import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Manages a Google Kubernetes Engine (GKE) cluster.
 *
 * To get more information about GKE clusters, see:
 *   * [The API reference](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters)
 *   * How-to guides
 *     * [GKE overview](https://cloud.google.com/kubernetes-engine/docs/concepts/kubernetes-engine-overview)
 *     * [About cluster configuration choices](https://cloud.google.com/kubernetes-engine/docs/concepts/types-of-clusters)
 *
 * > On version 5.0.0+ of the provider, you must explicitly set `deletionProtection = false`
 * and run `pulumi up` to write the field to state in order to destroy a cluster.
 *
 * > All arguments and attributes (including certificate outputs) will be stored in the raw state as
 * plaintext. [Read more about secrets in state](https://www.pulumi.com/docs/intro/concepts/programming-model/#secrets).
 *
 * ## Example Usage
 *
 * ### With A Separately Managed Node Pool (Recommended)
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.serviceaccount.Account("default", {
 *     accountId: "service-account-id",
 *     displayName: "Service Account",
 * });
 * const primary = new gcp.container.Cluster("primary", {
 *     name: "my-gke-cluster",
 *     location: "us-central1",
 *     removeDefaultNodePool: true,
 *     initialNodeCount: 1,
 * });
 * const primaryPreemptibleNodes = new gcp.container.NodePool("primary_preemptible_nodes", {
 *     name: "my-node-pool",
 *     location: "us-central1",
 *     cluster: primary.name,
 *     nodeCount: 1,
 *     nodeConfig: {
 *         preemptible: true,
 *         machineType: "e2-medium",
 *         serviceAccount: _default.email,
 *         oauthScopes: ["https://www.googleapis.com/auth/cloud-platform"],
 *     },
 * });
 * ```
 *
 * > **Note:** It is recommended that node pools be created and managed as separate resources as in the example above.
 * This allows node pools to be added and removed without recreating the cluster.  Node pools defined directly in the
 * `gcp.container.Cluster` resource cannot be removed without re-creating the cluster.
 *
 * ### With The Default Node Pool
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.serviceaccount.Account("default", {
 *     accountId: "service-account-id",
 *     displayName: "Service Account",
 * });
 * const primary = new gcp.container.Cluster("primary", {
 *     name: "marcellus-wallace",
 *     location: "us-central1-a",
 *     initialNodeCount: 3,
 *     nodeConfig: {
 *         serviceAccount: _default.email,
 *         oauthScopes: ["https://www.googleapis.com/auth/cloud-platform"],
 *         labels: {
 *             foo: "bar",
 *         },
 *         tags: [
 *             "foo",
 *             "bar",
 *         ],
 *     },
 * });
 * ```
 *
 * ### Autopilot
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const _default = new gcp.serviceaccount.Account("default", {
 *     accountId: "service-account-id",
 *     displayName: "Service Account",
 * });
 * const primary = new gcp.container.Cluster("primary", {
 *     name: "marcellus-wallace",
 *     location: "us-central1-a",
 *     enableAutopilot: true,
 * });
 * ```
 *
 * ## Import
 *
 * GKE clusters can be imported using the `project` , `location`, and `name`. If the project is omitted, the default
 *
 * provider value will be used. Examples:
 *
 * * `projects/{{project_id}}/locations/{{location}}/clusters/{{cluster_id}}`
 *
 * * `{{project_id}}/{{location}}/{{cluster_id}}`
 *
 * * `{{location}}/{{cluster_id}}`
 *
 * When using the `pulumi import` command, GKE clusters can be imported using one of the formats above. For example:
 *
 * ```sh
 * $ pulumi import gcp:container/cluster:Cluster default projects/{{project_id}}/locations/{{location}}/clusters/{{cluster_id}}
 * ```
 *
 * ```sh
 * $ pulumi import gcp:container/cluster:Cluster default {{project_id}}/{{location}}/{{cluster_id}}
 * ```
 *
 * ```sh
 * $ pulumi import gcp:container/cluster:Cluster default {{location}}/{{cluster_id}}
 * ```
 *
 * For example, the following fields will show diffs if set in config:
 *
 * - `min_master_version`
 *
 * - `remove_default_node_pool`
 */
export declare class Cluster extends pulumi.CustomResource {
    /**
     * Get an existing Cluster resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ClusterState, opts?: pulumi.CustomResourceOptions): Cluster;
    /**
     * Returns true if the given object is an instance of Cluster.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is Cluster;
    /**
     * The configuration for addons supported by GKE.
     * Structure is documented below.
     */
    readonly addonsConfig: pulumi.Output<outputs.container.ClusterAddonsConfig>;
    /**
     * Enable NET_ADMIN for the cluster. Defaults to
     * `false`. This field should only be enabled for Autopilot clusters (`enableAutopilot`
     * set to `true`).
     */
    readonly allowNetAdmin: pulumi.Output<boolean | undefined>;
    /**
     * Configuration for [anonymous authentication restrictions](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#restrict-anon-access). Structure is documented below.
     */
    readonly anonymousAuthenticationConfig: pulumi.Output<outputs.container.ClusterAnonymousAuthenticationConfig>;
    /**
     * Configuration for the
     * [Google Groups for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#groups-setup-gsuite) feature.
     * Structure is documented below.
     */
    readonly authenticatorGroupsConfig: pulumi.Output<outputs.container.ClusterAuthenticatorGroupsConfig>;
    /**
     * Configuration options for the Binary
     * Authorization feature. Structure is documented below.
     */
    readonly binaryAuthorization: pulumi.Output<outputs.container.ClusterBinaryAuthorization | undefined>;
    /**
     * Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to
     * automatically adjust the size of the cluster and create/delete node pools based
     * on the current needs of the cluster's workload. See the
     * [guide to using Node Auto-Provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)
     * for more details. Structure is documented below.
     */
    readonly clusterAutoscaling: pulumi.Output<outputs.container.ClusterClusterAutoscaling>;
    /**
     * The IP address range of the Kubernetes pods
     * in this cluster in CIDR notation (e.g. `10.96.0.0/14`). Leave blank to have one
     * automatically chosen or specify a `/14` block in `10.0.0.0/8`. This field will
     * default a new cluster to routes-based, where `ipAllocationPolicy` is not defined.
     */
    readonly clusterIpv4Cidr: pulumi.Output<string>;
    /**
     * Configuration for
     * [ClusterTelemetry](https://cloud.google.com/monitoring/kubernetes-engine/installing#controlling_the_collection_of_application_logs) feature,
     * Structure is documented below.
     */
    readonly clusterTelemetry: pulumi.Output<outputs.container.ClusterClusterTelemetry>;
    /**
     * Configuration for [Confidential Nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes) feature. Structure is documented below documented below.
     */
    readonly confidentialNodes: pulumi.Output<outputs.container.ClusterConfidentialNodes>;
    /**
     * Configuration for all of the cluster's control plane endpoints.
     * Structure is documented below.
     */
    readonly controlPlaneEndpointsConfig: pulumi.Output<outputs.container.ClusterControlPlaneEndpointsConfig>;
    /**
     * Configuration for the
     * [Cost Allocation](https://cloud.google.com/kubernetes-engine/docs/how-to/cost-allocations) feature.
     * Structure is documented below.
     */
    readonly costManagementConfig: pulumi.Output<outputs.container.ClusterCostManagementConfig>;
    /**
     * Structure is documented below.
     */
    readonly databaseEncryption: pulumi.Output<outputs.container.ClusterDatabaseEncryption>;
    /**
     * The desired datapath provider for this cluster. This is set to `LEGACY_DATAPATH` by default, which uses the IPTables-based kube-proxy implementation. Set to `ADVANCED_DATAPATH` to enable Dataplane v2.
     */
    readonly datapathProvider: pulumi.Output<string>;
    /**
     * The default maximum number of pods
     * per node in this cluster. This doesn't work on "routes-based" clusters, clusters
     * that don't have IP Aliasing enabled. See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr)
     * for more information.
     */
    readonly defaultMaxPodsPerNode: pulumi.Output<number>;
    /**
     * [GKE SNAT](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#how_ipmasq_works) DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster, [API doc](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#networkconfig). Structure is documented below
     */
    readonly defaultSnatStatus: pulumi.Output<outputs.container.ClusterDefaultSnatStatus>;
    readonly deletionProtection: pulumi.Output<boolean | undefined>;
    /**
     * Description of the cluster.
     */
    readonly description: pulumi.Output<string | undefined>;
    /**
     * Disable L4 load balancer VPC firewalls to enable firewall policies.
     */
    readonly disableL4LbFirewallReconciliation: pulumi.Output<boolean | undefined>;
    /**
     * Configuration for [Using Cloud DNS for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-dns). Structure is documented below.
