@pulumi/eks 2.8.1 → 3.0.0-alpha.6

package/cluster.d.ts

@@ -1,489 +1,352 @@
-import * as aws from "@pulumi/aws";
-import * as k8s from "@pulumi/kubernetes";
 import * as pulumi from "@pulumi/pulumi";
-import { VpcCni, VpcCniOptions } from "./cni";
-import { NodeGroup, NodeGroupBaseOptions, NodeGroupData } from "./nodegroup";
-import { EBSVolumeType, StorageClass } from "./storageclass";
-import { InputTags, UserStorageClasses } from "./utils";
+import * as inputs from "./types/input";
+import * as outputs from "./types/output";
+import * as enums from "./types/enums";
+import * as pulumiAws from "@pulumi/aws";
 /**
- * RoleMapping describes a mapping from an AWS IAM role to a Kubernetes user and groups.
+ * Cluster is a component that wraps the AWS and Kubernetes resources necessary to run an EKS cluster, its worker nodes, its optional StorageClasses, and an optional deployment of the Kubernetes Dashboard.
+ *
+ * ## Example Usage
+ *
+ * ### Provisioning a New EKS Cluster
+ *
+ * <!--Start PulumiCodeChooser -->
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as eks from "@pulumi/eks";
+ *
+ * // Create an EKS cluster with the default configuration.
+ * const cluster = new eks.Cluster("cluster", {});
+ *
+ * // Export the cluster's kubeconfig.
+ * export const kubeconfig = cluster.kubeconfig;
+ * ```
+ * <!--End PulumiCodeChooser -->
  */
-export interface RoleMapping {
+export declare class Cluster extends pulumi.ComponentResource {
     /**
-     * The ARN of the IAM role to add.
+     * Returns true if the given object is an instance of Cluster.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
      */
-    roleArn: pulumi.Input<aws.ARN>;
+    static isInstance(obj: any): obj is Cluster;
     /**
-     * The user name within Kubernetes to map to the IAM role. By default, the user name is the ARN of the IAM role.
+     * The AWS resource provider.
      */
-    username: pulumi.Input<string>;
+    readonly awsProvider: pulumi.Output<pulumiAws.Provider>;
     /**
-     * A list of groups within Kubernetes to which the role is mapped.
+     * The security group for the EKS cluster.
      */
-    groups: pulumi.Input<pulumi.Input<string>[]>;
-}
-/**
- * UserMapping describes a mapping from an AWS IAM user to a Kubernetes user and groups.
- */
-export interface UserMapping {
+    readonly clusterSecurityGroup: pulumi.Output<pulumiAws.ec2.SecurityGroup>;
     /**
-     * The ARN of the IAM user to add.
+     * The EKS cluster and its dependencies.
      */
-    userArn: pulumi.Input<aws.ARN>;
+    readonly core: pulumi.Output<outputs.CoreData>;
     /**
-     * The user name within Kubernetes to map to the IAM user. By default, the user name is the ARN of the IAM user.
+     * The default Node Group configuration, or undefined if `skipDefaultNodeGroup` was specified.
      */
-    username: pulumi.Input<string>;
+    readonly defaultNodeGroup: pulumi.Output<outputs.NodeGroupData | undefined>;
     /**
-     * A list of groups within Kubernetes to which the user is mapped to.
+     * The EKS cluster.
      */
-    groups: pulumi.Input<pulumi.Input<string>[]>;
-}
-/**
- * CreationRoleProvider is a component containing the AWS Role and Provider necessary to override the `[system:master]`
- * entity ARN. This is an optional argument used in `ClusterOptions`. Read more: https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html
- */
-export interface CreationRoleProvider {
-    role: aws.iam.Role;
-    provider: pulumi.ProviderResource;
-}
-/**
- * KubeconfigOptions represents the AWS credentials to scope a given kubeconfig
- * when using a non-default credential chain.
- *
- * The options can be used independently, or additively.
- *
- * A scoped kubeconfig is necessary for certain auth scenarios. For example:
- *   1. Assume a role on the default account caller,
- *   2. Use an AWS creds profile instead of the default account caller,
- *   3. Use an AWS creds creds profile instead of the default account caller,
- *      and then assume a given role on the profile. This scenario is also
- *      possible by only using a profile, iff the profile includes a role to
- *      assume in its settings.
- *
- * See for more details:
- * - https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html
- * - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html
- * - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html
- */
-export interface KubeconfigOptions {
+    readonly eksCluster: pulumi.Output<pulumiAws.eks.Cluster>;
     /**
-     * Role ARN to assume instead of the default AWS credential provider chain.
-     *
-     * The role is passed to kubeconfig as an authentication exec argument.
+     * The ingress rule that gives node group access to cluster API server.
