input("nodeTerminationHandler")]
        public Input<Inputs.ClusterNodeTerminationHandlerArgs>? NodeTerminationHandler { get; set; }

        /// <summary>
        /// - (Computed) - String - NonMasqueradeCIDR is the CIDR for the internal k8s network (on which pods &amp; services live)&lt;br /&gt;It cannot overlap ServiceClusterIPRange.
        /// </summary>
        [Input("nonMasqueradeCidr")]
        public Input<string>? NonMasqueradeCidr { get; set; }

        /// <summary>
        /// - ntp_config
        /// </summary>
        [Input("ntp")]
        public Input<Inputs.ClusterNtpArgs>? Ntp { get; set; }

        /// <summary>
        /// - String - PodCIDR is the CIDR from which we allocate IPs for pods.
        /// </summary>
        [Input("podCidr")]
        public Input<string>? PodCidr { get; set; }

        /// <summary>
        /// - pod_identity_webhook_config - PodIdentityWebhook determines the EKS Pod Identity Webhook configuration.
        /// </summary>
        [Input("podIdentityWebhook")]
        public Input<Inputs.ClusterPodIdentityWebhookArgs>? PodIdentityWebhook { get; set; }

        /// <summary>
        /// - String - Project is the cloud project we should use, required on GCE.
        /// </summary>
        [Input("project")]
        public Input<string>? Project { get; set; }

        /// <summary>
        /// - rolling_update - RollingUpdate defines the default rolling-update settings for instance groups.
        /// </summary>
        [Input("rollingUpdate")]
        public Input<Inputs.ClusterRollingUpdateArgs>? RollingUpdate { get; set; }

        /// <summary>
        /// - String - SecretStore is the VFS path to where secrets are stored.
        /// </summary>
        [Input("secretStore")]
        public Input<string>? SecretStore { get; set; }

        /// <summary>
        /// - cluster_secrets - Secrets defines the cluster secret.
        /// </summary>
        [Input("secrets")]
        public Input<Inputs.ClusterSecretsArgs>? Secrets { get; set; }

        /// <summary>
        /// - service_account_issuer_discovery_config - ServiceAccountIssuerDiscovery configures the OIDC Issuer for ServiceAccounts.
        /// </summary>
        [Input("serviceAccountIssuerDiscovery")]
        public Input<Inputs.ClusterServiceAccountIssuerDiscoveryArgs>? ServiceAccountIssuerDiscovery { get; set; }

        /// <summary>
        /// - String - ServiceClusterIPRange is the CIDR, from the internal network, where we allocate IPs for services.
        /// </summary>
        [Input("serviceClusterIpRange")]
        public Input<string>? ServiceClusterIpRange { get; set; }

        /// <summary>
        /// - snapshot_controller_config - SnapshotController defines the CSI Snapshot Controller configuration.
        /// </summary>
        [Input("snapshotController")]
        public Input<Inputs.ClusterSnapshotControllerArgs>? SnapshotController { get; set; }

        [Input("sshAccesses")]
        private InputList<string>? _sshAccesses;

        /// <summary>
        /// - List(String) - SSHAccess is a list of the CIDRs that can access SSH.
        /// </summary>
        public InputList<string> SshAccesses
        {
            get => _sshAccesses ?? (_sshAccesses = new InputList<string>());
            set => _sshAccesses = value;
        }

        /// <summary>
        /// - String - SSHKeyName specifies a preexisting SSH key to use.
        /// </summary>
        [Input("sshKeyName")]
        public Input<string>? SshKeyName { get; set; }

        [Input("subnets", required: true)]
        private InputList<Inputs.ClusterSubnetArgs>? _subnets;

        /// <summary>
        /// - List(cluster_subnet_spec) - Configuration of subnets we are targeting.
        /// </summary>
        public InputList<Inputs.ClusterSubnetArgs> Subnets
        {
            get => _subnets ?? (_subnets = new InputList<Inputs.ClusterSubnetArgs>());
            set => _subnets = value;
        }

        [Input("sysctlParameters")]
        private InputList<string>? _sysctlParameters;

        /// <summary>
        /// - List(String) - SysctlParameters will configure kernel parameters using sysctl(8). When&lt;br /&gt;specified, each parameter must follow the form variable=value, the way&lt;br /&gt;it would appear in sysctl.conf.
        /// </summary>
        public InputList<string> SysctlParameters
        {
            get => _sysctlParameters ?? (_sysctlParameters = new InputList<string>());
            set => _sysctlParameters = value;
        }