     */
    readonly dnsConfig: pulumi.Output<outputs.container.ClusterDnsConfig | undefined>;
    /**
     * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
     */
    readonly effectiveLabels: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * Enable Autopilot for this cluster. Defaults to `false`.
     * Note that when this option is enabled, certain features of Standard GKE are not available.
     * See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison)
     * for available features.
     */
    readonly enableAutopilot: pulumi.Output<boolean | undefined>;
    /**
     * Whether CiliumClusterWideNetworkPolicy is enabled on this cluster. Defaults to false.
     */
    readonly enableCiliumClusterwideNetworkPolicy: pulumi.Output<boolean | undefined>;
    /**
     * Whether FQDN Network Policy is enabled on this cluster. Users who enable this feature for existing Standard clusters must restart the GKE Dataplane V2 `anetd` DaemonSet after enabling it. See the [Enable FQDN Network Policy in an existing cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/fqdn-network-policies#enable_fqdn_network_policy_in_an_existing_cluster) for more information.
     */
    readonly enableFqdnNetworkPolicy: pulumi.Output<boolean | undefined>;
    /**
     * Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
     */
    readonly enableIntranodeVisibility: pulumi.Output<boolean>;
    /**
     * Configuration for Kubernetes Beta APIs.
     * Structure is documented below.
     */
    readonly enableK8sBetaApis: pulumi.Output<outputs.container.ClusterEnableK8sBetaApis | undefined>;
    /**
     * Whether to enable Kubernetes Alpha features for
     * this cluster. Note that when this option is enabled, the cluster cannot be upgraded
     * and will be automatically deleted after 30 days.
     */
    readonly enableKubernetesAlpha: pulumi.Output<boolean | undefined>;
    /**
     * Whether L4ILB Subsetting is enabled for this cluster.
     */
    readonly enableL4IlbSubsetting: pulumi.Output<boolean | undefined>;
    /**
     * Whether the ABAC authorizer is enabled for this cluster.
     * When enabled, identities in the system, including service accounts, nodes, and controllers,
     * will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
     * Defaults to `false`
     */
    readonly enableLegacyAbac: pulumi.Output<boolean | undefined>;
    /**
     * Whether multi-networking is enabled for this cluster.
     */
    readonly enableMultiNetworking: pulumi.Output<boolean | undefined>;
    /**
     * Enable Shielded Nodes features on all nodes in this cluster.  Defaults to `true`.
     */
    readonly enableShieldedNodes: pulumi.Output<boolean | undefined>;
    /**
     * Whether to enable Cloud TPU resources in this cluster.
     * See the [official documentation](https://cloud.google.com/tpu/docs/kubernetes-engine-setup).
     */
    readonly enableTpu: pulumi.Output<boolean>;
    /**
     * The IP address of this cluster's Kubernetes master.
     */
    readonly endpoint: pulumi.Output<string>;
    /**
     * (DEPRECATED) Configuration for [Enterprise edition].(https://cloud.google.com/kubernetes-engine/enterprise/docs/concepts/gke-editions). Structure is documented below. Deprecated as GKE Enterprise features are now available without an Enterprise tier. See https://cloud.google.com/blog/products/containers-kubernetes/gke-gets-new-pricing-and-capabilities-on-10th-birthday for the announcement of this change.
     *
     * @deprecated GKE Enterprise features are now available without an Enterprise tier. This field is deprecated and will be removed in a future major release
     */
    readonly enterpriseConfig: pulumi.Output<outputs.container.ClusterEnterpriseConfig>;
    /**
     * Fleet configuration for the cluster. Structure is documented below.
     */
    readonly fleet: pulumi.Output<outputs.container.ClusterFleet | undefined>;
    /**
     * Configuration for [GKE Gateway API controller](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api). Structure is documented below.
     */
    readonly gatewayApiConfig: pulumi.Output<outputs.container.ClusterGatewayApiConfig>;
    /**
     * Configuration options for the auto-upgrade patch type feature, which provide more control over the speed of automatic upgrades of your GKE clusters.
     * Structure is documented below.
     */
    readonly gkeAutoUpgradeConfig: pulumi.Output<outputs.container.ClusterGkeAutoUpgradeConfig>;
    /**
     * . Structure is documented below.
     */
    readonly identityServiceConfig: pulumi.Output<outputs.container.ClusterIdentityServiceConfig>;
    /**
     * Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
     */
    readonly inTransitEncryptionConfig: pulumi.Output<string | undefined>;
    /**
     * The number of nodes to create in this
     * cluster's default node pool. In regional or multi-zonal clusters, this is the
     * number of nodes per zone. Must be set if `nodePool` is not set. If you're using
     * `gcp.container.NodePool` objects with no default node pool, you'll need to
     * set this to a value of at least `1`, alongside setting
     * `removeDefaultNodePool` to `true`.
     */
    readonly initialNodeCount: pulumi.Output<number | undefined>;
    /**
     * Configuration of cluster IP allocation for
     * VPC-native clusters. If this block is unset during creation, it will be set by the GKE backend.
     * Structure is documented below.
     */
    readonly ipAllocationPolicy: pulumi.Output<outputs.container.ClusterIpAllocationPolicy>;
    /**
     * The fingerprint of the set of labels for this cluster.
     */
    readonly labelFingerprint: pulumi.Output<string>;
    /**
     * The location (region or zone) in which the cluster
     * master will be created, as well as the default node location. If you specify a
     * zone (such as `us-central1-a`), the cluster will be a zonal cluster with a
     * single cluster master. If you specify a region (such as `us-west1`), the
     * cluster will be a regional cluster with multiple masters spread across zones in
     * the region, and with default node locations in those zones as well
     */
    readonly location: pulumi.Output<string>;
    /**
     * Logging configuration for the cluster.
     * Structure is documented below.
     */
    readonly loggingConfig: pulumi.Output<outputs.container.ClusterLoggingConfig>;
    /**
     * The logging service that the cluster should
     * write logs to. Available options include `logging.googleapis.com`(Legacy Stackdriver),
     * `logging.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Logging), and `none`. Defaults to `logging.googleapis.com/kubernetes`
     */
    readonly loggingService: pulumi.Output<string>;
    /**
     * The maintenance policy to use for the cluster. Structure is
     * documented below.
     */
    readonly maintenancePolicy: pulumi.Output<outputs.container.ClusterMaintenancePolicy | undefined>;
    /**
     * The authentication information for accessing the
     * Kubernetes master. Some values in this block are only returned by the API if
     * your service account has permission to get credentials for your GKE cluster. If
     * you see an unexpected diff unsetting your client cert, ensure you have the
     * `container.clusters.getCredentials` permission.
     * Structure is documented below.
     */
    readonly masterAuth: pulumi.Output<outputs.container.ClusterMasterAuth>;
    /**
     * The desired
     * configuration options for master authorized networks. Omit the
     * nested `cidrBlocks` attribute to disallow external access (except
     * the cluster node IPs, which GKE automatically whitelists).
     * Structure is documented below.
     */
    readonly masterAuthorizedNetworksConfig: pulumi.Output<outputs.container.ClusterMasterAuthorizedNetworksConfig>;
    /**
     * The current version of the master in the cluster. This may
     * be different than the `minMasterVersion` set in the config if the master
     * has been updated by GKE.
     */
    readonly masterVersion: pulumi.Output<string>;
    /**
     * Structure is documented below.
     */
    readonly meshCertificates: pulumi.Output<outputs.container.ClusterMeshCertificates>;
    /**
     * The minimum version of the master. GKE
     * will auto-update the master to new versions, so this does not guarantee the
     * current master version--use the read-only `masterVersion` field to obtain that.
     * If unset, the cluster's version will be set by GKE to the version of the most recent
     * official release (which is not necessarily the latest version).  Most users will find
     * the `gcp.container.getEngineVersions` data source useful - it indicates which versions
     * are available. If you intend to specify versions manually,
     * [the docs](https://cloud.google.com/kubernetes-engine/versioning-and-upgrades#specifying_cluster_version)
     * describe the various acceptable formats for this field.
     *
     * > If you are using the `gcp.container.getEngineVersions` datasource with a regional cluster, ensure that you have provided a `location`
     * to the datasource. A region can have a different set of supported versions than its corresponding zones, and not all zones in a
     * region are guaranteed to support the same version.
     */
    readonly minMasterVersion: pulumi.Output<string | undefined>;
    /**
     * Monitoring configuration for the cluster.
     * Structure is documented below.
     */
    readonly monitoringConfig: pulumi.Output<outputs.container.ClusterMonitoringConfig>;
    /**
     * The monitoring service that the cluster
     * should write metrics to.
     * Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API.
     * VM metrics will be collected by Google Compute Engine regardless of this setting
     * Available options include
     * `monitoring.googleapis.com`(Legacy Stackdriver), `monitoring.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Monitoring), and `none`.