      */
-    roleArn?: pulumi.Input<aws.ARN>;
+    readonly eksClusterIngressRule: pulumi.Output<pulumiAws.ec2.SecurityGroupRule>;
     /**
-     * AWS credential profile name to always use instead of the
-     * default AWS credential provider chain.
-     *
-     * The profile is passed to kubeconfig as an authentication environment
-     * setting.
+     * The service roles used by the EKS cluster. Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
      */
-    profileName?: pulumi.Input<string>;
-}
-/**
- * CoreData defines the core set of data associated with an EKS cluster, including the network in which it runs.
- */
-export interface CoreData {
-    cluster: aws.eks.Cluster;
-    vpcId: pulumi.Output<string>;
-    subnetIds: pulumi.Output<string[]>;
-    endpoint: pulumi.Output<string>;
-    clusterSecurityGroup: aws.ec2.SecurityGroup;
-    provider: k8s.Provider;
-    instanceRoles: pulumi.Output<aws.iam.Role[]>;
-    nodeGroupOptions: ClusterNodeGroupOptions;
-    awsProvider?: pulumi.ProviderResource;
-    publicSubnetIds?: pulumi.Output<string[]>;
-    privateSubnetIds?: pulumi.Output<string[]>;
-    eksNodeAccess?: k8s.core.v1.ConfigMap;
-    storageClasses?: UserStorageClasses;
-    kubeconfig?: pulumi.Output<any>;
-    vpcCni?: VpcCni;
-    tags?: InputTags;
-    nodeSecurityGroupTags?: InputTags;
-    fargateProfile: pulumi.Output<aws.eks.FargateProfile | undefined>;
-    oidcProvider?: aws.iam.OpenIdConnectProvider;
-    encryptionConfig?: pulumi.Output<aws.types.output.eks.ClusterEncryptionConfig>;
-    clusterIamRole: pulumi.Output<aws.iam.Role>;
-    accessEntries?: pulumi.Output<aws.eks.AccessEntry[]>;
-}
-export interface ClusterCreationRoleProviderOptions {
-    region?: pulumi.Input<aws.Region>;
-    profile?: pulumi.Input<string>;
-}
-/**
- * ClusterCreationRoleProvider is a component that wraps creating a role provider that can be passed to
- * `new eks.Cluster("test", { creationRoleProvider: ... })`. This can be used to provide a
- * specific role to use for the creation of the EKS cluster different from the role being used
- * to run the Pulumi deployment.
- */
-export declare class ClusterCreationRoleProvider extends pulumi.ComponentResource implements CreationRoleProvider {
-    readonly role: aws.iam.Role;
-    readonly provider: pulumi.ProviderResource;
+    readonly instanceRoles: pulumi.Output<pulumiAws.iam.Role[]>;
     /**
-     * Creates a role provider that can be passed to `new eks.Cluster("test", { creationRoleProvider: ... })`.
-     * This can be used to provide a specific role to use for the creation of the EKS cluster different from
-     * the role being used to run the Pulumi deployment.
-     *
-     * @param name The _unique_ name of this component.
-     * @param args The arguments for this component.
-     * @param opts A bag of options that control this component's behavior.
+     * A kubeconfig that can be used to connect to the EKS cluster.
      */
-    constructor(name: string, args: ClusterCreationRoleProviderOptions, opts?: pulumi.ComponentResourceOptions);
-}
-/**
- * getRoleProvider creates a role provider that can be passed to `new eks.Cluster("test", {
- * creationRoleProvider: ... })`.  This can be used to provide a specific role to use for the
- * creation of the EKS cluster different from the role being used to run the Pulumi deployment.
- */
-export declare function getRoleProvider(name: string, region?: pulumi.Input<aws.Region>, profile?: pulumi.Input<string>, parent?: pulumi.ComponentResource, provider?: pulumi.ProviderResource): CreationRoleProvider;
-/**
- * Create the core components and settings required for the EKS cluster.
- */
-export declare function createCore(name: string, rawArgs: ClusterOptions, parent: pulumi.ComponentResource, provider?: pulumi.ProviderResource): CoreData;
-/**
- * ClusterOptions describes the configuration options accepted by an EKSCluster component.
- */
-export interface ClusterOptions {
+    readonly kubeconfig: pulumi.Output<any>;
     /**
-     * The VPC in which to create the cluster and its worker nodes. If unset, the cluster will be created in the
-     * default VPC.
+     * A kubeconfig that can be used to connect to the EKS cluster as a JSON string.
      */
-    vpcId?: pulumi.Input<string>;
+    readonly kubeconfigJson: pulumi.Output<string>;
     /**
-     * The set of all subnets, public and private, to use for the worker node
-     * groups on the EKS cluster. These subnets are automatically tagged by EKS
-     * for Kubernetes purposes.
-     *
-     * If `vpcId` is not set, the cluster will use the AWS account's default VPC subnets.