        /// <summary>
        /// - Bool(Nullable) - TagSubnets controls if tags are added to subnets to enable use by load balancers (AWS only). Default: true.
        /// </summary>
        [Input("tagSubnets")]
        public Input<Inputs.ClusterTagSubnetsArgs>? TagSubnets { get; set; }

        /// <summary>
        /// - topology_spec - Topology defines the type of network topology to use on the cluster - default public&lt;br /&gt;This is heavily weighted towards AWS for the time being, but should also be agnostic enough&lt;br /&gt;to port out to GCE later if needed.
        /// </summary>
        [Input("topology", required: true)]
        public Input<Inputs.ClusterTopologyArgs> Topology { get; set; } = null!;

        /// <summary>
        /// - String - UpdatePolicy determines the policy for applying upgrades automatically.&lt;br /&gt;Valid values:&lt;br /&gt;  'automatic' (default): apply updates automatically (apply OS security upgrades, avoiding rebooting when possible)&lt;br /&gt;  'external': do not apply updates automatically; they are applied manually or by an external system.
        /// </summary>
        [Input("updatePolicy")]
        public Input<string>? UpdatePolicy { get; set; }

        /// <summary>
        /// - Bool - UseHostCertificates will mount /etc/ssl/certs to inside needed containers.&lt;br /&gt;This is needed if some APIs do have self-signed certs.
        /// </summary>
        [Input("useHostCertificates")]
        public Input<bool>? UseHostCertificates { get; set; }

        /// <summary>
        /// - warm_pool_spec - WarmPool defines the default warm pool settings for instance groups (AWS only).
        /// </summary>
        [Input("warmPool")]
        public Input<Inputs.ClusterWarmPoolArgs>? WarmPool { get; set; }

        public ClusterArgs()
        {
        }
        public static new ClusterArgs Empty => new ClusterArgs();
    }

    public sealed class ClusterState : global::Pulumi.ResourceArgs
    {
        [Input("additionalNetworkCidrs")]
        private InputList<string>? _additionalNetworkCidrs;

        /// <summary>
        /// - List(String) - AdditionalNetworkCIDRs is a list of additional CIDR used for the AWS VPC&lt;br /&gt;or otherwise allocated to k8s. This is a real CIDR, not the internal k8s network&lt;br /&gt;On AWS, it maps to any additional CIDRs added to a VPC.
        /// </summary>
        public InputList<string> AdditionalNetworkCidrs
        {
            get => _additionalNetworkCidrs ?? (_additionalNetworkCidrs = new InputList<string>());
            set => _additionalNetworkCidrs = value;
        }

        [Input("additionalPolicies")]
        private InputMap<string>? _additionalPolicies;

        /// <summary>
        /// - Map(String) - Additional policies to add for roles.
        /// </summary>
        public InputMap<string> AdditionalPolicies
        {
            get => _additionalPolicies ?? (_additionalPolicies = new InputMap<string>());
            set => _additionalPolicies = value;
        }

        [Input("additionalSans")]
        private InputList<string>? _additionalSans;

        /// <summary>
        /// - List(String) - AdditionalSANs adds additional Subject Alternate Names to apiserver cert that kops generates.
        /// </summary>
        public InputList<string> AdditionalSans
        {
            get => _additionalSans ?? (_additionalSans = new InputList<string>());
            set => _additionalSans = value;
        }

        [Input("addons")]
        private InputList<Inputs.ClusterAddonGetArgs>? _addons;

        /// <summary>
        /// - List(addon_spec) - Additional addons that should be installed on the cluster.
        /// </summary>
        public InputList<Inputs.ClusterAddonGetArgs> Addons
        {
            get => _addons ?? (_addons = new InputList<Inputs.ClusterAddonGetArgs>());
            set => _addons = value;
        }

        /// <summary>
        /// - (Sensitive) - String - AdminSshKey defines the cluster admin ssh key.
        /// </summary>
        [Input("adminSshKey")]
        public Input<string>? AdminSshKey { get; set; }

        [Input("annotations")]
        private InputMap<string>? _annotations;