     * Defaults to `monitoring.googleapis.com/kubernetes`
     */
    readonly monitoringService: pulumi.Output<string>;
    /**
     * The name of the cluster, unique within the project and
     * location.
     *
     * - - -
     */
    readonly name: pulumi.Output<string>;
    /**
     * The name or selfLink of the Google Compute Engine
     * network to which the cluster is connected. For Shared VPC, set this to the self link of the
     * shared network.
     */
    readonly network: pulumi.Output<string | undefined>;
    /**
     * Network bandwidth tier configuration.
     */
    readonly networkPerformanceConfig: pulumi.Output<outputs.container.ClusterNetworkPerformanceConfig | undefined>;
    /**
     * Configuration options for the
     * [NetworkPolicy](https://kubernetes.io/docs/concepts/services-networking/networkpolicies/)
     * feature. Structure is documented below.
     */
    readonly networkPolicy: pulumi.Output<outputs.container.ClusterNetworkPolicy | undefined>;
    /**
     * Determines whether alias IPs or routes will be used for pod IPs in the cluster.
     * Options are `VPC_NATIVE` or `ROUTES`. `VPC_NATIVE` enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases). Newly created clusters will default to `VPC_NATIVE`.
     */
    readonly networkingMode: pulumi.Output<string>;
    /**
     * Parameters used in creating the default node pool.
     * Generally, this field should not be used at the same time as a
     * `gcp.container.NodePool` or a `nodePool` block; this configuration
     * manages the default node pool, which isn't recommended to be used.
     * Structure is documented below.
     */
    readonly nodeConfig: pulumi.Output<outputs.container.ClusterNodeConfig>;
    /**
     * The list of zones in which the cluster's nodes
     * are located. Nodes must be in the region of their regional cluster or in the
     * same region as their cluster's zone for zonal clusters. If this is specified for
     * a zonal cluster, omit the cluster's zone.
     *
     * > A "multi-zonal" cluster is a zonal cluster with at least one additional zone
     * defined; in a multi-zonal cluster, the cluster master is only present in a
     * single zone while nodes are present in each of the primary zone and the node
     * locations. In contrast, in a regional cluster, cluster master nodes are present
     * in multiple zones in the region. For that reason, regional clusters should be
     * preferred.
     */
    readonly nodeLocations: pulumi.Output<string[]>;
    /**
     * Node pool configs that apply to auto-provisioned node pools in
     * [autopilot](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison) clusters and
     * [node auto-provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)-enabled clusters. Structure is documented below.
     */
    readonly nodePoolAutoConfig: pulumi.Output<outputs.container.ClusterNodePoolAutoConfig>;
    /**
     * Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object. Structure is documented below.
     */
    readonly nodePoolDefaults: pulumi.Output<outputs.container.ClusterNodePoolDefaults>;
    /**
     * List of node pools associated with this cluster.
     * See gcp.container.NodePool for schema.
     * **Warning:** node pools defined inside a cluster can't be changed (or added/removed) after
     * cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability
     * to say "these are the _only_ node pools associated with this cluster", use the
     * gcp.container.NodePool resource instead of this property.
     */
    readonly nodePools: pulumi.Output<outputs.container.ClusterNodePool[]>;
    /**
     * The Kubernetes version on the nodes. Must either be unset
     * or set to the same value as `minMasterVersion` on create. Defaults to the default
     * version set by GKE which is not necessarily the latest version. This only affects
     * nodes in the default node pool. While a fuzzy version can be specified, it's
     * recommended that you specify explicit versions as the provider will see spurious diffs
     * when fuzzy versions are used. See the `gcp.container.getEngineVersions` data source's
     * `versionPrefix` field to approximate fuzzy versions.
     * To update nodes in other node pools, use the `version` attribute on the node pool.
     */
    readonly nodeVersion: pulumi.Output<string>;
    /**
     * Configuration for the [cluster upgrade notifications](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-upgrade-notifications) feature. Structure is documented below.
     */
    readonly notificationConfig: pulumi.Output<outputs.container.ClusterNotificationConfig>;
    readonly operation: pulumi.Output<string>;
    /**
     * Configuration for the
     * Structure is documented below.
     */
    readonly podAutoscaling: pulumi.Output<outputs.container.ClusterPodAutoscaling>;
    /**
     * Configuration for the
     * [PodSecurityPolicy](https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies) feature.
     * Structure is documented below.
     */
    readonly podSecurityPolicyConfig: pulumi.Output<outputs.container.ClusterPodSecurityPolicyConfig | undefined>;
    /**
     * Configuration for [private clusters](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters),
     * clusters with private nodes. Structure is documented below.
     */
    readonly privateClusterConfig: pulumi.Output<outputs.container.ClusterPrivateClusterConfig>;
    /**
     * The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4).
     */
    readonly privateIpv6GoogleAccess: pulumi.Output<string>;
    /**
     * The ID of the project in which the resource belongs. If it
     * is not provided, the provider project is used.
     */
    readonly project: pulumi.Output<string>;
    /**
     * Enable/Disable Protect API features for the cluster. Structure is documented below.
     */
    readonly protectConfig: pulumi.Output<outputs.container.ClusterProtectConfig>;
    /**
     * The combination of labels configured directly on the resource and default labels configured on the provider.
     */
    readonly pulumiLabels: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created. Structure is documented below.
     *
     * <a name="nestedDefaultSnatStatus"></a>The `defaultSnatStatus` block supports
     */
    readonly rbacBindingConfig: pulumi.Output<outputs.container.ClusterRbacBindingConfig>;
    /**
     * Configuration options for the [Release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels)
     * feature, which provide more control over automatic upgrades of your GKE clusters.
     * When updating this field, GKE imposes specific version requirements. See
     * [Selecting a new release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels#selecting_a_new_release_channel)
     * for more details; the `gcp.container.getEngineVersions` datasource can provide
     * the default version for a channel. Note that removing the `releaseChannel`
     * field from your config will cause the provider to stop managing your cluster's
     * release channel, but will not unenroll it. Instead, use the `"UNSPECIFIED"`
     * channel. Structure is documented below.
     */
    readonly releaseChannel: pulumi.Output<outputs.container.ClusterReleaseChannel>;
    /**
     * If `true`, deletes the default node
     * pool upon cluster creation. If you're using `gcp.container.NodePool`
     * resources with no default node pool, this should be set to `true`, alongside
     * setting `initialNodeCount` to at least `1`.
     */
    readonly removeDefaultNodePool: pulumi.Output<boolean | undefined>;
    /**
     * The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
     *
     * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
     * Please refer to the field 'effective_labels' for all of the labels present on the resource.
     */
    readonly resourceLabels: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * Configuration for the
     * [ResourceUsageExportConfig](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-usage-metering) feature.
     * Structure is documented below.
     */
    readonly resourceUsageExportConfig: pulumi.Output<outputs.container.ClusterResourceUsageExportConfig | undefined>;
    /**
     * Configuration for the
     * [SecretManagerConfig](https://cloud.google.com/secret-manager/docs/secret-manager-managed-csi-component) feature.
     * Structure is documented below.
     */
    readonly secretManagerConfig: pulumi.Output<outputs.container.ClusterSecretManagerConfig | undefined>;
    /**
     * Enable/Disable Security Posture API features for the cluster. Structure is documented below.
     */
    readonly securityPostureConfig: pulumi.Output<outputs.container.ClusterSecurityPostureConfig>;
    /**
     * The server-defined URL for the resource.
     */
    readonly selfLink: pulumi.Output<string>;
    /**
     * Structure is documented below.
     */
    readonly serviceExternalIpsConfig: pulumi.Output<outputs.container.ClusterServiceExternalIpsConfig>;
    /**
     * The IP address range of the Kubernetes services in this
     * cluster, in [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
     * notation (e.g. `1.2.3.4/29`). Service addresses are typically put in the last
     * `/16` from the container CIDR.
     */
    readonly servicesIpv4Cidr: pulumi.Output<string>;
    /**
     * The name or selfLink of the Google Compute Engine
     * subnetwork in which the cluster's instances are launched.
     */
    readonly subnetwork: pulumi.Output<string>;
    /**
     * TPU configuration for the cluster.
     */
    readonly tpuConfig: pulumi.Output<outputs.container.ClusterTpuConfig>;
    /**
     * The IP address range of the Cloud TPUs in this cluster, in
     * [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
     * notation (e.g. `1.2.3.4/29`).
     */
    readonly tpuIpv4CidrBlock: pulumi.Output<string>;
    /**
     * The custom keys configuration of the cluster Structure is documented below.
     */
    readonly userManagedKeysConfig: pulumi.Output<outputs.container.ClusterUserManagedKeysConfig | undefined>;
    /**
     * Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it.