-     *
-     * If the list of subnets includes both public and private subnets, the worker
-     * nodes will only be attached to the private subnets, and the public
-     * subnets will be used for internet-facing load balancers.
-     *
-     * See for more details: https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html.
-     *
-     * Note: The use of `subnetIds`, along with `publicSubnetIds`
-     * and/or `privateSubnetIds` is mutually exclusive. The use of
-     * `publicSubnetIds` and `privateSubnetIds` is encouraged.
+     * The security group for the cluster's nodes.
      */
-    subnetIds?: pulumi.Input<pulumi.Input<string>[]>;
+    readonly nodeSecurityGroup: pulumi.Output<pulumiAws.ec2.SecurityGroup>;
     /**
-     * The set of public subnets to use for the worker node groups on the EKS cluster.
-     * These subnets are automatically tagged by EKS for Kubernetes purposes.
-     *
-     * If `vpcId` is not set, the cluster will use the AWS account's default VPC subnets.
-     *
-     * Worker network architecture options:
-     *  - Private-only: Only set `privateSubnetIds`.
-     *    - Default workers to run in a private subnet. In this setting, Kubernetes
-     *    cannot create public, internet-facing load balancers for your pods.
-     *  - Public-only: Only set `publicSubnetIds`.
-     *    - Default workers to run in a public subnet.
-     *  - Mixed (recommended): Set both `privateSubnetIds` and `publicSubnetIds`.
-     *    - Default all worker nodes to run in private subnets, and use the public subnets
-     *  for internet-facing load balancers.
-     *
-     * See for more details: https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html.
+     * Create a Cluster resource with the given unique name, arguments, and options.
      *
-     * Note: The use of `subnetIds`, along with `publicSubnetIds`
-     * and/or `privateSubnetIds` is mutually exclusive. The use of
-     * `publicSubnetIds` and `privateSubnetIds` is encouraged.
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
      */
-    publicSubnetIds?: pulumi.Input<pulumi.Input<string>[]>;
+    constructor(name: string, args?: ClusterArgs, opts?: pulumi.ComponentResourceOptions);
     /**
-     * The set of private subnets to use for the worker node groups on the EKS cluster.
-     * These subnets are automatically tagged by EKS for Kubernetes purposes.
-     *
-     * If `vpcId` is not set, the cluster will use the AWS account's default VPC subnets.
+     * Generate a kubeconfig for cluster authentication that does not use the default AWS credential provider chain, and instead is scoped to the supported options in `KubeconfigOptions`.
      *
-     * Worker network architecture options:
-     *  - Private-only: Only set `privateSubnetIds`.
-     *    - Default workers to run in a private subnet. In this setting, Kubernetes
-     *    cannot create public, internet-facing load balancers for your pods.
-     *  - Public-only: Only set `publicSubnetIds`.
-     *    - Default workers to run in a public subnet.
-     *  - Mixed (recommended): Set both `privateSubnetIds` and `publicSubnetIds`.
-     *    - Default all worker nodes to run in private subnets, and use the public subnets
-     *  for internet-facing load balancers.
+     * The kubeconfig generated is automatically stringified for ease of use with the pulumi/kubernetes provider.
      *
-     * See for more details: https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html.
-     *
-     * Note: The use of `subnetIds`, along with `publicSubnetIds`
-     * and/or `privateSubnetIds` is mutually exclusive. The use of
-     * `publicSubnetIds` and `privateSubnetIds` is encouraged.
-     *
-     * Also consider setting `nodeAssociatePublicIpAddress: false` for
-     * fully private workers.
-     */
-    privateSubnetIds?: pulumi.Input<pulumi.Input<string>[]>;
-    /**
-     * The common configuration settings for NodeGroups.
+     * See for more details:
+     * - https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html
+     * - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html
+     * - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html
      */
-    nodeGroupOptions?: ClusterNodeGroupOptions;
+    getKubeconfig(args?: Cluster.GetKubeconfigArgs): pulumi.Output<Cluster.GetKubeconfigResult>;
+}
+/**
+ * The set of arguments for constructing a Cluster resource.
+ */
+export interface ClusterArgs {
     /**
-     * Whether or not to auto-assign the EKS worker nodes public IP addresses.
-     * If this toggle is set to true, the EKS workers will be
-     * auto-assigned public IPs. If false, they will not be auto-assigned
-     * public IPs.
+     * Access entries to add to the EKS cluster. They can be used to allow IAM principals to access the cluster. Access entries are only supported with authentication mode `API` or `API_AND_CONFIG_MAP`.
+     *
+     * See for more details:
+     * https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html
      */
-    nodeAssociatePublicIpAddress?: boolean;
+    accessEntries?: {
+        [key: string]: inputs.AccessEntryArgs;
+    };
     /**
-     * Optional mappings from AWS IAM roles to Kubernetes users and groups.
-     * Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
+     * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`.