        /// <summary>
        /// - Map(String) - Annotations is an unstructured key value map stored with a resource that may be&lt;br /&gt;set by external tools to store and retrieve arbitrary metadata. They are not&lt;br /&gt;queryable and should be preserved when modifying objects.
        /// </summary>
        public InputMap<string> Annotations
        {
            get => _annotations ?? (_annotations = new InputMap<string>());
            set => _annotations = value;
        }

        /// <summary>
        /// - access_spec - API field controls how the API is exposed outside the cluster.
        /// </summary>
        [Input("api")]
        public Input<Inputs.ClusterApiGetArgs>? Api { get; set; }

        /// <summary>
        /// - assets - Assets is alternative locations for files and containers; the API under construction, will remove this comment once this API is fully functional.
        /// </summary>
        [Input("assets")]
        public Input<Inputs.ClusterAssetsGetArgs>? Assets { get; set; }

        /// <summary>
        /// - authentication_spec - Authentication field controls how the cluster is configured for authentication.
        /// </summary>
        [Input("authentication")]
        public Input<Inputs.ClusterAuthenticationGetArgs>? Authentication { get; set; }

        /// <summary>
        /// - authorization_spec - Authorization field controls how the cluster is configured for authorization.
        /// </summary>
        [Input("authorization")]
        public Input<Inputs.ClusterAuthorizationGetArgs>? Authorization { get; set; }

        /// <summary>
        /// - aws_load_balancer_controller_config - AWSLoadbalancerControllerConfig determines the AWS LB controller configuration.
        /// </summary>
        [Input("awsLoadBalancerController")]
        public Input<Inputs.ClusterAwsLoadBalancerControllerGetArgs>? AwsLoadBalancerController { get; set; }

        /// <summary>
        /// - cert_manager_config - CertManager determines the metrics server configuration.
        /// </summary>
        [Input("certManager")]
        public Input<Inputs.ClusterCertManagerGetArgs>? CertManager { get; set; }

        /// <summary>
        /// - String - The Channel we are following.
        /// </summary>
        [Input("channel")]
        public Input<string>? Channel { get; set; }

        /// <summary>
        /// - cloud_configuration
        /// </summary>
        [Input("cloudConfig")]
        public Input<Inputs.ClusterCloudConfigGetArgs>? CloudConfig { get; set; }

        [Input("cloudLabels")]
        private InputMap<string>? _cloudLabels;

        /// <summary>
        /// - Map(String) - CloudLabels defines additional tags or labels on cloud provider resources.
        /// </summary>
        public InputMap<string> CloudLabels
        {
            get => _cloudLabels ?? (_cloudLabels = new InputMap<string>());
            set => _cloudLabels = value;
        }

        /// <summary>
        /// - cloud_provider_spec - CloudProvider configures the cloud provider to use.
        /// </summary>
        [Input("cloudProvider")]
        public Input<Inputs.ClusterCloudProviderGetArgs>? CloudProvider { get; set; }

        /// <summary>
        /// - cluster_autoscaler_config - ClusterAutoscaler defines the cluster autoscaler configuration.
        /// </summary>
        [Input("clusterAutoscaler")]
        public Input<Inputs.ClusterClusterAutoscalerGetArgs>? ClusterAutoscaler { get; set; }

        /// <summary>
        /// - String - ClusterDNSDomain is the suffix we use for internal DNS names (normally cluster.local).
        /// </summary>
        [Input("clusterDnsDomain")]
        public Input<string>? ClusterDnsDomain { get; set; }

        /// <summary>
        /// - (Computed) - String - ConfigBase is the path where we store configuration for the cluster&lt;br /&gt;This might be different than the location where the cluster spec itself is stored,&lt;br /&gt;both because this must be accessible to the cluster,&lt;br /&gt;and because it might be on a different cloud or storage system (etcd vs S3).
        /// </summary>
        [Input("configBase")]
        public Input<string>? ConfigBase { get; set; }

        /// <summary>
        /// - String - ConfigStore is the VFS path to where the configuration (Cluster, InstanceGroups etc) is stored.
        /// </summary>
        [Input("configStore")]
        public Input<string>? ConfigStore { get; set; }

        /// <summary>
        /// - String - Container runtime to use for Kubernetes.
        /// </summary>
        [Input("containerRuntime")]
        public Input<string>? ContainerRuntime { get; set; }

        /// <summary>
        /// - containerd_config - Component configurations.
        /// </summary>
        [Input("containerd")]
        public Input<Inputs.ClusterContainerdGetArgs>? Containerd { get; set; }