     * Structure is documented below.
     */
    readonly verticalPodAutoscaling: pulumi.Output<outputs.container.ClusterVerticalPodAutoscaling>;
    /**
     * Configuration for [direct-path (via ALTS) with workload identity.](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#workloadaltsconfig). Structure is documented below.
     */
    readonly workloadAltsConfig: pulumi.Output<outputs.container.ClusterWorkloadAltsConfig>;
    /**
     * Workload Identity allows Kubernetes service accounts to act as a user-managed
     * [Google IAM Service Account](https://cloud.google.com/iam/docs/service-accounts#user-managed_service_accounts).
     * Structure is documented below.
     */
    readonly workloadIdentityConfig: pulumi.Output<outputs.container.ClusterWorkloadIdentityConfig>;
    /**
     * Create a Cluster resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args?: ClusterArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering Cluster resources.
 */
export interface ClusterState {
    /**
     * The configuration for addons supported by GKE.
     * Structure is documented below.
     */
    addonsConfig?: pulumi.Input<inputs.container.ClusterAddonsConfig>;
    /**
     * Enable NET_ADMIN for the cluster. Defaults to
     * `false`. This field should only be enabled for Autopilot clusters (`enableAutopilot`
     * set to `true`).
     */
    allowNetAdmin?: pulumi.Input<boolean>;
    /**
     * Configuration for [anonymous authentication restrictions](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#restrict-anon-access). Structure is documented below.
     */
    anonymousAuthenticationConfig?: pulumi.Input<inputs.container.ClusterAnonymousAuthenticationConfig>;
    /**
     * Configuration for the
     * [Google Groups for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#groups-setup-gsuite) feature.
     * Structure is documented below.
     */
    authenticatorGroupsConfig?: pulumi.Input<inputs.container.ClusterAuthenticatorGroupsConfig>;
    /**
     * Configuration options for the Binary
     * Authorization feature. Structure is documented below.
     */
    binaryAuthorization?: pulumi.Input<inputs.container.ClusterBinaryAuthorization>;
    /**
     * Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to
     * automatically adjust the size of the cluster and create/delete node pools based
     * on the current needs of the cluster's workload. See the
     * [guide to using Node Auto-Provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)
     * for more details. Structure is documented below.
     */
    clusterAutoscaling?: pulumi.Input<inputs.container.ClusterClusterAutoscaling>;
    /**
     * The IP address range of the Kubernetes pods
     * in this cluster in CIDR notation (e.g. `10.96.0.0/14`). Leave blank to have one
     * automatically chosen or specify a `/14` block in `10.0.0.0/8`. This field will
     * default a new cluster to routes-based, where `ipAllocationPolicy` is not defined.
     */
    clusterIpv4Cidr?: pulumi.Input<string>;
    /**
     * Configuration for
     * [ClusterTelemetry](https://cloud.google.com/monitoring/kubernetes-engine/installing#controlling_the_collection_of_application_logs) feature,
     * Structure is documented below.
     */
    clusterTelemetry?: pulumi.Input<inputs.container.ClusterClusterTelemetry>;
    /**
     * Configuration for [Confidential Nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes) feature. Structure is documented below documented below.
     */
    confidentialNodes?: pulumi.Input<inputs.container.ClusterConfidentialNodes>;
    /**
     * Configuration for all of the cluster's control plane endpoints.
     * Structure is documented below.
     */
    controlPlaneEndpointsConfig?: pulumi.Input<inputs.container.ClusterControlPlaneEndpointsConfig>;
    /**
     * Configuration for the
     * [Cost Allocation](https://cloud.google.com/kubernetes-engine/docs/how-to/cost-allocations) feature.
     * Structure is documented below.
     */
    costManagementConfig?: pulumi.Input<inputs.container.ClusterCostManagementConfig>;
    /**
     * Structure is documented below.
     */
    databaseEncryption?: pulumi.Input<inputs.container.ClusterDatabaseEncryption>;
    /**
     * The desired datapath provider for this cluster. This is set to `LEGACY_DATAPATH` by default, which uses the IPTables-based kube-proxy implementation. Set to `ADVANCED_DATAPATH` to enable Dataplane v2.
     */
    datapathProvider?: pulumi.Input<string>;
    /**
     * The default maximum number of pods
     * per node in this cluster. This doesn't work on "routes-based" clusters, clusters
     * that don't have IP Aliasing enabled. See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr)
     * for more information.
     */
    defaultMaxPodsPerNode?: pulumi.Input<number>;
    /**
     * [GKE SNAT](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#how_ipmasq_works) DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster, [API doc](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#networkconfig). Structure is documented below
     */
    defaultSnatStatus?: pulumi.Input<inputs.container.ClusterDefaultSnatStatus>;
    deletionProtection?: pulumi.Input<boolean>;
    /**
     * Description of the cluster.
     */
    description?: pulumi.Input<string>;
    /**
     * Disable L4 load balancer VPC firewalls to enable firewall policies.
     */
    disableL4LbFirewallReconciliation?: pulumi.Input<boolean>;
    /**
     * Configuration for [Using Cloud DNS for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-dns). Structure is documented below.
     */
    dnsConfig?: pulumi.Input<inputs.container.ClusterDnsConfig>;
    /**
     * All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
     */
    effectiveLabels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Enable Autopilot for this cluster. Defaults to `false`.
     * Note that when this option is enabled, certain features of Standard GKE are not available.
     * See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison)
     * for available features.
     */
    enableAutopilot?: pulumi.Input<boolean>;
    /**
     * Whether CiliumClusterWideNetworkPolicy is enabled on this cluster. Defaults to false.
     */
    enableCiliumClusterwideNetworkPolicy?: pulumi.Input<boolean>;
    /**
     * Whether FQDN Network Policy is enabled on this cluster. Users who enable this feature for existing Standard clusters must restart the GKE Dataplane V2 `anetd` DaemonSet after enabling it. See the [Enable FQDN Network Policy in an existing cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/fqdn-network-policies#enable_fqdn_network_policy_in_an_existing_cluster) for more information.
     */
    enableFqdnNetworkPolicy?: pulumi.Input<boolean>;
    /**
     * Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
     */
    enableIntranodeVisibility?: pulumi.Input<boolean>;
    /**
     * Configuration for Kubernetes Beta APIs.
     * Structure is documented below.
     */
    enableK8sBetaApis?: pulumi.Input<inputs.container.ClusterEnableK8sBetaApis>;
    /**
     * Whether to enable Kubernetes Alpha features for
     * this cluster. Note that when this option is enabled, the cluster cannot be upgraded
     * and will be automatically deleted after 30 days.
     */
    enableKubernetesAlpha?: pulumi.Input<boolean>;
    /**
     * Whether L4ILB Subsetting is enabled for this cluster.
     */
    enableL4IlbSubsetting?: pulumi.Input<boolean>;
    /**
     * Whether the ABAC authorizer is enabled for this cluster.
     * When enabled, identities in the system, including service accounts, nodes, and controllers,
     * will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
     * Defaults to `false`
     */
    enableLegacyAbac?: pulumi.Input<boolean>;
    /**
     * Whether multi-networking is enabled for this cluster.
     */
    enableMultiNetworking?: pulumi.Input<boolean>;
    /**
     * Enable Shielded Nodes features on all nodes in this cluster.  Defaults to `true`.
     */
    enableShieldedNodes?: pulumi.Input<boolean>;
    /**
     * Whether to enable Cloud TPU resources in this cluster.
     * See the [official documentation](https://cloud.google.com/tpu/docs/kubernetes-engine-setup).
     */
    enableTpu?: pulumi.Input<boolean>;
    /**
     * The IP address of this cluster's Kubernetes master.
     */
    endpoint?: pulumi.Input<string>;
    /**
     * (DEPRECATED) Configuration for [Enterprise edition].(https://cloud.google.com/kubernetes-engine/enterprise/docs/concepts/gke-editions). Structure is documented below. Deprecated as GKE Enterprise features are now available without an Enterprise tier. See https://cloud.google.com/blog/products/containers-kubernetes/gke-gets-new-pricing-and-capabilities-on-10th-birthday for the announcement of this change.
     *
     * @deprecated GKE Enterprise features are now available without an Enterprise tier. This field is deprecated and will be removed in a future major release
     */
    enterpriseConfig?: pulumi.Input<inputs.container.ClusterEnterpriseConfig>;
    /**
     * Fleet configuration for the cluster. Structure is documented below.
     */
    fleet?: pulumi.Input<inputs.container.ClusterFleet>;
    /**
     * Configuration for [GKE Gateway API controller](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api). Structure is documented below.
     */
    gatewayApiConfig?: pulumi.Input<inputs.container.ClusterGatewayApiConfig>;
    /**
     * Configuration options for the auto-upgrade patch type feature, which provide more control over the speed of automatic upgrades of your GKE clusters.
