@pulumi/gcp/container/cluster.d.ts

A Pulumi package for creating and managing Google Cloud Platform resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Manages a Google Kubernetes Engine (GKE) cluster.
 *
 * To get more information about GKE clusters, see:
 *   * [The API reference](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters)
 *   * How-to guides
 *     * [GKE overview](https://cloud.google.com/kubernetes-engine/docs/concepts/kubernetes-engine-overview)
 *     * [About cluster configuration choices](https://cloud.google.com/kubernetes-engine/docs/concepts/types-of-clusters)
 *
 * > On version 5.0.0+ of the provider, you must explicitly set `deletionProtection = false`
 * and run `pulumi up` to write the field to state in order to destroy a cluster.
 *
 * > All arguments and attributes (including certificate outputs) will be stored in the raw state as
 * plaintext. Read more about sensitive data in state.
 *
 * ## Example Usage
 *
 * ### With A Separately Managed Node Pool (Recommended)
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.serviceaccount.Account("default", {
 *     accountId: "service-account-id",
 *     displayName: "Service Account",
 * });
 * const primary = new gcp.container.Cluster("primary", {
 *     name: "my-gke-cluster",
 *     location: "us-central1",
 *     removeDefaultNodePool: true,
 *     initialNodeCount: 1,
 * });
 * const primaryPreemptibleNodes = new gcp.container.NodePool("primary_preemptible_nodes", {
 *     name: "my-node-pool",
 *     location: "us-central1",
 *     cluster: primary.name,
 *     nodeCount: 1,
 *     nodeConfig: {
 *         preemptible: true,
 *         machineType: "e2-medium",
 *         serviceAccount: _default.email,
 *         oauthScopes: ["https://www.googleapis.com/auth/cloud-platform"],
 *     },
 * });
 * ```
 *
 * > **Note:** It is recommended that node pools be created and managed as separate resources as in the example above.
 * This allows node pools to be added and removed without recreating the cluster.  Node pools defined directly in the
 * `gcp.container.Cluster` resource cannot be removed without re-creating the cluster.
 *
 * ### With The Default Node Pool
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.serviceaccount.Account("default", {
 *     accountId: "service-account-id",
 *     displayName: "Service Account",
 * });
 * const primary = new gcp.container.Cluster("primary", {
 *     name: "marcellus-wallace",
 *     location: "us-central1-a",
 *     initialNodeCount: 3,
 *     nodeConfig: {
 *         serviceAccount: _default.email,
 *         oauthScopes: ["https://www.googleapis.com/auth/cloud-platform"],
 *         labels: {
 *             foo: "bar",
 *         },
 *         tags: [
 *             "foo",
 *             "bar",
 *         ],
 *     },
 * });
 * ```
 *
 * ### Autopilot
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.serviceaccount.Account("default", {
 *     accountId: "service-account-id",
 *     displayName: "Service Account",
 * });
 * const primary = new gcp.container.Cluster("primary", {
 *     name: "marcellus-wallace",
 *     location: "us-central1-a",
 *     enableAutopilot: true,
 * });
 * ```
 *
 * ## Import
 *
 * GKE clusters can be imported using the `project` , `location`, and `name`. If the project is omitted, the default
 * provider value will be used. Examples:
 *
 * * `projects/{{project_id}}/locations/{{location}}/clusters/{{cluster_id}}`
 * * `{{project_id}}/{{location}}/{{cluster_id}}`
 * * `{{location}}/{{cluster_id}}`
 *
 * When using the `pulumi import` command, GKE clusters can be imported using one of the formats above. For example:
 *
 * ```sh
 * $ pulumi import gcp:container/cluster:Cluster default projects/{{project_id}}/locations/{{location}}/clusters/{{cluster_id}}
 *
 * $ pulumi import gcp:container/cluster:Cluster default {{project_id}}/{{location}}/{{cluster_id}}
 *
 * $ pulumi import gcp:container/cluster:Cluster default {{location}}/{{cluster_id}}
 * ```
 *
 * > **Note:** This resource has several fields that control Terraform-specific behavior and aren't present in the API. If they are set in config and you import a cluster, Terraform may need to perform an update immediately after import. Most of these updates should be no-ops but some may modify your cluster if the imported state differs.
 *
 * For example, the following fields will show diffs if set in config:
 *
 * - `minMasterVersion`
 * - `removeDefaultNodePool`
 */
export declare class Cluster extends pulumi.CustomResource {
    /**
     * Get an existing Cluster resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ClusterState, opts?: pulumi.CustomResourceOptions): Cluster;
    /**
     * Returns true if the given object is an instance of Cluster.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is Cluster;
    /**
     * The configuration for addons supported by GKE.
     * Structure is documented below.
     */
    readonly addonsConfig: pulumi.Output<outputs.container.ClusterAddonsConfig>;
    /**
     * Enable NET_ADMIN for the cluster. Defaults to
     * `false`. This field should only be enabled for Autopilot clusters (`enableAutopilot`
     * set to `true`).
     */
    readonly allowNetAdmin: pulumi.Output<boolean | undefined>;
    /**
     * Configuration for [anonymous authentication restrictions](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#restrict-anon-access). Structure is documented below.