        /// <summary>
        /// - String - DNSZone is the DNS zone we should use when configuring DNS&lt;br /&gt;This is because some clouds let us define a managed zone foo.bar, and then have&lt;br /&gt;kubernetes.dev.foo.bar, without needing to define dev.foo.bar as a hosted zone.&lt;br /&gt;DNSZone will probably be a suffix of the MasterPublicName and MasterInternalName&lt;br /&gt;Note that DNSZone can either by the host name of the zone (containing dots),&lt;br /&gt;or can be an identifier for the zone.
        /// </summary>
        [Input("dnsZone")]
        public Input<string>? DnsZone { get; set; }

        /// <summary>
        /// - docker_config
        /// </summary>
        [Input("docker")]
        public Input<Inputs.ClusterDockerGetArgs>? Docker { get; set; }

        /// <summary>
        /// - egress_proxy_spec - HTTPProxy defines connection information to support use of a private cluster behind an forward HTTP Proxy.
        /// </summary>
        [Input("egressProxy")]
        public Input<Inputs.ClusterEgressProxyGetArgs>? EgressProxy { get; set; }

        /// <summary>
        /// - Bool - EncryptionConfig controls if encryption is enabled.
        /// </summary>
        [Input("encryptionConfig")]
        public Input<bool>? EncryptionConfig { get; set; }

        [Input("etcdClusters")]
        private InputList<Inputs.ClusterEtcdClusterGetArgs>? _etcdClusters;

        /// <summary>
        /// - List(etcd_cluster_spec) - EtcdClusters stores the configuration for each cluster.
        /// </summary>
        public InputList<Inputs.ClusterEtcdClusterGetArgs> EtcdClusters
        {
            get => _etcdClusters ?? (_etcdClusters = new InputList<Inputs.ClusterEtcdClusterGetArgs>());
            set => _etcdClusters = value;
        }

        /// <summary>
        /// - cloud_controller_manager_config
        /// </summary>
        [Input("externalCloudControllerManager")]
        public Input<Inputs.ClusterExternalCloudControllerManagerGetArgs>? ExternalCloudControllerManager { get; set; }

        /// <summary>
        /// - external_dns_config
        /// </summary>
        [Input("externalDns")]
        public Input<Inputs.ClusterExternalDnsGetArgs>? ExternalDns { get; set; }

        [Input("externalPolicies")]
        private InputList<Inputs.ClusterExternalPolicyGetArgs>? _externalPolicies;

        /// <summary>
        /// - Map(List(String)) - ExternalPolicies allows the insertion of pre-existing managed policies on IG Roles.
        /// </summary>
        public InputList<Inputs.ClusterExternalPolicyGetArgs> ExternalPolicies
        {
            get => _externalPolicies ?? (_externalPolicies = new InputList<Inputs.ClusterExternalPolicyGetArgs>());
            set => _externalPolicies = value;
        }

        [Input("fileAssets")]
        private InputList<Inputs.ClusterFileAssetGetArgs>? _fileAssets;

        /// <summary>
        /// - List(file_asset_spec) - A collection of files assets for deployed cluster wide.
        /// </summary>
        public InputList<Inputs.ClusterFileAssetGetArgs> FileAssets
        {
            get => _fileAssets ?? (_fileAssets = new InputList<Inputs.ClusterFileAssetGetArgs>());
            set => _fileAssets = value;
        }

        [Input("hooks")]
        private InputList<Inputs.ClusterHookGetArgs>? _hooks;

        /// <summary>
        /// - List(hook_spec) - Hooks for custom actions e.g. on first installation.
        /// </summary>
        public InputList<Inputs.ClusterHookGetArgs> Hooks
        {
            get => _hooks ?? (_hooks = new InputList<Inputs.ClusterHookGetArgs>());
            set => _hooks = value;
        }

        /// <summary>
        /// - (Computed) - iam_spec - IAM field adds control over the IAM security policies applied to resources.
        /// </summary>
        [Input("iam")]
        public Input<Inputs.ClusterIamGetArgs>? Iam { get; set; }

        /// <summary>
        /// - Bool - IsolateMasters determines whether we should lock down masters so that they are not on the pod network.&lt;br /&gt;true is the kube-up behaviour, but it is very surprising: it means that daemonsets only work on the master&lt;br /&gt;if they have hostNetwork=true.&lt;br /&gt;false is now the default, and it will:&lt;br /&gt; * give the master a normal PodCIDR&lt;br /&gt; * run kube-proxy on the master&lt;br /&gt; * enable debugging handlers on the master, so kubectl logs works.
        /// </summary>
        [Input("isolateMasters")]
        public Input<bool>? IsolateMasters { get; set; }