     * Structure is documented below.
     */
    gkeAutoUpgradeConfig?: pulumi.Input<inputs.container.ClusterGkeAutoUpgradeConfig>;
    /**
     * . Structure is documented below.
     */
    identityServiceConfig?: pulumi.Input<inputs.container.ClusterIdentityServiceConfig>;
    /**
     * Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
     */
    inTransitEncryptionConfig?: pulumi.Input<string>;
    /**
     * The number of nodes to create in this
     * cluster's default node pool. In regional or multi-zonal clusters, this is the
     * number of nodes per zone. Must be set if `nodePool` is not set. If you're using
     * `gcp.container.NodePool` objects with no default node pool, you'll need to
     * set this to a value of at least `1`, alongside setting
     * `removeDefaultNodePool` to `true`.
     */
    initialNodeCount?: pulumi.Input<number>;
    /**
     * Configuration of cluster IP allocation for
     * VPC-native clusters. If this block is unset during creation, it will be set by the GKE backend.
     * Structure is documented below.
     */
    ipAllocationPolicy?: pulumi.Input<inputs.container.ClusterIpAllocationPolicy>;
    /**
     * The fingerprint of the set of labels for this cluster.
     */
    labelFingerprint?: pulumi.Input<string>;
    /**
     * The location (region or zone) in which the cluster
     * master will be created, as well as the default node location. If you specify a
     * zone (such as `us-central1-a`), the cluster will be a zonal cluster with a
     * single cluster master. If you specify a region (such as `us-west1`), the
     * cluster will be a regional cluster with multiple masters spread across zones in
     * the region, and with default node locations in those zones as well
     */
    location?: pulumi.Input<string>;
    /**
     * Logging configuration for the cluster.
     * Structure is documented below.
     */
    loggingConfig?: pulumi.Input<inputs.container.ClusterLoggingConfig>;
    /**
     * The logging service that the cluster should
     * write logs to. Available options include `logging.googleapis.com`(Legacy Stackdriver),
     * `logging.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Logging), and `none`. Defaults to `logging.googleapis.com/kubernetes`
     */
    loggingService?: pulumi.Input<string>;
    /**
     * The maintenance policy to use for the cluster. Structure is
     * documented below.
     */
    maintenancePolicy?: pulumi.Input<inputs.container.ClusterMaintenancePolicy>;
    /**
     * The authentication information for accessing the
     * Kubernetes master. Some values in this block are only returned by the API if
     * your service account has permission to get credentials for your GKE cluster. If
     * you see an unexpected diff unsetting your client cert, ensure you have the
     * `container.clusters.getCredentials` permission.
     * Structure is documented below.
     */
    masterAuth?: pulumi.Input<inputs.container.ClusterMasterAuth>;
    /**
     * The desired
     * configuration options for master authorized networks. Omit the
     * nested `cidrBlocks` attribute to disallow external access (except
     * the cluster node IPs, which GKE automatically whitelists).
     * Structure is documented below.
     */
    masterAuthorizedNetworksConfig?: pulumi.Input<inputs.container.ClusterMasterAuthorizedNetworksConfig>;
    /**
     * The current version of the master in the cluster. This may
     * be different than the `minMasterVersion` set in the config if the master
     * has been updated by GKE.
     */
    masterVersion?: pulumi.Input<string>;
    /**
     * Structure is documented below.
     */
    meshCertificates?: pulumi.Input<inputs.container.ClusterMeshCertificates>;
    /**
     * The minimum version of the master. GKE
     * will auto-update the master to new versions, so this does not guarantee the
     * current master version--use the read-only `masterVersion` field to obtain that.
     * If unset, the cluster's version will be set by GKE to the version of the most recent
     * official release (which is not necessarily the latest version).  Most users will find
     * the `gcp.container.getEngineVersions` data source useful - it indicates which versions
     * are available. If you intend to specify versions manually,
     * [the docs](https://cloud.google.com/kubernetes-engine/versioning-and-upgrades#specifying_cluster_version)
     * describe the various acceptable formats for this field.
     *
     * > If you are using the `gcp.container.getEngineVersions` datasource with a regional cluster, ensure that you have provided a `location`
     * to the datasource. A region can have a different set of supported versions than its corresponding zones, and not all zones in a
     * region are guaranteed to support the same version.
     */
    minMasterVersion?: pulumi.Input<string>;
    /**
     * Monitoring configuration for the cluster.
     * Structure is documented below.
     */
    monitoringConfig?: pulumi.Input<inputs.container.ClusterMonitoringConfig>;
    /**
     * The monitoring service that the cluster
     * should write metrics to.
     * Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API.
     * VM metrics will be collected by Google Compute Engine regardless of this setting
     * Available options include
     * `monitoring.googleapis.com`(Legacy Stackdriver), `monitoring.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Monitoring), and `none`.
     * Defaults to `monitoring.googleapis.com/kubernetes`
     */
    monitoringService?: pulumi.Input<string>;
    /**
     * The name of the cluster, unique within the project and
     * location.
     *
     * - - -
     */
    name?: pulumi.Input<string>;
    /**
     * The name or selfLink of the Google Compute Engine
     * network to which the cluster is connected. For Shared VPC, set this to the self link of the
     * shared network.
     */
    network?: pulumi.Input<string>;
    /**
     * Network bandwidth tier configuration.
     */
    networkPerformanceConfig?: pulumi.Input<inputs.container.ClusterNetworkPerformanceConfig>;
    /**
     * Configuration options for the
     * [NetworkPolicy](https://kubernetes.io/docs/concepts/services-networking/networkpolicies/)
     * feature. Structure is documented below.
     */
    networkPolicy?: pulumi.Input<inputs.container.ClusterNetworkPolicy>;
    /**
     * Determines whether alias IPs or routes will be used for pod IPs in the cluster.
     * Options are `VPC_NATIVE` or `ROUTES`. `VPC_NATIVE` enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases). Newly created clusters will default to `VPC_NATIVE`.
     */
    networkingMode?: pulumi.Input<string>;
    /**
     * Parameters used in creating the default node pool.
     * Generally, this field should not be used at the same time as a
     * `gcp.container.NodePool` or a `nodePool` block; this configuration
     * manages the default node pool, which isn't recommended to be used.
     * Structure is documented below.
     */
    nodeConfig?: pulumi.Input<inputs.container.ClusterNodeConfig>;
    /**
     * The list of zones in which the cluster's nodes
     * are located. Nodes must be in the region of their regional cluster or in the
     * same region as their cluster's zone for zonal clusters. If this is specified for
     * a zonal cluster, omit the cluster's zone.
     *
     * > A "multi-zonal" cluster is a zonal cluster with at least one additional zone
     * defined; in a multi-zonal cluster, the cluster master is only present in a
     * single zone while nodes are present in each of the primary zone and the node
     * locations. In contrast, in a regional cluster, cluster master nodes are present
     * in multiple zones in the region. For that reason, regional clusters should be
     * preferred.
     */
    nodeLocations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Node pool configs that apply to auto-provisioned node pools in
     * [autopilot](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison) clusters and
     * [node auto-provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)-enabled clusters. Structure is documented below.
     */
    nodePoolAutoConfig?: pulumi.Input<inputs.container.ClusterNodePoolAutoConfig>;
    /**
     * Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object. Structure is documented below.
     */
    nodePoolDefaults?: pulumi.Input<inputs.container.ClusterNodePoolDefaults>;
    /**
     * List of node pools associated with this cluster.
     * See gcp.container.NodePool for schema.
     * **Warning:** node pools defined inside a cluster can't be changed (or added/removed) after
     * cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability
     * to say "these are the _only_ node pools associated with this cluster", use the
     * gcp.container.NodePool resource instead of this property.
     */
    nodePools?: pulumi.Input<pulumi.Input<inputs.container.ClusterNodePool>[]>;
    /**
     * The Kubernetes version on the nodes. Must either be unset
     * or set to the same value as `minMasterVersion` on create. Defaults to the default
     * version set by GKE which is not necessarily the latest version. This only affects
     * nodes in the default node pool. While a fuzzy version can be specified, it's
     * recommended that you specify explicit versions as the provider will see spurious diffs
     * when fuzzy versions are used. See the `gcp.container.getEngineVersions` data source's
     * `versionPrefix` field to approximate fuzzy versions.
     * To update nodes in other node pools, use the `version` attribute on the node pool.
     */
    nodeVersion?: pulumi.Input<string>;
    /**
     * Configuration for the [cluster upgrade notifications](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-upgrade-notifications) feature. Structure is documented below.
     */
    notificationConfig?: pulumi.Input<inputs.container.ClusterNotificationConfig>;
    operation?: pulumi.Input<string>;
    /**
     * Configuration for the
     * Structure is documented below.