     */
    readonly anonymousAuthenticationConfig: pulumi.Output<outputs.container.ClusterAnonymousAuthenticationConfig>;
    /**
     * Configuration for the
     * [Google Groups for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#groups-setup-gsuite) feature.
     * Structure is documented below.
     */
    readonly authenticatorGroupsConfig: pulumi.Output<outputs.container.ClusterAuthenticatorGroupsConfig>;
    /**
     * Per-cluster configuration of Autopilot cluster policies in GKE clusters. This field can only be configured in non Autopilot clusters. Structure is documented below.
     */
    readonly autopilotClusterPolicyConfig: pulumi.Output<outputs.container.ClusterAutopilotClusterPolicyConfig>;
    /**
     * The customer
     * allowlist Cloud Storage paths for the cluster. These paths are used with the
     * `--autopilot-privileged-admission` flag to authorize privileged workloads in
     * Autopilot clusters. See the Cluster API's
     * [PrivilegedAdmissionConfig](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#privilegedadmissionconfig)
     * documentation for more details.
     */
    readonly autopilotPrivilegedAdmissions: pulumi.Output<string[]>;
    /**
     * Configuration options for the Binary
     * Authorization feature. Structure is documented below.
     */
    readonly binaryAuthorization: pulumi.Output<outputs.container.ClusterBinaryAuthorization | undefined>;
    /**
     * Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to
     * automatically adjust the size of the cluster and create/delete node pools based
     * on the current needs of the cluster's workload. See the
     * [guide to using Node Auto-Provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)
     * for more details. Structure is documented below.
     */
    readonly clusterAutoscaling: pulumi.Output<outputs.container.ClusterClusterAutoscaling>;
    /**
     * The IP address range of the Kubernetes pods
     * in this cluster in CIDR notation (e.g. `10.96.0.0/14`). Leave blank to have one
     * automatically chosen or specify a `/14` block in `10.0.0.0/8`. This field will
     * default a new cluster to routes-based, where `ipAllocationPolicy` is not defined.
     */
    readonly clusterIpv4Cidr: pulumi.Output<string>;
    /**
     * ) Configuration for
     * [ClusterTelemetry](https://cloud.google.com/monitoring/kubernetes-engine/installing#controlling_the_collection_of_application_logs) feature,
     * Structure is documented below.
     */
    readonly clusterTelemetry: pulumi.Output<outputs.container.ClusterClusterTelemetry>;
    /**
     * Configuration for [Confidential Nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes) feature. Structure is documented below documented below.
     */
    readonly confidentialNodes: pulumi.Output<outputs.container.ClusterConfidentialNodes>;
    /**
     * Configuration for all of the cluster's control plane endpoints.
     * Structure is documented below.
     */
    readonly controlPlaneEndpointsConfig: pulumi.Output<outputs.container.ClusterControlPlaneEndpointsConfig>;
    /**
     * Configuration for the
     * [Cost Allocation](https://cloud.google.com/kubernetes-engine/docs/how-to/cost-allocations) feature.
     * Structure is documented below.
     */
    readonly costManagementConfig: pulumi.Output<outputs.container.ClusterCostManagementConfig>;
    /**
     * Structure is documented below.
     */
    readonly databaseEncryption: pulumi.Output<outputs.container.ClusterDatabaseEncryption>;
    /**
     * The desired datapath provider for this cluster. This is set to `LEGACY_DATAPATH` by default, which uses the IPTables-based kube-proxy implementation. Set to `ADVANCED_DATAPATH` to enable Dataplane v2.
     */
    readonly datapathProvider: pulumi.Output<string>;
    /**
     * The dataplane optimization mode for the cluster. Possible values: `SCALE_OPTIMIZED`.
     */
    readonly dataplaneOptimizationMode: pulumi.Output<string | undefined>;
    /**
     * The default maximum number of pods
     * per node in this cluster. This doesn't work on "routes-based" clusters, clusters
     * that don't have IP Aliasing enabled. See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr)
     * for more information.
     */
    readonly defaultMaxPodsPerNode: pulumi.Output<number>;
    /**
     * [GKE SNAT](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#how_ipmasq_works) DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster, [API doc](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#networkconfig). Structure is documented below
     */
    readonly defaultSnatStatus: pulumi.Output<outputs.container.ClusterDefaultSnatStatus>;
    /**
     * (Optional) Whether Terraform will be prevented from destroying the resource. Defaults to "DELETE".
     * When a 'terraform destroy' or 'pulumi up' would delete the resource,
     * the command will fail if this field is set to "PREVENT" in Terraform state.
     * When set to "ABANDON", the command will remove the resource from Terraform
     * management without updating or deleting the resource in the API.
     * When set to "DELETE", deleting the resource is allowed.
     *
     * <a name="nestedDefaultSnatStatus"></a>The `defaultSnatStatus` block supports
     */
    readonly deletionPolicy: pulumi.Output<string>;
    /**
     * Whether Terraform will be prevented from
     * destroying the cluster.  Deleting this cluster via `terraform destroy` or
     * `pulumi up` will only succeed if this field is `false` in the Terraform
     * state.
     */
    readonly deletionProtection: pulumi.Output<boolean | undefined>;
    /**
     * Description of the cluster.
     */
    readonly description: pulumi.Output<string | undefined>;
    /**
     * Disable L4 load balancer VPC firewalls to enable firewall policies.