        /// <summary>
        /// - karpenter_config - Karpenter defines the Karpenter configuration.
        /// </summary>
        [Input("karpenter")]
        public Input<Inputs.ClusterKarpenterGetArgs>? Karpenter { get; set; }

        /// <summary>
        /// - String - KeyStore is the VFS path to where SSL keys and certificates are stored.
        /// </summary>
        [Input("keyStore")]
        public Input<string>? KeyStore { get; set; }

        /// <summary>
        /// - kube_api_server_config
        /// </summary>
        [Input("kubeApiServer")]
        public Input<Inputs.ClusterKubeApiServerGetArgs>? KubeApiServer { get; set; }

        /// <summary>
        /// - kube_controller_manager_config
        /// </summary>
        [Input("kubeControllerManager")]
        public Input<Inputs.ClusterKubeControllerManagerGetArgs>? KubeControllerManager { get; set; }

        /// <summary>
        /// - kube_dns_config
        /// </summary>
        [Input("kubeDns")]
        public Input<Inputs.ClusterKubeDnsGetArgs>? KubeDns { get; set; }

        /// <summary>
        /// - kube_proxy_config
        /// </summary>
        [Input("kubeProxy")]
        public Input<Inputs.ClusterKubeProxyGetArgs>? KubeProxy { get; set; }

        /// <summary>
        /// - kube_scheduler_config
        /// </summary>
        [Input("kubeScheduler")]
        public Input<Inputs.ClusterKubeSchedulerGetArgs>? KubeScheduler { get; set; }

        /// <summary>
        /// - kubelet_config_spec - Kubelet is the kubelet configuration for nodes not belonging to the control plane.&lt;br /&gt;It can be overridden by the kubelet configuration specified in the instance group.
        /// </summary>
        [Input("kubelet")]
        public Input<Inputs.ClusterKubeletGetArgs>? Kubelet { get; set; }

        [Input("kubernetesApiAccesses")]
        private InputList<string>? _kubernetesApiAccesses;

        /// <summary>
        /// - List(String) - KubernetesAPIAccess is a list of the CIDRs that can access the Kubernetes API endpoint (master HTTPS).
        /// </summary>
        public InputList<string> KubernetesApiAccesses
        {
            get => _kubernetesApiAccesses ?? (_kubernetesApiAccesses = new InputList<string>());
            set => _kubernetesApiAccesses = value;
        }

        /// <summary>
        /// - String - The version of kubernetes to install (optional, and can be a "spec" like stable).
        /// </summary>
        [Input("kubernetesVersion")]
        public Input<string>? KubernetesVersion { get; set; }

        [Input("labels")]
        private InputMap<string>? _labels;

        /// <summary>
        /// - Map(String) - Map of string keys and values that can be used to organize and categorize&lt;br /&gt;(scope and select) objects. May match selectors of replication controllers&lt;br /&gt;and services.
        /// </summary>
        public InputMap<string> Labels
        {
            get => _labels ?? (_labels = new InputMap<string>());
            set => _labels = value;
        }

        /// <summary>
        /// - (Computed) - String - MasterInternalName is the internal DNS name for the master nodes.
        /// </summary>
        [Input("masterInternalName")]
        public Input<string>? MasterInternalName { get; set; }

        /// <summary>
        /// - kubelet_config_spec - MasterKubelet is the kubelet configuration for nodes belonging to the control plane&lt;br /&gt;It can be overridden by the kubelet configuration specified in the instance group.
        /// </summary>
        [Input("masterKubelet")]
        public Input<Inputs.ClusterMasterKubeletGetArgs>? MasterKubelet { get; set; }

        /// <summary>
        /// - (Computed) - String - MasterPublicName is the external DNS name for the master nodes.
        /// </summary>
        [Input("masterPublicName")]
        public Input<string>? MasterPublicName { get; set; }

        /// <summary>
        /// - metrics_server_config - MetricsServer determines the metrics server configuration.
        /// </summary>
        [Input("metricsServer")]
        public Input<Inputs.ClusterMetricsServerGetArgs>? MetricsServer { get; set; }