+     *
+     * See for more details:
+     * https://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam
      */
-    roleMappings?: pulumi.Input<pulumi.Input<RoleMapping>[]>;
+    authenticationMode?: enums.AuthenticationMode;
     /**
-     * Optional mappings from AWS IAM users to Kubernetes users and groups.
-     * Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
+     * The security group to use for the cluster API endpoint. If not provided, a new security group will be created with full internet egress and ingress from node groups.
+     *
+     * Note: The security group resource should not contain any inline ingress or egress rules.
      */
-    userMappings?: pulumi.Input<pulumi.Input<UserMapping>[]>;
+    clusterSecurityGroup?: pulumi.Input<pulumiAws.ec2.SecurityGroup>;
     /**
-     * The configuration of the Amazon VPC CNI plugin for this instance. Defaults are described in the documentation
-     * for the VpcCniOptions type.
+     * The tags to apply to the cluster security group.
      */
-    vpcCniOptions?: VpcCniOptions;
+    clusterSecurityGroupTags?: pulumi.Input<{
+        [key: string]: pulumi.Input<string>;
+    }>;
     /**
-     * Use the default VPC CNI instead of creating a custom one. Should not be used in conjunction with `vpcCniOptions`.
+     * The tags to apply to the EKS cluster.
      */
-    useDefaultVpcCni?: boolean;
+    clusterTags?: pulumi.Input<{
+        [key: string]: pulumi.Input<string>;
+    }>;
     /**
-     * The instance type to use for the cluster's nodes. Defaults to "t2.medium".
+     * Options for managing the `coredns` addon.
      */
-    instanceType?: pulumi.Input<aws.ec2.InstanceType | string>;
+    corednsAddonOptions?: inputs.CoreDnsAddonOptionsArgs;
     /**
-     * This enables the simple case of only registering a *single* IAM
-     * instance role with the cluster, that is required to be shared by
-     * *all* node groups in their instance profiles.
+     * Indicates whether an IAM OIDC Provider is created for the EKS cluster.
      *
-     * Note: options `instanceRole` and `instanceRoles` are mutually exclusive.
+     * The OIDC provider is used in the cluster in combination with k8s Service Account annotations to provide IAM roles at the k8s Pod level.
+     *
+     * See for more details:
+     *  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
+     *  - https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
+     *  - https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
+     *  - https://www.pulumi.com/registry/packages/aws/api-docs/eks/cluster/#enabling-iam-roles-for-service-accounts
      */
-    instanceRole?: pulumi.Input<aws.iam.Role>;
+    createOidcProvider?: pulumi.Input<boolean>;
     /**
-     * The default IAM InstanceProfile to use on the Worker NodeGroups, if one is not already set in the NodeGroup.
+     * The IAM Role Provider used to create & authenticate against the EKS cluster. This role is given `[system:masters]` permission in K8S, See: https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html
+     *
+     * Note: This option is only supported with Pulumi nodejs programs. Please use `ProviderCredentialOpts` as an alternative instead.
      */
-    instanceProfileName?: pulumi.Input<string>;
+    creationRoleProvider?: inputs.CreationRoleProviderArgs;
     /**
-     * IAM Service Role for EKS to use to manage the cluster.
+     * List of addons to remove upon creation. Any addon listed will be "adopted" and then removed. This allows for the creation of a baremetal cluster where no addon is deployed and direct management of addons via Pulumi Kubernetes resources. Valid entries are kube-proxy, coredns and vpc-cni. Only works on first creation of a cluster.
      */
-    serviceRole?: pulumi.Input<aws.iam.Role>;
+    defaultAddonsToRemove?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The IAM Role Provider used to create & authenticate against the EKS cluster. This role is given `[system:masters]`
-     * permission in K8S, See: https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html
+     * The number of worker nodes that should be running in the cluster. Defaults to 2.
      */
-    creationRoleProvider?: CreationRoleProvider;
+    desiredCapacity?: pulumi.Input<number>;
     /**
-     * This enables the advanced case of registering *many* IAM instance roles
-     * with the cluster for per node group IAM, instead of the simpler, shared case of `instanceRole`.
-     * Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
+     * Sets the 'enableConfigMapMutable' option on the cluster kubernetes provider.
      *
-     * Note: options `instanceRole` and `instanceRoles` are mutually exclusive.
+     * Applies updates to the aws-auth ConfigMap in place over a replace operation if set to true.
+     * https://www.pulumi.com/registry/packages/kubernetes/api-docs/provider/#enableconfigmapmutable_nodejs
      */
-    instanceRoles?: pulumi.Input<pulumi.Input<aws.iam.Role>[]>;
+    enableConfigMapMutable?: pulumi.Input<boolean>;
     /**
-     * Attach a custom role policy to worker node instance role
-     *
-     * @deprecated This option has been replaced with the use of
-     * `instanceRole` or `instanceRoles`. The role provided to either option
-     * should already include all required policies.