     */
    readonly disableL4LbFirewallReconciliation: pulumi.Output<boolean | undefined>;
    /**
     * Configuration for [Using Cloud DNS for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-dns). Structure is documented below.
     */
    readonly dnsConfig: pulumi.Output<outputs.container.ClusterDnsConfig | undefined>;
    /**
     * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
     */
    readonly effectiveLabels: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * Enable Autopilot for this cluster. Defaults to `false`.
     * Note that when this option is enabled, certain features of Standard GKE are not available.
     * See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison)
     * for available features.
     */
    readonly enableAutopilot: pulumi.Output<boolean | undefined>;
    /**
     * Whether CiliumClusterWideNetworkPolicy is enabled on this cluster. Defaults to false.
     */
    readonly enableCiliumClusterwideNetworkPolicy: pulumi.Output<boolean | undefined>;
    /**
     * Whether FQDN Network Policy is enabled on this cluster. Users who enable this feature for existing Standard clusters must restart the GKE Dataplane V2 `anetd` DaemonSet after enabling it. See the [Enable FQDN Network Policy in an existing cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/fqdn-network-policies#enable_fqdn_network_policy_in_an_existing_cluster) for more information.
     */
    readonly enableFqdnNetworkPolicy: pulumi.Output<boolean | undefined>;
    /**
     * Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
     */
    readonly enableIntranodeVisibility: pulumi.Output<boolean>;
    /**
     * Configuration for Kubernetes Beta APIs.
     * Structure is documented below.
     */
    readonly enableK8sBetaApis: pulumi.Output<outputs.container.ClusterEnableK8sBetaApis | undefined>;
    /**
     * Whether to enable Kubernetes Alpha features for
     * this cluster. Note that when this option is enabled, the cluster cannot be upgraded
     * and will be automatically deleted after 30 days.
     */
    readonly enableKubernetesAlpha: pulumi.Output<boolean | undefined>;
    /**
     * Whether L4ILB Subsetting is enabled for this cluster.
     */
    readonly enableL4IlbSubsetting: pulumi.Output<boolean>;
    /**
     * Whether the ABAC authorizer is enabled for this cluster.
     * When enabled, identities in the system, including service accounts, nodes, and controllers,
     * will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
     * Defaults to `false`
     */
    readonly enableLegacyAbac: pulumi.Output<boolean | undefined>;
    /**
     * Whether multi-networking is enabled for this cluster.
     */
    readonly enableMultiNetworking: pulumi.Output<boolean | undefined>;
    /**
     * Enable Shielded Nodes features on all nodes in this cluster.  Defaults to `true`.
     */
    readonly enableShieldedNodes: pulumi.Output<boolean | undefined>;
    /**
     * Whether to enable Cloud TPU resources in this cluster.
     * See the [official documentation](https://cloud.google.com/tpu/docs/kubernetes-engine-setup).
     */
    readonly enableTpu: pulumi.Output<boolean>;
    /**
     * The IP address of this cluster's Kubernetes master.
     */
    readonly endpoint: pulumi.Output<string>;
    /**
     * (DEPRECATED) Configuration for [Enterprise edition].(https://cloud.google.com/kubernetes-engine/enterprise/docs/concepts/gke-editions). Structure is documented below. Deprecated as GKE Enterprise features are now available without an Enterprise tier. See https://cloud.google.com/blog/products/containers-kubernetes/gke-gets-new-pricing-and-capabilities-on-10th-birthday for the announcement of this change.
     *
     * @deprecated GKE Enterprise features are now available without an Enterprise tier. This field is deprecated and will be removed in a future major release
     */
    readonly enterpriseConfig: pulumi.Output<outputs.container.ClusterEnterpriseConfig>;
    /**
     * Fleet configuration for the cluster. Structure is documented below.
     */
    readonly fleet: pulumi.Output<outputs.container.ClusterFleet | undefined>;
    /**
     * Configuration for [GKE Gateway API controller](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api). Structure is documented below.
     */
    readonly gatewayApiConfig: pulumi.Output<outputs.container.ClusterGatewayApiConfig>;
    /**
     * Configuration options for the auto-upgrade patch type feature, which provide more control over the speed of automatic upgrades of your GKE clusters.
     * Structure is documented below.
     */
    readonly gkeAutoUpgradeConfig: pulumi.Output<outputs.container.ClusterGkeAutoUpgradeConfig>;
    /**
     * . Structure is documented below.
     */
    readonly identityServiceConfig: pulumi.Output<outputs.container.ClusterIdentityServiceConfig>;
    /**
     * Whether to ignore external changes (drift) to the GKE node count (e.g. from GKE autoscaling). Setting this to `true` skips querying Compute Engine Instance Group Managers (IGMs) to determine the current node count on read, which can save API quota and speed up plans on large clusters. Unlike Terraform core's `lifecycle { ignoreChanges = [nodeCount] }`, this allows configuration-driven scaling updates in your HCL while still ignoring runtime autoscaling drift.
     */
    readonly ignoreNodeCountChanges: pulumi.Output<boolean | undefined>;
    /**
     * Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
     */
    readonly inTransitEncryptionConfig: pulumi.Output<string | undefined>;
    /**
     * The number of nodes to create in this
     * cluster's default node pool. In regional or multi-zonal clusters, this is the
     * number of nodes per zone. Must be set if `nodePool` is not set. If you're using
     * `gcp.container.NodePool` objects with no default node pool, you'll need to
     * set this to a value of at least `1`, alongside setting
     * `removeDefaultNodePool` to `true`.