        /// <summary>
        /// - (Force new) - String - Name defines the cluster name.
        /// </summary>
        [Input("name")]
        public Input<string>? Name { get; set; }

        /// <summary>
        /// - (Computed) - String - NetworkCIDR is the CIDR used for the AWS VPC / DO/ GCE Network, or otherwise allocated to k8s&lt;br /&gt;This is a real CIDR, not the internal k8s network&lt;br /&gt;On AWS, it maps to the VPC CIDR.  It is not required on GCE.&lt;br /&gt;On DO, it maps to the VPC CIDR.
        /// </summary>
        [Input("networkCidr")]
        public Input<string>? NetworkCidr { get; set; }

        /// <summary>
        /// - String - NetworkID is an identifier of a network, if we want to reuse/share an existing network (e.g. an AWS VPC).
        /// </summary>
        [Input("networkId")]
        public Input<string>? NetworkId { get; set; }

        /// <summary>
        /// - networking_spec - Networking configuration.
        /// </summary>
        [Input("networking")]
        public Input<Inputs.ClusterNetworkingGetArgs>? Networking { get; set; }

        /// <summary>
        /// - node_authorization_spec - NodeAuthorization defined the custom node authorization configuration.
        /// </summary>
        [Input("nodeAuthorization")]
        public Input<Inputs.ClusterNodeAuthorizationGetArgs>? NodeAuthorization { get; set; }

        [Input("nodePortAccesses")]
        private InputList<string>? _nodePortAccesses;

        /// <summary>
        /// - List(String) - NodePortAccess is a list of the CIDRs that can access the node ports range (30000-32767).
        /// </summary>
        public InputList<string> NodePortAccesses
        {
            get => _nodePortAccesses ?? (_nodePortAccesses = new InputList<string>());
            set => _nodePortAccesses = value;
        }

        /// <summary>
        /// - node_problem_detector_config - NodeProblemDetector determines the node problem detector configuration.
        /// </summary>
        [Input("nodeProblemDetector")]
        public Input<Inputs.ClusterNodeProblemDetectorGetArgs>? NodeProblemDetector { get; set; }

        /// <summary>
        /// - node_termination_handler_config - NodeTerminationHandler determines the node termination handler configuration.
        /// </summary>
        [Input("nodeTerminationHandler")]
        public Input<Inputs.ClusterNodeTerminationHandlerGetArgs>? NodeTerminationHandler { get; set; }

        /// <summary>
        /// - (Computed) - String - NonMasqueradeCIDR is the CIDR for the internal k8s network (on which pods &amp; services live)&lt;br /&gt;It cannot overlap ServiceClusterIPRange.
        /// </summary>
        [Input("nonMasqueradeCidr")]
        public Input<string>? NonMasqueradeCidr { get; set; }

        /// <summary>
        /// - ntp_config
        /// </summary>
        [Input("ntp")]
        public Input<Inputs.ClusterNtpGetArgs>? Ntp { get; set; }

        /// <summary>
        /// - String - PodCIDR is the CIDR from which we allocate IPs for pods.
        /// </summary>
        [Input("podCidr")]
        public Input<string>? PodCidr { get; set; }

        /// <summary>
        /// - pod_identity_webhook_config - PodIdentityWebhook determines the EKS Pod Identity Webhook configuration.
        /// </summary>
        [Input("podIdentityWebhook")]
        public Input<Inputs.ClusterPodIdentityWebhookGetArgs>? PodIdentityWebhook { get; set; }

        /// <summary>
        /// - String - Project is the cloud project we should use, required on GCE.
        /// </summary>
        [Input("project")]
        public Input<string>? Project { get; set; }

        /// <summary>
        /// - Int - Revision is incremented every time the resource changes, this is useful for triggering cluster updater.
        /// </summary>
        [Input("revision")]
        public Input<int>? Revision { get; set; }

        /// <summary>
        /// - rolling_update - RollingUpdate defines the default rolling-update settings for instance groups.
        /// </summary>
        [Input("rollingUpdate")]
        public Input<Inputs.ClusterRollingUpdateGetArgs>? RollingUpdate { get; set; }

        /// <summary>
        /// - String - SecretStore is the VFS path to where secrets are stored.
        /// </summary>
        [Input("secretStore")]
        public Input<string>? SecretStore { get; set; }

        /// <summary>
        /// - cluster_secrets - Secrets defines the cluster secret.
        /// </summary>
        [Input("secrets")]
        public Input<Inputs.ClusterSecretsGetArgs>? Secrets { get; set; }