+     * Enable EKS control plane logging. This sends logs to cloudwatch. Possible list of values are: ["api", "audit", "authenticator", "controllerManager", "scheduler"]. By default it is off.
      */
-    customInstanceRolePolicy?: pulumi.Input<string>;
+    enabledClusterLogTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The AMI ID to use for the worker nodes.
-     *
-     * Defaults to the latest recommended EKS Optimized Linux AMI from the
-     * AWS Systems Manager Parameter Store.
-     *
-     * Note: `nodeAmiId` and `gpu` are mutually exclusive.
+     * KMS Key ARN to use with the encryption configuration for the cluster.
      *
+     * Only available on Kubernetes 1.13+ clusters created after March 6, 2020.
      * See for more details:
-     * - https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html.
+     * - https://aws.amazon.com/about-aws/whats-new/2020/03/amazon-eks-adds-envelope-encryption-for-secrets-with-aws-kms/
      */
-    nodeAmiId?: pulumi.Input<string>;
+    encryptionConfigKeyArn?: pulumi.Input<string>;
+    /**
+     * Indicates whether or not the Amazon EKS private API server endpoint is enabled. Default is `false`.
+     */
+    endpointPrivateAccess?: pulumi.Input<boolean>;
+    /**
+     * Indicates whether or not the Amazon EKS public API server endpoint is enabled. Default is `true`.
+     */
+    endpointPublicAccess?: pulumi.Input<boolean>;
     /**
-     * Use the latest recommended EKS Optimized Linux AMI with GPU support for
-     * the worker nodes from the AWS Systems Manager Parameter Store.
+     * Add support for launching pods in Fargate. Defaults to launching pods in the `default` namespace.  If specified, the default node group is skipped as though `skipDefaultNodeGroup: true` had been passed.
+     */
+    fargate?: pulumi.Input<boolean | inputs.FargateProfileArgs>;
+    /**
+     * Use the latest recommended EKS Optimized Linux AMI with GPU support for the worker nodes from the AWS Systems Manager Parameter Store.
      *
      * Defaults to false.
      *
      * Note: `gpu` and `nodeAmiId` are mutually exclusive.
      *
      * See for more details:
-     * - https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html.
+     * - https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html
      * - https://docs.aws.amazon.com/eks/latest/userguide/retrieve-ami-id.html
      */
     gpu?: pulumi.Input<boolean>;
     /**
-     * Public key material for SSH access to worker nodes. See allowed formats at:
-     * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html
-     * If not provided, no SSH access is enabled on VMs.
-     */
-    nodePublicKey?: pulumi.Input<string>;
-    /**
-     * The subnets to use for worker nodes. Defaults to the value of subnetIds.
+     * The default IAM InstanceProfile to use on the Worker NodeGroups, if one is not already set in the NodeGroup.
      */
-    nodeSubnetIds?: pulumi.Input<pulumi.Input<string>[]>;
+    instanceProfileName?: pulumi.Input<string>;
     /**
-     * The security group to use for the cluster API endpoint.  If not provided, a new security group will be created
-     * with full internet egress and ingress from node groups.
+     * This enables the simple case of only registering a *single* IAM instance role with the cluster, that is required to be shared by *all* node groups in their instance profiles.
      *
-     * Note: The security group resource should not contain any inline ingress or egress rules.
-     */
-    clusterSecurityGroup?: aws.ec2.SecurityGroup;
-    /**
-     * The tags to apply to the cluster security group.
-     */
-    clusterSecurityGroupTags?: InputTags;
-    /**
-     * Encrypt the root block device of the nodes in the node group.
+     * Note: options `instanceRole` and `instanceRoles` are mutually exclusive.
      */
-    nodeRootVolumeEncrypted?: pulumi.Input<boolean>;
+    instanceRole?: pulumi.Input<pulumiAws.iam.Role>;
     /**
-     * The tags to apply to the default `nodeSecurityGroup` created by the cluster.
+     * This enables the advanced case of registering *many* IAM instance roles with the cluster for per node group IAM, instead of the simpler, shared case of `instanceRole`.
      *
-     * Note: The `nodeSecurityGroupTags` option and the node group option
-     * `nodeSecurityGroup` are mutually exclusive.
+     * Note: options `instanceRole` and `instanceRoles` are mutually exclusive.
      */
-    nodeSecurityGroupTags?: InputTags;
+    instanceRoles?: pulumi.Input<pulumi.Input<pulumiAws.iam.Role>[]>;
     /**
-     * The size in GiB of a cluster node's root volume. Defaults to 20.
+     * The instance type to use for the cluster's nodes. Defaults to "t3.medium".