     */
    readonly initialNodeCount: pulumi.Output<number | undefined>;
    /**
     * Configuration of cluster IP allocation for
     * VPC-native clusters. If this block is unset during creation, it will be set by the GKE backend.
     * Structure is documented below.
     */
    readonly ipAllocationPolicy: pulumi.Output<outputs.container.ClusterIpAllocationPolicy>;
    /**
     * The fingerprint of the set of labels for this cluster.
     */
    readonly labelFingerprint: pulumi.Output<string>;
    /**
     * The location (region or zone) in which the cluster
     * master will be created, as well as the default node location. If you specify a
     * zone (such as `us-central1-a`), the cluster will be a zonal cluster with a
     * single cluster master. If you specify a region (such as `us-west1`), the
     * cluster will be a regional cluster with multiple masters spread across zones in
     * the region, and with default node locations in those zones as well
     */
    readonly location: pulumi.Output<string>;
    /**
     * Logging configuration for the cluster.
     * Structure is documented below.
     */
    readonly loggingConfig: pulumi.Output<outputs.container.ClusterLoggingConfig>;
    /**
     * The logging service that the cluster should
     * write logs to. Available options include `logging.googleapis.com`(Legacy Stackdriver),
     * `logging.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Logging), and `none`. Defaults to `logging.googleapis.com/kubernetes`
     */
    readonly loggingService: pulumi.Output<string>;
    /**
     * The maintenance policy to use for the cluster. Structure is
     * documented below.
     */
    readonly maintenancePolicy: pulumi.Output<outputs.container.ClusterMaintenancePolicy | undefined>;
    /**
     * ) Configuration for the [GKE Managed ML Diagnostics](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/TODO) feature. Structure is documented below.
     */
    readonly managedMachineLearningDiagnosticsConfig: pulumi.Output<outputs.container.ClusterManagedMachineLearningDiagnosticsConfig>;
    /**
     * ) Configuration for the [GKE Managed OpenTelemetry](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/managed-otel-gke) feature. Structure is documented below.
     */
    readonly managedOpentelemetryConfig: pulumi.Output<outputs.container.ClusterManagedOpentelemetryConfig>;
    /**
     * The authentication information for accessing the
     * Kubernetes master. Some values in this block are only returned by the API if
     * your service account has permission to get credentials for your GKE cluster. If
     * you see an unexpected diff unsetting your client cert, ensure you have the
     * `container.clusters.getCredentials` permission.
     * Structure is documented below.
     */
    readonly masterAuth: pulumi.Output<outputs.container.ClusterMasterAuth>;
    /**
     * The desired
     * configuration options for master authorized networks. Omit the
     * nested `cidrBlocks` attribute to disallow external access (except
     * the cluster node IPs, which GKE automatically whitelists).
     * Structure is documented below.
     */
    readonly masterAuthorizedNetworksConfig: pulumi.Output<outputs.container.ClusterMasterAuthorizedNetworksConfig>;
    /**
     * The current version of the master in the cluster. This may
     * be different than the `minMasterVersion` set in the config if the master
     * has been updated by GKE.
     */
    readonly masterVersion: pulumi.Output<string>;
    /**
     * Structure is documented below.
     */
    readonly meshCertificates: pulumi.Output<outputs.container.ClusterMeshCertificates>;
    /**
     * The minimum version of the master. GKE
     * will auto-update the master to new versions, so this does not guarantee the
     * current master version--use the read-only `masterVersion` field to obtain that.
     * If unset, the cluster's version will be set by GKE to the version of the most recent
     * official release (which is not necessarily the latest version).  Most users will find
     * the `gcp.container.getEngineVersions` data source useful - it indicates which versions
     * are available. If you intend to specify versions manually,
     * [the docs](https://cloud.google.com/kubernetes-engine/versioning-and-upgrades#specifying_cluster_version)
     * describe the various acceptable formats for this field.
     *
     * > If you are using the `gcp.container.getEngineVersions` datasource with a regional cluster, ensure that you have provided a `location`
     * to the datasource. A region can have a different set of supported versions than its corresponding zones, and not all zones in a
     * region are guaranteed to support the same version.
     */
    readonly minMasterVersion: pulumi.Output<string | undefined>;
    /**
     * Monitoring configuration for the cluster.
     * Structure is documented below.
     */
    readonly monitoringConfig: pulumi.Output<outputs.container.ClusterMonitoringConfig>;
    /**
     * The monitoring service that the cluster
     * should write metrics to.
     * Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API.
     * VM metrics will be collected by Google Compute Engine regardless of this setting
     * Available options include
     * `monitoring.googleapis.com`(Legacy Stackdriver), `monitoring.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Monitoring), and `none`.
     * Defaults to `monitoring.googleapis.com/kubernetes`
     */
    readonly monitoringService: pulumi.Output<string>;
    /**
     * The name of the cluster, unique within the project and
     * location.
     *
     * ***
     */
    readonly name: pulumi.Output<string>;
    /**
     * The name or selfLink of the Google Compute Engine
     * network to which the cluster is connected. For Shared VPC, set this to the self link of the
     * shared network.