     */
    podAutoscaling?: pulumi.Input<inputs.container.ClusterPodAutoscaling>;
    /**
     * Configuration for the
     * [PodSecurityPolicy](https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies) feature.
     * Structure is documented below.
     */
    podSecurityPolicyConfig?: pulumi.Input<inputs.container.ClusterPodSecurityPolicyConfig>;
    /**
     * Configuration for [private clusters](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters),
     * clusters with private nodes. Structure is documented below.
     */
    privateClusterConfig?: pulumi.Input<inputs.container.ClusterPrivateClusterConfig>;
    /**
     * The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4).
     */
    privateIpv6GoogleAccess?: pulumi.Input<string>;
    /**
     * The ID of the project in which the resource belongs. If it
     * is not provided, the provider project is used.
     */
    project?: pulumi.Input<string>;
    /**
     * Enable/Disable Protect API features for the cluster. Structure is documented below.
     */
    protectConfig?: pulumi.Input<inputs.container.ClusterProtectConfig>;
    /**
     * The combination of labels configured directly on the resource and default labels configured on the provider.
     */
    pulumiLabels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created. Structure is documented below.
     *
     * <a name="nestedDefaultSnatStatus"></a>The `defaultSnatStatus` block supports
     */
    rbacBindingConfig?: pulumi.Input<inputs.container.ClusterRbacBindingConfig>;
    /**
     * Configuration options for the [Release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels)
     * feature, which provide more control over automatic upgrades of your GKE clusters.
     * When updating this field, GKE imposes specific version requirements. See
     * [Selecting a new release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels#selecting_a_new_release_channel)
     * for more details; the `gcp.container.getEngineVersions` datasource can provide
     * the default version for a channel. Note that removing the `releaseChannel`
     * field from your config will cause the provider to stop managing your cluster's
     * release channel, but will not unenroll it. Instead, use the `"UNSPECIFIED"`
     * channel. Structure is documented below.
     */
    releaseChannel?: pulumi.Input<inputs.container.ClusterReleaseChannel>;
    /**
     * If `true`, deletes the default node
     * pool upon cluster creation. If you're using `gcp.container.NodePool`
     * resources with no default node pool, this should be set to `true`, alongside
     * setting `initialNodeCount` to at least `1`.
     */
    removeDefaultNodePool?: pulumi.Input<boolean>;
    /**
     * The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
     *
     * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
     * Please refer to the field 'effective_labels' for all of the labels present on the resource.
     */
    resourceLabels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Configuration for the
     * [ResourceUsageExportConfig](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-usage-metering) feature.
     * Structure is documented below.
     */
    resourceUsageExportConfig?: pulumi.Input<inputs.container.ClusterResourceUsageExportConfig>;
    /**
     * Configuration for the
     * [SecretManagerConfig](https://cloud.google.com/secret-manager/docs/secret-manager-managed-csi-component) feature.
     * Structure is documented below.
     */
    secretManagerConfig?: pulumi.Input<inputs.container.ClusterSecretManagerConfig>;
    /**
     * Enable/Disable Security Posture API features for the cluster. Structure is documented below.
     */
    securityPostureConfig?: pulumi.Input<inputs.container.ClusterSecurityPostureConfig>;
    /**
     * The server-defined URL for the resource.
     */
    selfLink?: pulumi.Input<string>;
    /**
     * Structure is documented below.
     */
    serviceExternalIpsConfig?: pulumi.Input<inputs.container.ClusterServiceExternalIpsConfig>;
    /**
     * The IP address range of the Kubernetes services in this
     * cluster, in [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
     * notation (e.g. `1.2.3.4/29`). Service addresses are typically put in the last
     * `/16` from the container CIDR.
     */
    servicesIpv4Cidr?: pulumi.Input<string>;
    /**
     * The name or selfLink of the Google Compute Engine
     * subnetwork in which the cluster's instances are launched.
     */
    subnetwork?: pulumi.Input<string>;
    /**
     * TPU configuration for the cluster.
     */
    tpuConfig?: pulumi.Input<inputs.container.ClusterTpuConfig>;
    /**
     * The IP address range of the Cloud TPUs in this cluster, in
     * [CIDR](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
     * notation (e.g. `1.2.3.4/29`).
     */
    tpuIpv4CidrBlock?: pulumi.Input<string>;
    /**
     * The custom keys configuration of the cluster Structure is documented below.
     */
    userManagedKeysConfig?: pulumi.Input<inputs.container.ClusterUserManagedKeysConfig>;
    /**
     * Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it.
     * Structure is documented below.
     */
    verticalPodAutoscaling?: pulumi.Input<inputs.container.ClusterVerticalPodAutoscaling>;
    /**
     * Configuration for [direct-path (via ALTS) with workload identity.](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#workloadaltsconfig). Structure is documented below.
     */
    workloadAltsConfig?: pulumi.Input<inputs.container.ClusterWorkloadAltsConfig>;
    /**
     * Workload Identity allows Kubernetes service accounts to act as a user-managed
     * [Google IAM Service Account](https://cloud.google.com/iam/docs/service-accounts#user-managed_service_accounts).
     * Structure is documented below.
     */
    workloadIdentityConfig?: pulumi.Input<inputs.container.ClusterWorkloadIdentityConfig>;
}
/**
 * The set of arguments for constructing a Cluster resource.
 */
export interface ClusterArgs {
    /**
     * The configuration for addons supported by GKE.
     * Structure is documented below.
     */
    addonsConfig?: pulumi.Input<inputs.container.ClusterAddonsConfig>;
    /**
     * Enable NET_ADMIN for the cluster. Defaults to
     * `false`. This field should only be enabled for Autopilot clusters (`enableAutopilot`
     * set to `true`).
     */
    allowNetAdmin?: pulumi.Input<boolean>;
    /**
     * Configuration for [anonymous authentication restrictions](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#restrict-anon-access). Structure is documented below.
     */
    anonymousAuthenticationConfig?: pulumi.Input<inputs.container.ClusterAnonymousAuthenticationConfig>;
    /**
     * Configuration for the
     * [Google Groups for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#groups-setup-gsuite) feature.
     * Structure is documented below.
     */
    authenticatorGroupsConfig?: pulumi.Input<inputs.container.ClusterAuthenticatorGroupsConfig>;
    /**
     * Configuration options for the Binary
     * Authorization feature. Structure is documented below.
     */
    binaryAuthorization?: pulumi.Input<inputs.container.ClusterBinaryAuthorization>;
    /**
     * Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to
     * automatically adjust the size of the cluster and create/delete node pools based
     * on the current needs of the cluster's workload. See the
     * [guide to using Node Auto-Provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)
     * for more details. Structure is documented below.
     */
    clusterAutoscaling?: pulumi.Input<inputs.container.ClusterClusterAutoscaling>;
    /**
     * The IP address range of the Kubernetes pods
     * in this cluster in CIDR notation (e.g. `10.96.0.0/14`). Leave blank to have one
     * automatically chosen or specify a `/14` block in `10.0.0.0/8`. This field will
     * default a new cluster to routes-based, where `ipAllocationPolicy` is not defined.
     */
    clusterIpv4Cidr?: pulumi.Input<string>;
    /**
     * Configuration for
     * [ClusterTelemetry](https://cloud.google.com/monitoring/kubernetes-engine/installing#controlling_the_collection_of_application_logs) feature,
     * Structure is documented below.
     */
    clusterTelemetry?: pulumi.Input<inputs.container.ClusterClusterTelemetry>;
    /**
     * Configuration for [Confidential Nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes) feature. Structure is documented below documented below.
     */
    confidentialNodes?: pulumi.Input<inputs.container.ClusterConfidentialNodes>;
    /**
     * Configuration for all of the cluster's control plane endpoints.
     * Structure is documented below.
     */
    controlPlaneEndpointsConfig?: pulumi.Input<inputs.container.ClusterControlPlaneEndpointsConfig>;
    /**
     * Configuration for the
     * [Cost Allocation](https://cloud.google.com/kubernetes-engine/docs/how-to/cost-allocations) feature.
     * Structure is documented below.
     */
    costManagementConfig?: pulumi.Input<inputs.container.ClusterCostManagementConfig>;
    /**
     * Structure is documented below.
     */
    databaseEncryption?: pulumi.Input<inputs.container.ClusterDatabaseEncryption>;
    /**
     * The desired datapath provider for this cluster. This is set to `LEGACY_DATAPATH` by default, which uses the IPTables-based kube-proxy implementation. Set to `ADVANCED_DATAPATH` to enable Dataplane v2.