      */
-    nodeRootVolumeSize?: pulumi.Input<number>;
+    instanceType?: pulumi.Input<string>;
     /**
-     * Extra code to run on node startup. This code will run after the AWS EKS bootstrapping code and before the node
-     * signals its readiness to the managing CloudFormation stack. This code must be a typical user data script:
-     * critically it must begin with an interpreter directive (i.e. a `#!`).
+     * The IP family used to assign Kubernetes pod and service addresses. Valid values are `ipv4` (default) and `ipv6`.
+     * You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.
      */
-    nodeUserData?: pulumi.Input<string>;
+    ipFamily?: pulumi.Input<string>;
     /**
-     * The number of worker nodes that should be running in the cluster. Defaults to 2.
+     * Options for managing the `kube-proxy` addon.
      */
-    desiredCapacity?: pulumi.Input<number>;
+    kubeProxyAddonOptions?: inputs.KubeProxyAddonOptionsArgs;
     /**
-     * The minimum number of worker nodes running in the cluster. Defaults to 1.
+     * The CIDR block to assign Kubernetes service IP addresses from. If you don't
+     * specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or
+     * 172.20.0.0/16 CIDR blocks. This setting only applies to IPv4 clusters. We recommend that you specify a block
+     * that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify
+     * a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created.
+     *
+     * The block must meet the following requirements:
+     * - Within one of the following private IP address blocks: 10.0.0.0/8, 172.16.0.0.0/12, or 192.168.0.0/16.
+     * - Doesn't overlap with any CIDR block assigned to the VPC that you selected for VPC.
+     * - Between /24 and /12.
      */
-    minSize?: pulumi.Input<number>;
+    kubernetesServiceIpAddressRange?: pulumi.Input<string>;
     /**
      * The maximum number of worker nodes running in the cluster. Defaults to 2.
      */
     maxSize?: pulumi.Input<number>;
     /**
-     * An optional set of StorageClasses to enable for the cluster. If this is a single volume type rather than a map,
-     * a single StorageClass will be created for that volume type.
-     *
-     * Note: As of Kubernetes v1.11+ on EKS, a default `gp2` storage class will
-     * always be created automatically for the cluster by the EKS service. See
-     * https://docs.aws.amazon.com/eks/latest/userguide/storage-classes.html
-     */
-    storageClasses?: {
-        [name: string]: StorageClass;
-    } | EBSVolumeType;
-    /**
-     * If this toggle is set to true, the EKS cluster will be created without node group attached.
-     * Defaults to false, unless `fargate` input is provided.
+     * The minimum number of worker nodes running in the cluster. Defaults to 1.
      */
-    skipDefaultNodeGroup?: boolean;
+    minSize?: pulumi.Input<number>;
     /**
-     * Whether or not to deploy the Kubernetes dashboard to the cluster. If the dashboard is deployed, it can be
-     * accessed as follows:
-     *
-     * 1. Retrieve an authentication token for the dashboard by running the following and copying the value of `token`
-     *   from the output of the last command:
-     *
-     *     $ kubectl -n kube-system get secret | grep eks-admin | awk '{print $1}'
-     *     $ kubectl -n kube-system describe secret <output from previous command>
+     * The cluster's physical resource name.
      *
-     * 2. Start the kubectl proxy:
+     * If not specified, the default is to use auto-naming for the cluster's name, resulting in a physical name with the format `${name}-eksCluster-0123abcd`.
      *
-     *     $ kubectl proxy
+     * See for more details: https://www.pulumi.com/docs/intro/concepts/programming-model/#autonaming
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * The AMI ID to use for the worker nodes.
      *
-     * 3. Open `http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/` in a
-     *    web browser.
-     * 4. Choose `Token` authentication, paste the token retrieved earlier into the `Token` field, and sign in.
+     * Defaults to the latest recommended EKS Optimized Linux AMI from the AWS Systems Manager Parameter Store.
      *
-     * Defaults to `false`.
+     * Note: `nodeAmiId` and `gpu` are mutually exclusive.
      *
-     * @deprecated This option has been deprecated due to a lack of
-     * support for it on EKS, and the general community recommendation to avoid
-     * using it for security concerns. If you'd like alternatives to deploy the
-     * dashboard, consider writing it in Pulumi, or using the Helm chart.
-     */
-    deployDashboard?: boolean;
-    /**
-     * Key-value mapping of tags that are automatically applied to all AWS
-     * resources directly under management with this cluster, which support tagging.
+     * See for more details:
+     * - https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html.
      */
-    tags?: InputTags;
+    nodeAmiId?: pulumi.Input<string>;
     /**
-     * Desired Kubernetes master / control plane version. If you do not specify a value, the latest available version is used.
+     * Whether or not to auto-assign the EKS worker nodes public IP addresses. If this toggle is set to true, the EKS workers will be auto-assigned public IPs. If false, they will not be auto-assigned public IPs.