     */
    readonly network: pulumi.Output<string | undefined>;
    /**
     * Network bandwidth tier configuration.
     */
    readonly networkPerformanceConfig: pulumi.Output<outputs.container.ClusterNetworkPerformanceConfig | undefined>;
    /**
     * Configuration options for the
     * [NetworkPolicy](https://kubernetes.io/docs/concepts/services-networking/networkpolicies/)
     * feature. Structure is documented below.
     */
    readonly networkPolicy: pulumi.Output<outputs.container.ClusterNetworkPolicy | undefined>;
    /**
     * Determines whether alias IPs or routes will be used for pod IPs in the cluster.
     * Options are `VPC_NATIVE` or `ROUTES`. `VPC_NATIVE` enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases). Newly created clusters will default to `VPC_NATIVE`.
     */
    readonly networkingMode: pulumi.Output<string>;
    /**
     * Parameters used in creating the default node pool.
     * Generally, this field should not be used at the same time as a
     * `gcp.container.NodePool` or a `nodePool` block; this configuration
     * manages the default node pool, which isn't recommended to be used.
     * Structure is documented below.
     */
    readonly nodeConfig: pulumi.Output<outputs.container.ClusterNodeConfig>;
    /**
     * Configuration for [node creation config](https://clouddocs.devsite.corp.google.com/kubernetes-engine/security/control-plane-node-creation). Structure is documented below.
     */
    readonly nodeCreationConfig: pulumi.Output<outputs.container.ClusterNodeCreationConfig>;
    /**
     * The list of zones in which the cluster's nodes
     * are located. Nodes must be in the region of their regional cluster or in the
     * same region as their cluster's zone for zonal clusters. If this is specified for
     * a zonal cluster, omit the cluster's zone.
     *
     * > A "multi-zonal" cluster is a zonal cluster with at least one additional zone
     * defined; in a multi-zonal cluster, the cluster master is only present in a
     * single zone while nodes are present in each of the primary zone and the node
     * locations. In contrast, in a regional cluster, cluster master nodes are present
     * in multiple zones in the region. For that reason, regional clusters should be
     * preferred.
     */
    readonly nodeLocations: pulumi.Output<string[]>;
    /**
     * Node pool configs that apply to auto-provisioned node pools in
     * [autopilot](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison) clusters and
     * [node auto-provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)-enabled clusters. Structure is documented below.
     */
    readonly nodePoolAutoConfig: pulumi.Output<outputs.container.ClusterNodePoolAutoConfig>;
    /**
     * Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object. Structure is documented below.
     */
    readonly nodePoolDefaults: pulumi.Output<outputs.container.ClusterNodePoolDefaults>;
    /**
     * List of node pools associated with this cluster. Structure is documented below. See gcp.container.NodePool for exact schema.
     * **Warning:** node pools defined inside a cluster can't be changed (or added/removed) after
     * cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability
     * to say "these are the _only_ node pools associated with this cluster", use the
     * gcp.container.NodePool resource instead of this property.
     */
    readonly nodePools: pulumi.Output<outputs.container.ClusterNodePool[]>;
    /**
     * The Kubernetes version on the nodes. Must either be unset
     * or set to the same value as `minMasterVersion` on create. Defaults to the default
     * version set by GKE which is not necessarily the latest version. This only affects
     * nodes in the default node pool. While a fuzzy version can be specified, it's
     * recommended that you specify explicit versions as the provider will see spurious diffs
     * when fuzzy versions are used. See the `gcp.container.getEngineVersions` data source's
     * `versionPrefix` field to approximate fuzzy versions.
     * To update nodes in other node pools, use the `version` attribute on the node pool.
     */
    readonly nodeVersion: pulumi.Output<string>;
    /**
     * Configuration for the [cluster upgrade notifications](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-upgrade-notifications) feature. Structure is documented below.
     */
    readonly notificationConfig: pulumi.Output<outputs.container.ClusterNotificationConfig>;
    readonly operation: pulumi.Output<string>;
    /**
     * Configuration for the
     * Structure is documented below.
     */
    readonly podAutoscaling: pulumi.Output<outputs.container.ClusterPodAutoscaling>;
    /**
     * ) Configuration for the
     * [PodSecurityPolicy](https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies) feature.
     * Structure is documented below.
     */
    readonly podSecurityPolicyConfig: pulumi.Output<outputs.container.ClusterPodSecurityPolicyConfig | undefined>;
    /**
     * Configuration for [private clusters](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters),
     * clusters with private nodes. Structure is documented below.
     */
    readonly privateClusterConfig: pulumi.Output<outputs.container.ClusterPrivateClusterConfig>;
    /**
     * The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4).
     */
    readonly privateIpv6GoogleAccess: pulumi.Output<string>;
    /**
     * The ID of the project in which the resource belongs. If it
     * is not provided, the provider project is used.
     */
    readonly project: pulumi.Output<string>;
    /**
     * )
     * Enable/Disable Protect API features for the cluster. Structure is documented below.
     */
    readonly protectConfig: pulumi.Output<outputs.container.ClusterProtectConfig>;
    /**
     * The combination of labels configured directly on the resource and default labels configured on the provider.
     */
    readonly pulumiLabels: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created. Structure is documented below.