     */
    datapathProvider?: pulumi.Input<string>;
    /**
     * The default maximum number of pods
     * per node in this cluster. This doesn't work on "routes-based" clusters, clusters
     * that don't have IP Aliasing enabled. See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr)
     * for more information.
     */
    defaultMaxPodsPerNode?: pulumi.Input<number>;
    /**
     * [GKE SNAT](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#how_ipmasq_works) DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster, [API doc](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#networkconfig). Structure is documented below
     */
    defaultSnatStatus?: pulumi.Input<inputs.container.ClusterDefaultSnatStatus>;
    deletionProtection?: pulumi.Input<boolean>;
    /**
     * Description of the cluster.
     */
    description?: pulumi.Input<string>;
    /**
     * Disable L4 load balancer VPC firewalls to enable firewall policies.
     */
    disableL4LbFirewallReconciliation?: pulumi.Input<boolean>;
    /**
     * Configuration for [Using Cloud DNS for GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-dns). Structure is documented below.
     */
    dnsConfig?: pulumi.Input<inputs.container.ClusterDnsConfig>;
    /**
     * Enable Autopilot for this cluster. Defaults to `false`.
     * Note that when this option is enabled, certain features of Standard GKE are not available.
     * See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison)
     * for available features.
     */
    enableAutopilot?: pulumi.Input<boolean>;
    /**
     * Whether CiliumClusterWideNetworkPolicy is enabled on this cluster. Defaults to false.
     */
    enableCiliumClusterwideNetworkPolicy?: pulumi.Input<boolean>;
    /**
     * Whether FQDN Network Policy is enabled on this cluster. Users who enable this feature for existing Standard clusters must restart the GKE Dataplane V2 `anetd` DaemonSet after enabling it. See the [Enable FQDN Network Policy in an existing cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/fqdn-network-policies#enable_fqdn_network_policy_in_an_existing_cluster) for more information.
     */
    enableFqdnNetworkPolicy?: pulumi.Input<boolean>;
    /**
     * Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
     */
    enableIntranodeVisibility?: pulumi.Input<boolean>;
    /**
     * Configuration for Kubernetes Beta APIs.
     * Structure is documented below.
     */
    enableK8sBetaApis?: pulumi.Input<inputs.container.ClusterEnableK8sBetaApis>;
    /**
     * Whether to enable Kubernetes Alpha features for
     * this cluster. Note that when this option is enabled, the cluster cannot be upgraded
     * and will be automatically deleted after 30 days.
     */
    enableKubernetesAlpha?: pulumi.Input<boolean>;
    /**
     * Whether L4ILB Subsetting is enabled for this cluster.
     */
    enableL4IlbSubsetting?: pulumi.Input<boolean>;
    /**
     * Whether the ABAC authorizer is enabled for this cluster.
     * When enabled, identities in the system, including service accounts, nodes, and controllers,
     * will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
     * Defaults to `false`
     */
    enableLegacyAbac?: pulumi.Input<boolean>;
    /**
     * Whether multi-networking is enabled for this cluster.
     */
    enableMultiNetworking?: pulumi.Input<boolean>;
    /**
     * Enable Shielded Nodes features on all nodes in this cluster.  Defaults to `true`.
     */
    enableShieldedNodes?: pulumi.Input<boolean>;
    /**
     * Whether to enable Cloud TPU resources in this cluster.
     * See the [official documentation](https://cloud.google.com/tpu/docs/kubernetes-engine-setup).
     */
    enableTpu?: pulumi.Input<boolean>;
    /**
     * (DEPRECATED) Configuration for [Enterprise edition].(https://cloud.google.com/kubernetes-engine/enterprise/docs/concepts/gke-editions). Structure is documented below. Deprecated as GKE Enterprise features are now available without an Enterprise tier. See https://cloud.google.com/blog/products/containers-kubernetes/gke-gets-new-pricing-and-capabilities-on-10th-birthday for the announcement of this change.
     *
     * @deprecated GKE Enterprise features are now available without an Enterprise tier. This field is deprecated and will be removed in a future major release
     */
    enterpriseConfig?: pulumi.Input<inputs.container.ClusterEnterpriseConfig>;
    /**
     * Fleet configuration for the cluster. Structure is documented below.
     */
    fleet?: pulumi.Input<inputs.container.ClusterFleet>;
    /**
     * Configuration for [GKE Gateway API controller](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api). Structure is documented below.
     */
    gatewayApiConfig?: pulumi.Input<inputs.container.ClusterGatewayApiConfig>;
    /**
     * Configuration options for the auto-upgrade patch type feature, which provide more control over the speed of automatic upgrades of your GKE clusters.
     * Structure is documented below.
     */
    gkeAutoUpgradeConfig?: pulumi.Input<inputs.container.ClusterGkeAutoUpgradeConfig>;
    /**
     * . Structure is documented below.
     */
    identityServiceConfig?: pulumi.Input<inputs.container.ClusterIdentityServiceConfig>;
    /**
     * Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
     */
    inTransitEncryptionConfig?: pulumi.Input<string>;
    /**
     * The number of nodes to create in this
     * cluster's default node pool. In regional or multi-zonal clusters, this is the
     * number of nodes per zone. Must be set if `nodePool` is not set. If you're using
     * `gcp.container.NodePool` objects with no default node pool, you'll need to
     * set this to a value of at least `1`, alongside setting
     * `removeDefaultNodePool` to `true`.
     */
    initialNodeCount?: pulumi.Input<number>;
    /**
     * Configuration of cluster IP allocation for
     * VPC-native clusters. If this block is unset during creation, it will be set by the GKE backend.
     * Structure is documented below.
     */
    ipAllocationPolicy?: pulumi.Input<inputs.container.ClusterIpAllocationPolicy>;
    /**
     * The location (region or zone) in which the cluster
     * master will be created, as well as the default node location. If you specify a
     * zone (such as `us-central1-a`), the cluster will be a zonal cluster with a
     * single cluster master. If you specify a region (such as `us-west1`), the
     * cluster will be a regional cluster with multiple masters spread across zones in
     * the region, and with default node locations in those zones as well
     */
    location?: pulumi.Input<string>;
    /**
     * Logging configuration for the cluster.
     * Structure is documented below.
     */
    loggingConfig?: pulumi.Input<inputs.container.ClusterLoggingConfig>;
    /**
     * The logging service that the cluster should
     * write logs to. Available options include `logging.googleapis.com`(Legacy Stackdriver),
     * `logging.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Logging), and `none`. Defaults to `logging.googleapis.com/kubernetes`
     */
    loggingService?: pulumi.Input<string>;
    /**
     * The maintenance policy to use for the cluster. Structure is
     * documented below.
     */
    maintenancePolicy?: pulumi.Input<inputs.container.ClusterMaintenancePolicy>;
    /**
     * The authentication information for accessing the
     * Kubernetes master. Some values in this block are only returned by the API if
     * your service account has permission to get credentials for your GKE cluster. If
     * you see an unexpected diff unsetting your client cert, ensure you have the
     * `container.clusters.getCredentials` permission.
     * Structure is documented below.
     */
    masterAuth?: pulumi.Input<inputs.container.ClusterMasterAuth>;
    /**
     * The desired
     * configuration options for master authorized networks. Omit the
     * nested `cidrBlocks` attribute to disallow external access (except
     * the cluster node IPs, which GKE automatically whitelists).
     * Structure is documented below.
     */
    masterAuthorizedNetworksConfig?: pulumi.Input<inputs.container.ClusterMasterAuthorizedNetworksConfig>;
    /**
     * Structure is documented below.
     */
    meshCertificates?: pulumi.Input<inputs.container.ClusterMeshCertificates>;
    /**
     * The minimum version of the master. GKE
     * will auto-update the master to new versions, so this does not guarantee the
     * current master version--use the read-only `masterVersion` field to obtain that.
     * If unset, the cluster's version will be set by GKE to the version of the most recent
     * official release (which is not necessarily the latest version).  Most users will find
     * the `gcp.container.getEngineVersions` data source useful - it indicates which versions
     * are available. If you intend to specify versions manually,
     * [the docs](https://cloud.google.com/kubernetes-engine/versioning-and-upgrades#specifying_cluster_version)
     * describe the various acceptable formats for this field.
     *
     * > If you are using the `gcp.container.getEngineVersions` datasource with a regional cluster, ensure that you have provided a `location`
     * to the datasource. A region can have a different set of supported versions than its corresponding zones, and not all zones in a
     * region are guaranteed to support the same version.
     */
    minMasterVersion?: pulumi.Input<string>;
    /**
     * Monitoring configuration for the cluster.
     * Structure is documented below.
     */
    monitoringConfig?: pulumi.Input<inputs.container.ClusterMonitoringConfig>;
    /**
     * The monitoring service that the cluster
     * should write metrics to.
     * Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API.