      */
-    version?: pulumi.Input<string>;
+    nodeAssociatePublicIpAddress?: boolean;
     /**
-     * Enable EKS control plane logging. This sends logs to cloudwatch.
-     * Possible list of values are: ["api", "audit", "authenticator", "controllerManager", "scheduler"].
-     * By default it is off.
+     * The common configuration settings for NodeGroups.
      */
-    enabledClusterLogTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    nodeGroupOptions?: inputs.ClusterNodeGroupOptionsArgs;
     /**
-     * List of addons to remove upon creation. Any addon listed will be "adopted" and then removed.
-     * This allows for the creation of a baremetal cluster where no addon is deployed and direct management of addons via Pulumi Kubernetes resources.
-     * Valid entries are kube-proxy, coredns and vpc-cni. Only works on first creation of a cluster.
+     * Public key material for SSH access to worker nodes. See allowed formats at:
+     * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html
+     * If not provided, no SSH access is enabled on VMs.
      */
-    defaultAddonsToRemove?: pulumi.Input<pulumi.Input<string>[]>;
+    nodePublicKey?: pulumi.Input<string>;
     /**
-     * Indicates whether or not the Amazon EKS public API server endpoint is enabled. Default is `true`.
+     * Encrypt the root block device of the nodes in the node group.
      */
-    endpointPublicAccess?: pulumi.Input<boolean>;
+    nodeRootVolumeEncrypted?: pulumi.Input<boolean>;
     /**
-     * Indicates whether or not the Amazon EKS private API server endpoint is enabled.  The default is `false`.
+     * The size in GiB of a cluster node's root volume. Defaults to 20.
      */
-    endpointPrivateAccess?: pulumi.Input<boolean>;
+    nodeRootVolumeSize?: pulumi.Input<number>;
     /**
-     * Indicates which CIDR blocks can access the Amazon EKS public API server endpoint.
+     * The tags to apply to the default `nodeSecurityGroup` created by the cluster.
+     *
+     * Note: The `nodeSecurityGroupTags` option and the node group option `nodeSecurityGroup` are mutually exclusive.
      */
-    publicAccessCidrs?: pulumi.Input<pulumi.Input<string>[]>;
+    nodeSecurityGroupTags?: pulumi.Input<{
+        [key: string]: pulumi.Input<string>;
+    }>;
     /**
-     * Add support for launching pods in Fargate.  Defaults to launching pods in the `default`
-     * namespace.  If specified, the default node group is skipped as though `skipDefaultNodeGroup:
-     * true` had been passed.
+     * The subnets to use for worker nodes. Defaults to the value of subnetIds.
      */
-    fargate?: pulumi.Input<boolean | FargateProfile>;
+    nodeSubnetIds?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The tags to apply to the EKS cluster.
+     * Extra code to run on node startup. This code will run after the AWS EKS bootstrapping code and before the node signals its readiness to the managing CloudFormation stack. This code must be a typical user data script: critically it must begin with an interpreter directive (i.e. a `#!`).
      */
-    clusterTags?: InputTags;
+    nodeUserData?: pulumi.Input<string>;
     /**
-     * Indicates whether an IAM OIDC Provider is created for the EKS cluster.
+     * The set of private subnets to use for the worker node groups on the EKS cluster. These subnets are automatically tagged by EKS for Kubernetes purposes.
      *
-     * The OIDC provider is used in the cluster in combination with k8s
-     * Service Account annotations to provide IAM roles at the k8s Pod level.
+     * If `vpcId` is not set, the cluster will use the AWS account's default VPC subnets.
      *
-     * See for more details:
-     * - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
-     * - https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
-     * - https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
-     * - https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/aws/eks/#enabling-iam-roles-for-service-accounts
+     * Worker network architecture options:
+     *  - Private-only: Only set `privateSubnetIds`.
+     *    - Default workers to run in a private subnet. In this setting, Kubernetes cannot create public, internet-facing load balancers for your pods.
+     *  - Public-only: Only set `publicSubnetIds`.
+     *    - Default workers to run in a public subnet.
+     *  - Mixed (recommended): Set both `privateSubnetIds` and `publicSubnetIds`.
+     *    - Default all worker nodes to run in private subnets, and use the public subnets for internet-facing load balancers.
+     *
+     * See for more details: https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html.Note: The use of `subnetIds`, along with `publicSubnetIds` and/or `privateSubnetIds` is mutually exclusive. The use of `publicSubnetIds` and `privateSubnetIds` is encouraged.
+     *
+     * Also consider setting `nodeAssociatePublicIpAddress: false` for fully private workers.
      */
-    createOidcProvider?: pulumi.Input<boolean>;
+    privateSubnetIds?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The cluster's physical resource name.
+     * The AWS provider credential options to scope the cluster's kubeconfig authentication when using a non-default credential chain.