     */
    readonly rbacBindingConfig: pulumi.Output<outputs.container.ClusterRbacBindingConfig>;
    /**
     * Configuration options for the [Release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels)
     * feature, which provide more control over automatic upgrades of your GKE clusters.
     * When updating this field, GKE imposes specific version requirements. See
     * [Selecting a new release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels#selecting_a_new_release_channel)
     * for more details; the `gcp.container.getEngineVersions` datasource can provide
     * the default version for a channel. Note that removing the `releaseChannel`
     * field from your config will cause the provider to stop managing your cluster's
     * release channel, but will not unenroll it. Instead, use the `"UNSPECIFIED"`
     * channel. Structure is documented below.
     */
    readonly releaseChannel: pulumi.Output<outputs.container.ClusterReleaseChannel>;
    /**
     * If `true`, deletes the default node
     * pool upon cluster creation. If you're using `gcp.container.NodePool`
     * resources with no default node pool, this should be set to `true`, alongside
     * setting `initialNodeCount` to at least `1`.
     */
    readonly removeDefaultNodePool: pulumi.Output<boolean | undefined>;
    /**
     * The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
     *
     * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
     * Please refer to the field 'effective_labels' for all of the labels present on the resource.
     */
    readonly resourceLabels: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * Configuration for the
     * [ResourceUsageExportConfig](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-usage-metering) feature.
     * Structure is documented below.
     */
    readonly resourceUsageExportConfig: pulumi.Output<outputs.container.ClusterResourceUsageExportConfig | undefined>;
    /**
     * Configuration for the
     * [SecretManagerConfig](https://cloud.google.com/secret-manager/docs/secret-manager-managed-csi-component) feature.
     * Structure is documented below.
     */
    readonly secretManagerConfig: pulumi.Output<outputs.container.ClusterSecretManagerConfig | undefined>;
    /**
     * Configuration for the
     * [SecretSyncConfig](https://cloud.google.com/secret-manager/docs/sync-k8-secrets) feature.
     * Structure is documented below.
     */
    readonly secretSyncConfig: pulumi.Output<outputs.container.ClusterSecretSyncConfig | undefined>;
    /**
     * Enable/Disable Security Posture API features for the cluster. Structure is documented below.
     */
    readonly securityPostureConfig: pulumi.Output<outputs.container.ClusterSecurityPostureConfig>;
    /**
     * The server-defined URL for the resource.
     */
    readonly selfLink: pulumi.Output<string>;
    /**
     * Structure is documented below.
     */
    readonly serviceExternalIpsConfig: pulumi.Output<outputs.container.ClusterServiceExternalIpsConfig>;
    /**
     * The IP address range of the Kubernetes services in this
     * cluster, in [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
     * notation (e.g. `1.2.3.4/29`). Service addresses are typically put in the last
     * `/16` from the container CIDR.
     */
    readonly servicesIpv4Cidr: pulumi.Output<string>;
    /**
     * Whether to skip refreshing the GKE cluster's inline node pool list during read operations. Setting this to `true` prevents the provider from querying GKE API for node pools, resolving long plan times on clusters with a large number of node pools. **Warning:** When enabled, the cluster's `nodePool` attribute in the Terraform state will remain empty (`[]`), even if node pools exist externally. This flag cannot be set to `true` if you define inline `nodePool` blocks in your configuration; doing so will result in a validation error during plan.
     */
    readonly skipNodePoolRefresh: pulumi.Output<boolean | undefined>;
    /**
     * The name or selfLink of the Google Compute Engine
     * subnetwork in which the cluster's instances are launched.
     */
    readonly subnetwork: pulumi.Output<string>;
    /**
     * TPU configuration for the cluster.
     */
    readonly tpuConfig: pulumi.Output<outputs.container.ClusterTpuConfig>;
    /**
     * The IP address range of the Cloud TPUs in this cluster, in
     * [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
     * notation (e.g. `1.2.3.4/29`).
     */
    readonly tpuIpv4CidrBlock: pulumi.Output<string>;
    /**
     * The custom keys configuration of the cluster Structure is documented below.
     */
    readonly userManagedKeysConfig: pulumi.Output<outputs.container.ClusterUserManagedKeysConfig | undefined>;
    /**
     * Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it.
     * Structure is documented below.
     */
    readonly verticalPodAutoscaling: pulumi.Output<outputs.container.ClusterVerticalPodAutoscaling>;
    /**
     * )
     * Configuration for [direct-path (via ALTS) with workload identity.](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#workloadaltsconfig). Structure is documented below.
     */
    readonly workloadAltsConfig: pulumi.Output<outputs.container.ClusterWorkloadAltsConfig>;
    /**
     * Workload Identity allows Kubernetes service accounts to act as a user-managed
     * [Google IAM Service Account](https://cloud.google.com/iam/docs/service-accounts#user-managed_service_accounts).
     * Structure is documented below.
     */
    readonly workloadIdentityConfig: pulumi.Output<outputs.container.ClusterWorkloadIdentityConfig>;
    /**
     * Create a Cluster resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args?: ClusterArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering Cluster resources.
 */
export interface ClusterState {
    /**
     * The configuration for addons supported by GKE.
     * Structure is documented below.
     */
    addonsConfig?: pulumi.Input<inputs.container.ClusterAddonsConfig | undefined>;
    /**
     * Enable NET_ADMIN for the cluster. Defaults to
     * `false`. This field should only be enabled for Autopilot clusters (`enableAutopilot`
     * set to `true`).