        /// <summary>
        /// - service_account_issuer_discovery_config - ServiceAccountIssuerDiscovery configures the OIDC Issuer for ServiceAccounts.
        /// </summary>
        [Input("serviceAccountIssuerDiscovery")]
        public Input<Inputs.ClusterServiceAccountIssuerDiscoveryGetArgs>? ServiceAccountIssuerDiscovery { get; set; }

        /// <summary>
        /// - String - ServiceClusterIPRange is the CIDR, from the internal network, where we allocate IPs for services.
        /// </summary>
        [Input("serviceClusterIpRange")]
        public Input<string>? ServiceClusterIpRange { get; set; }

        /// <summary>
        /// - snapshot_controller_config - SnapshotController defines the CSI Snapshot Controller configuration.
        /// </summary>
        [Input("snapshotController")]
        public Input<Inputs.ClusterSnapshotControllerGetArgs>? SnapshotController { get; set; }

        [Input("sshAccesses")]
        private InputList<string>? _sshAccesses;

        /// <summary>
        /// - List(String) - SSHAccess is a list of the CIDRs that can access SSH.
        /// </summary>
        public InputList<string> SshAccesses
        {
            get => _sshAccesses ?? (_sshAccesses = new InputList<string>());
            set => _sshAccesses = value;
        }

        /// <summary>
        /// - String - SSHKeyName specifies a preexisting SSH key to use.
        /// </summary>
        [Input("sshKeyName")]
        public Input<string>? SshKeyName { get; set; }

        [Input("subnets")]
        private InputList<Inputs.ClusterSubnetGetArgs>? _subnets;

        /// <summary>
        /// - List(cluster_subnet_spec) - Configuration of subnets we are targeting.
        /// </summary>
        public InputList<Inputs.ClusterSubnetGetArgs> Subnets
        {
            get => _subnets ?? (_subnets = new InputList<Inputs.ClusterSubnetGetArgs>());
            set => _subnets = value;
        }

        [Input("sysctlParameters")]
        private InputList<string>? _sysctlParameters;

        /// <summary>
        /// - List(String) - SysctlParameters will configure kernel parameters using sysctl(8). When&lt;br /&gt;specified, each parameter must follow the form variable=value, the way&lt;br /&gt;it would appear in sysctl.conf.
        /// </summary>
        public InputList<string> SysctlParameters
        {
            get => _sysctlParameters ?? (_sysctlParameters = new InputList<string>());
            set => _sysctlParameters = value;
        }

        /// <summary>
        /// - Bool(Nullable) - TagSubnets controls if tags are added to subnets to enable use by load balancers (AWS only). Default: true.
        /// </summary>
        [Input("tagSubnets")]
        public Input<Inputs.ClusterTagSubnetsGetArgs>? TagSubnets { get; set; }

        /// <summary>
        /// - topology_spec - Topology defines the type of network topology to use on the cluster - default public&lt;br /&gt;This is heavily weighted towards AWS for the time being, but should also be agnostic enough&lt;br /&gt;to port out to GCE later if needed.
        /// </summary>
        [Input("topology")]
        public Input<Inputs.ClusterTopologyGetArgs>? Topology { get; set; }

        /// <summary>
        /// - String - UpdatePolicy determines the policy for applying upgrades automatically.&lt;br /&gt;Valid values:&lt;br /&gt;  'automatic' (default): apply updates automatically (apply OS security upgrades, avoiding rebooting when possible)&lt;br /&gt;  'external': do not apply updates automatically; they are applied manually or by an external system.
        /// </summary>
        [Input("updatePolicy")]
        public Input<string>? UpdatePolicy { get; set; }

        /// <summary>
        /// - Bool - UseHostCertificates will mount /etc/ssl/certs to inside needed containers.&lt;br /&gt;This is needed if some APIs do have self-signed certs.
        /// </summary>
        [Input("useHostCertificates")]
        public Input<bool>? UseHostCertificates { get; set; }

        /// <summary>
        /// - warm_pool_spec - WarmPool defines the default warm pool settings for instance groups (AWS only).
        /// </summary>
        [Input("warmPool")]
        public Input<Inputs.ClusterWarmPoolGetArgs>? WarmPool { get; set; }

        public ClusterState()
        {
        }
        public static new ClusterState Empty => new ClusterState();
    }
}