     * VM metrics will be collected by Google Compute Engine regardless of this setting
     * Available options include
     * `monitoring.googleapis.com`(Legacy Stackdriver), `monitoring.googleapis.com/kubernetes`(Stackdriver Kubernetes Engine Monitoring), and `none`.
     * Defaults to `monitoring.googleapis.com/kubernetes`
     */
    monitoringService?: pulumi.Input<string>;
    /**
     * The name of the cluster, unique within the project and
     * location.
     *
     * - - -
     */
    name?: pulumi.Input<string>;
    /**
     * The name or selfLink of the Google Compute Engine
     * network to which the cluster is connected. For Shared VPC, set this to the self link of the
     * shared network.
     */
    network?: pulumi.Input<string>;
    /**
     * Network bandwidth tier configuration.
     */
    networkPerformanceConfig?: pulumi.Input<inputs.container.ClusterNetworkPerformanceConfig>;
    /**
     * Configuration options for the
     * [NetworkPolicy](https://kubernetes.io/docs/concepts/services-networking/networkpolicies/)
     * feature. Structure is documented below.
     */
    networkPolicy?: pulumi.Input<inputs.container.ClusterNetworkPolicy>;
    /**
     * Determines whether alias IPs or routes will be used for pod IPs in the cluster.
     * Options are `VPC_NATIVE` or `ROUTES`. `VPC_NATIVE` enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases). Newly created clusters will default to `VPC_NATIVE`.
     */
    networkingMode?: pulumi.Input<string>;
    /**
     * Parameters used in creating the default node pool.
     * Generally, this field should not be used at the same time as a
     * `gcp.container.NodePool` or a `nodePool` block; this configuration
     * manages the default node pool, which isn't recommended to be used.
     * Structure is documented below.
     */
    nodeConfig?: pulumi.Input<inputs.container.ClusterNodeConfig>;
    /**
     * The list of zones in which the cluster's nodes
     * are located. Nodes must be in the region of their regional cluster or in the
     * same region as their cluster's zone for zonal clusters. If this is specified for
     * a zonal cluster, omit the cluster's zone.
     *
     * > A "multi-zonal" cluster is a zonal cluster with at least one additional zone
     * defined; in a multi-zonal cluster, the cluster master is only present in a
     * single zone while nodes are present in each of the primary zone and the node
     * locations. In contrast, in a regional cluster, cluster master nodes are present
     * in multiple zones in the region. For that reason, regional clusters should be
     * preferred.
     */
    nodeLocations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Node pool configs that apply to auto-provisioned node pools in
     * [autopilot](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison) clusters and
     * [node auto-provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)-enabled clusters. Structure is documented below.
     */
    nodePoolAutoConfig?: pulumi.Input<inputs.container.ClusterNodePoolAutoConfig>;
    /**
     * Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object. Structure is documented below.
     */
    nodePoolDefaults?: pulumi.Input<inputs.container.ClusterNodePoolDefaults>;
    /**
     * List of node pools associated with this cluster.
     * See gcp.container.NodePool for schema.
     * **Warning:** node pools defined inside a cluster can't be changed (or added/removed) after
     * cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability
     * to say "these are the _only_ node pools associated with this cluster", use the
     * gcp.container.NodePool resource instead of this property.
     */
    nodePools?: pulumi.Input<pulumi.Input<inputs.container.ClusterNodePool>[]>;
    /**
     * The Kubernetes version on the nodes. Must either be unset
     * or set to the same value as `minMasterVersion` on create. Defaults to the default
     * version set by GKE which is not necessarily the latest version. This only affects
     * nodes in the default node pool. While a fuzzy version can be specified, it's
     * recommended that you specify explicit versions as the provider will see spurious diffs
     * when fuzzy versions are used. See the `gcp.container.getEngineVersions` data source's
     * `versionPrefix` field to approximate fuzzy versions.
     * To update nodes in other node pools, use the `version` attribute on the node pool.
     */
    nodeVersion?: pulumi.Input<string>;
    /**
     * Configuration for the [cluster upgrade notifications](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-upgrade-notifications) feature. Structure is documented below.
     */
    notificationConfig?: pulumi.Input<inputs.container.ClusterNotificationConfig>;
    /**
     * Configuration for the
     * Structure is documented below.
     */
    podAutoscaling?: pulumi.Input<inputs.container.ClusterPodAutoscaling>;
    /**
     * Configuration for the
     * [PodSecurityPolicy](https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies) feature.
     * Structure is documented below.
     */
    podSecurityPolicyConfig?: pulumi.Input<inputs.container.ClusterPodSecurityPolicyConfig>;
    /**
     * Configuration for [private clusters](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters),
     * clusters with private nodes. Structure is documented below.
     */
    privateClusterConfig?: pulumi.Input<inputs.container.ClusterPrivateClusterConfig>;
    /**
     * The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4).
     */
    privateIpv6GoogleAccess?: pulumi.Input<string>;
    /**
     * The ID of the project in which the resource belongs. If it
     * is not provided, the provider project is used.
     */
    project?: pulumi.Input<string>;
    /**
     * Enable/Disable Protect API features for the cluster. Structure is documented below.
     */
    protectConfig?: pulumi.Input<inputs.container.ClusterProtectConfig>;
    /**
     * RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created. Structure is documented below.
     *
     * <a name="nestedDefaultSnatStatus"></a>The `defaultSnatStatus` block supports
     */
    rbacBindingConfig?: pulumi.Input<inputs.container.ClusterRbacBindingConfig>;
    /**
     * Configuration options for the [Release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels)
     * feature, which provide more control over automatic upgrades of your GKE clusters.
     * When updating this field, GKE imposes specific version requirements. See
     * [Selecting a new release channel](https://cloud.google.com/kubernetes-engine/docs/concepts/release-channels#selecting_a_new_release_channel)
     * for more details; the `gcp.container.getEngineVersions` datasource can provide
     * the default version for a channel. Note that removing the `releaseChannel`
     * field from your config will cause the provider to stop managing your cluster's
     * release channel, but will not unenroll it. Instead, use the `"UNSPECIFIED"`
     * channel. Structure is documented below.
     */
    releaseChannel?: pulumi.Input<inputs.container.ClusterReleaseChannel>;
    /**
     * If `true`, deletes the default node
     * pool upon cluster creation. If you're using `gcp.container.NodePool`
     * resources with no default node pool, this should be set to `true`, alongside
     * setting `initialNodeCount` to at least `1`.
     */
    removeDefaultNodePool?: pulumi.Input<boolean>;
    /**
     * The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
     *
     * **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
     * Please refer to the field 'effective_labels' for all of the labels present on the resource.
     */
    resourceLabels?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Configuration for the
     * [ResourceUsageExportConfig](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-usage-metering) feature.
     * Structure is documented below.
     */
    resourceUsageExportConfig?: pulumi.Input<inputs.container.ClusterResourceUsageExportConfig>;
    /**
     * Configuration for the
     * [SecretManagerConfig](https://cloud.google.com/secret-manager/docs/secret-manager-managed-csi-component) feature.
     * Structure is documented below.
     */
    secretManagerConfig?: pulumi.Input<inputs.container.ClusterSecretManagerConfig>;
    /**
     * Enable/Disable Security Posture API features for the cluster. Structure is documented below.
     */
    securityPostureConfig?: pulumi.Input<inputs.container.ClusterSecurityPostureConfig>;
    /**
     * Structure is documented below.
     */
    serviceExternalIpsConfig?: pulumi.Input<inputs.container.ClusterServiceExternalIpsConfig>;
    /**
     * The name or selfLink of the Google Compute Engine
     * subnetwork in which the cluster's instances are launched.
     */
    subnetwork?: pulumi.Input<string>;
    /**
     * TPU configuration for the cluster.
     */
    tpuConfig?: pulumi.Input<inputs.container.ClusterTpuConfig>;
    /**
     * The custom keys configuration of the cluster Structure is documented below.
     */
    userManagedKeysConfig?: pulumi.Input<inputs.container.ClusterUserManagedKeysConfig>;
    /**
     * Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it.
     * Structure is documented below.
     */
    verticalPodAutoscaling?: pulumi.Input<inputs.container.ClusterVerticalPodAutoscaling>;
    /**
     * Configuration for [direct-path (via ALTS) with workload identity.](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#workloadaltsconfig). Structure is documented below.
     */
    workloadAltsConfig?: pulumi.Input<inputs.container.ClusterWorkloadAltsConfig>;
    /**
     * Workload Identity allows Kubernetes service accounts to act as a user-managed
     * [Google IAM Service Account](https://cloud.google.com/iam/docs/service-accounts#user-managed_service_accounts).
     * Structure is documented below.
     */
    workloadIdentityConfig?: pulumi.Input<inputs.container.ClusterWorkloadIdentityConfig>;
}