     */
    allowNetAdmin?: pulumi.Input<boolean | undefined>;
    /**
     * Configuration for [anonymous authentication restrictions](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#restrict-anon-access). Structure is documented below.
     */
    anonymousAuthenticationConfig?: pulumi.Input<inputs.container.ClusterAnonymousAuthenticationConfig | undefined>;
    /**
     * Configuration for the
     * [Google Groups for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#groups-setup-gsuite) feature.
     * Structure is documented below.
     */
    authenticatorGroupsConfig?: pulumi.Input<inputs.container.ClusterAuthenticatorGroupsConfig | undefined>;
    /**
     * Per-cluster configuration of Autopilot cluster policies in GKE clusters. This field can only be configured in non Autopilot clusters. Structure is documented below.
     */
    autopilotClusterPolicyConfig?: pulumi.Input<inputs.container.ClusterAutopilotClusterPolicyConfig | undefined>;
    /**
     * The customer
     * allowlist Cloud Storage paths for the cluster. These paths are used with the
     * `--autopilot-privileged-admission` flag to authorize privileged workloads in
     * Autopilot clusters. See the Cluster API's
     * [PrivilegedAdmissionConfig](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#privilegedadmissionconfig)
     * documentation for more details.
     */
    autopilotPrivilegedAdmissions?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * Configuration options for the Binary
     * Authorization feature. Structure is documented below.
     */
    binaryAuthorization?: pulumi.Input<inputs.container.ClusterBinaryAuthorization | undefined>;
    /**
     * Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to
     * automatically adjust the size of the cluster and create/delete node pools based
     * on the current needs of the cluster's workload. See the
     * [guide to using Node Auto-Provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)
     * for more details. Structure is documented below.
     */
    clusterAutoscaling?: pulumi.Input<inputs.container.ClusterClusterAutoscaling | undefined>;
    /**
     * The IP address range of the Kubernetes pods
     * in this cluster in CIDR notation (e.g. `10.96.0.0/14`). Leave blank to have one
     * automatically chosen or specify a `/14` block in `10.0.0.0/8`. This field will
     * default a new cluster to routes-based, where `ipAllocationPolicy` is not defined.
     */
    clusterIpv4Cidr?: pulumi.Input<string | undefined>;
    /**
     * ) Configuration for
     * [ClusterTelemetry](https://cloud.google.com/monitoring/kubernetes-engine/installing#controlling_the_collection_of_application_logs) feature,
     * Structure is documented below.
     */
    clusterTelemetry?: pulumi.Input<inputs.container.ClusterClusterTelemetry | undefined>;
    /**
     * Configuration for [Confidential Nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes) feature. Structure is documented below documented below.
     */
    confidentialNodes?: pulumi.Input<inputs.container.ClusterConfidentialNodes | undefined>;
    /**
     * Configuration for all of the cluster's control plane endpoints.
     * Structure is documented below.
     */
    controlPlaneEndpointsConfig?: pulumi.Input<inputs.container.ClusterControlPlaneEndpointsConfig | undefined>;
    /**
     * Configuration for the
     * [Cost Allocation](https://cloud.google.com/kubernetes-engine/docs/how-to/cost-allocations) feature.
     * Structure is documented below.
     */
    costManagementConfig?: pulumi.Input<inputs.container.ClusterCostManagementConfig | undefined>;
    /**
     * Structure is documented below.
     */
    databaseEncryption?: pulumi.Input<inputs.container.ClusterDatabaseEncryption | undefined>;
    /**
     * The desired datapath provider for this cluster. This is set to `LEGACY_DATAPATH` by default, which uses the IPTables-based kube-proxy implementation. Set to `ADVANCED_DATAPATH` to enable Dataplane v2.
     */
    datapathProvider?: pulumi.Input<string | undefined>;
    /**
     * The dataplane optimization mode for the cluster. Possible values: `SCALE_OPTIMIZED`.
     */
    dataplaneOptimizationMode?: pulumi.Input<string | undefined>;
    /**
     * The default maximum number of pods
     * per node in this cluster. This doesn't work on "routes-based" clusters, clusters
     * that don't have IP Aliasing enabled. See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr)
     * for more information.
     */
    defaultMaxPodsPerNode?: pulumi.Input<number | undefined>;
    /**
     * [GKE SNAT](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#how_ipmasq_works) DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster, [API doc](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#networkconfig). Structure is documented below
     */
    defaultSnatStatus?: pulumi.Input<inputs.container.ClusterDefaultSnatStatus | undefined>;
    /**
     * (Optional) Whether Terraform will be prevented from destroying the resource. Defaults to "DELETE".
     * When a 'terraform destroy' or 'pulumi up' would delete the resource,
     * the command will fail if this field is set to "PREVENT" in Terraform state.
     * When set to "ABANDON", the command will remove the resource from Terraform
     * management without updating or deleting the resource in the API.
     * When set to "DELETE", deleting the resource is allowed.
     *
     * <a name="nestedDefaultSnatStatus"></a>The `defaultSnatStatus` block supports
     */
    deletionPolicy?: pulumi.Input<string | undefined>;
    /**
     * Whether Terraform will be prevented from
     * destroying the cluster.  Deleting this cluster via `terraform destroy` or
     * `pulumi up` will only succeed if this field is `false` in the Terraform
     * state.
     */
    deletionProtection?: pulumi.Input<boolean | undefined>;
    /**
     * Description of the cluster.
     */
    description?: pulumi.Input<string | undefined>;
    /**
     * Disable L4 load balancer VPC firewalls to enable firewall policies.
     */
    disableL4LbFirewallReconciliation?: pulumi.Input<boolean | undefined>;
    /**
     * Configuration for [Using Cloud DNS for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-dns). Structure is documented below.
     */
    dnsConfig?: pulumi.Input<inputs.container.ClusterDnsConfig | undefined>;
    /**
     * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
     */
    effectiveLabels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    } | undefined>;
    /**
     * Enable Autopilot for this cluster. Defaults to `false`.
     * Note that when this option is enabled, certain features of Standard GKE are not available.
     * See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison)
     * for available features.
     */
    enableAutopilot?: pulumi.Input<boolean | undefined>;
    /**
     * Whether CiliumClusterWideNetworkPolicy is enabled on this cluster. Defaults to false.
     */
    enableCiliumClusterwideNetworkPolicy?: pulumi.Input<boolean | undefined>;
    /**
     * Whether FQDN Network Policy is enabled on this cluster. Users who enable this feature for existing Standard clusters must restart the GKE Dataplane V2 `anetd` DaemonSet after enabling it. See the [Enable FQDN Network Policy in an existing cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/fqdn-network-policies#enable_fqdn_network_policy_in_an_existing_cluster) for more information.
     */
    enableFqdnNetworkPolicy?: pulumi.Input<boolean | undefined>;
    /**
     * Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
     */
    enableIntranodeVisibility?: pulumi.Input<boolean | undefined>;
    /**
     * Configuration for Kubernetes Beta APIs.
     * Structure is documented below.
     */
    enableK8sBetaApis?: pulumi.Input<inputs.container.ClusterEnableK8sBetaApis | undefined>;
    /**
     * Whether to enable Kubernetes Alpha features for
     * this cluster. Note that when this option is enabled, the cluster cannot be upgraded
     * and will be automatically deleted after 30 days.
     */
    enableKubernetesAlpha?: pulumi.Input<boolean | undefined>;
    /**
     * Whether L4ILB Subsetting is enabled for this cluster.
     */
    enableL4IlbSubsetting?: pulumi.Input<boolean | undefined>;
    /**
     * Whether the ABAC authorizer is enabled for this cluster.
     * When enabled, identities in the system, including service accounts, nodes, and controllers,
     * will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
     * Defaults to `false`
     */
    enableLegacyAbac?: pulumi.Input<boolean | undefined>;
    /**
     * Whether multi-networking is enabled for this cluster.
     */
    enableMultiNetworking?: pulumi.Input<boolean | undefined>;
    /**
     * Enable Shielded Nodes features on all nodes in this cluster.  Defaults to `true`.
     */
    enableShieldedNodes?: pulumi.Input<boolean | undefined>;
    /**
     * Whether to enable Cloud TPU resources in this cluster.
     * See the [official documentation](https://cloud.google.com/tpu/docs/kubernetes-engine-setup).
     */
    enableTpu?: pulumi.Input<boolean | undefined>;
    /**
     * The IP address of this cluster's Kubernetes master.
     */
    endpoint?: pulumi.Input<string | undefined>;
    /**
     * (DEPRECATED) Configuration for [Enterprise edition].(https://cloud.google.com/kubernetes-engine/enterprise/docs/concepts/gke-editions). Structure is documented below. Deprecated as GKE Enterprise features are now available without an Enterprise tier. See https://cloud.google.com/blog/products/containers-kubernetes/gke-gets-new-pricing-and-capabilities-on-10th-birthday for the announcement of this change.
     *
     * @deprecated GKE Enterprise features are now available without an Enterprise tier. This field is deprecated and will be removed in a future major release
     */
    enterpriseConfig?: pulumi.Input<inputs.container.ClusterEnterpriseConfig | undefined>;
    /**
     * Fleet configuration for the cluster. Structure is documented below.
     */
    fleet?: pulumi.Input<inputs.container.ClusterFleet | undefined>;
    /**
     * Configuration for [GKE Gateway API controller](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api). Structure is documented below.
     */
    gatewayApiConfig?: pulumi.Input<inputs.container.ClusterGatewayApiConfig | undefined>;
    /**
     * Configuration options for the auto-upgrade patch type feature, which provide more control over the speed of automatic upgrades of your GKE clusters.
     * Structure is documented below.
     */
    gkeAutoUpgradeConfig?: pulumi.Input<inputs.container.ClusterGkeAutoUpgradeConfig | undefined>;
    /**
     * . Structure is documented below.
     */
    identityServiceConfig?: pulumi.Input<inputs.container.ClusterIdentityServiceConfig | undefined>;
    /**
     * Whether to ignore external changes (drift) to the GKE node count (e.g. from GKE autoscaling). Setting this to `true` skips querying Compute Engine Instance Group Managers (IGMs) to determine the current node count on read, which can save API quota and speed up plans on large clusters. Unlike Terraform core's `lifecycle { ignoreChanges = [nodeCount] }`, this allows configuration-driven scaling updates in your HCL