      *
-     * If not specified, the default is to use auto-naming for the cluster's
-     * name, resulting in a physical name with the format `${name}-eksCluster-0123abcd`.
+     * This is required for certain auth scenarios. For example:
+     * - Creating and using a new AWS provider instance, or
+     * - Setting the AWS_PROFILE environment variable, or
+     * - Using a named profile configured on the AWS provider via:
+     * `pulumi config set aws:profile <profileName>`
      *
      * See for more details:
-     * https://www.pulumi.com/docs/intro/concepts/programming-model/#autonaming
+     * - https://www.pulumi.com/registry/packages/aws/api-docs/provider/
+     * - https://www.pulumi.com/docs/intro/cloud-providers/aws/setup/
+     * - https://www.pulumi.com/docs/intro/cloud-providers/aws/#configuration
+     * - https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html
      */
-    name?: pulumi.Input<string>;
+    providerCredentialOpts?: pulumi.Input<inputs.KubeconfigOptionsArgs>;
     /**
      * The HTTP(S) proxy to use within a proxied environment.
      *
-     * The proxy is used during cluster creation, and OIDC configuration.
+     *  The proxy is used during cluster creation, and OIDC configuration.
      *
-     * This is an alternative option to setting the proxy environment variables:
-     * HTTP(S)_PROXY and/or http(s)_proxy.
+     * This is an alternative option to setting the proxy environment variables: HTTP(S)_PROXY and/or http(s)_proxy.
      *
      * This option is required iff the proxy environment variables are not set.
      *
@@ -497,266 +360,109 @@ export interface ClusterOptions {
      */
     proxy?: string;
     /**
-     * The AWS provider credential options to scope the cluster's kubeconfig
-     * authentication when using a non-default credential chain.
-     *
-     * This is required for certain auth scenarios. For example:
-     * - Creating and using a new AWS provider instance, or
-     * - Setting the AWS_PROFILE environment variable, or
-     * - Using a named profile configured on the AWS provider via:
-     * `pulumi config set aws:profile <profileName>`
-     *
-     * See for more details:
-     * - https://www.pulumi.com/registry/packages/aws/api-docs/provider/
-     * - https://www.pulumi.com/docs/intro/cloud-providers/aws/setup/
-     * - https://www.pulumi.com/docs/intro/cloud-providers/aws/#configuration
-     * - https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html
-     */
-    providerCredentialOpts?: pulumi.Input<KubeconfigOptions>;
-    /**
-     * Sets the 'enableConfigMapMutable' option on the cluster kubernetes provider.
-     * Applies updates to the aws-auth ConfigMap in place over a replace operation if set to true.
-     * https://www.pulumi.com/registry/packages/kubernetes/api-docs/provider/#enableconfigmapmutable_nodejs
+     * Indicates which CIDR blocks can access the Amazon EKS public API server endpoint.
      */
-    enableConfigMapMutable?: pulumi.Input<boolean>;
+    publicAccessCidrs?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * KMS Key ARN to use with the encryption configuration for the cluster.
+     * The set of public subnets to use for the worker node groups on the EKS cluster. These subnets are automatically tagged by EKS for Kubernetes purposes.
      *
-     * Only available on Kubernetes 1.13+ clusters created after March 6, 2020.
-     * See for more details:
-     * - https://aws.amazon.com/about-aws/whats-new/2020/03/amazon-eks-adds-envelope-encryption-for-secrets-with-aws-kms/
-     */
-    encryptionConfigKeyArn?: pulumi.Input<string>;
-    /**
-     * The CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns
-     * addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that
-     * does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify
-     * a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created.
+     * If `vpcId` is not set, the cluster will use the AWS account's default VPC subnets.
      *
-     * The block must meet the following requirements:
-     * - Within one of the following private IP address blocks: 10.0.0.0/8, 172.16.0.0.0/12, or 192.168.0.0/16.
-     * - Doesn't overlap with any CIDR block assigned to the VPC that you selected for VPC.
-     * - Between /24 and /12.
-     */
-    kubernetesServiceIpAddressRange?: pulumi.Input<string>;
-    /**
-     * The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6.
-     * You can only specify an IP family when you create a cluster, changing this value will force
-     * a new cluster to be created.
-     */
-    ipFamily?: pulumi.Input<string>;
-    /**
-     * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
-     * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam
-     */
-    authenticationMode?: AuthenticationMode;
-    /**
-     * Access entries to add to the EKS cluster. They can be used to allow IAM principals to access the cluster.
-     * Access entries are only supported with authentication mode `API` or `API_AND_CONFIG_MAP`.
+     * Worker network architecture options:
+     *  - Private-only: Only set `privateSubnetIds`.
+     *    - Default workers to run in a private subnet. In this setting, Kubernetes cannot create public, internet-facing load balancers for your pods.
+     *  - Public-only: Only set `publicSubnetIds`.
+     *    - Default workers to run in a public subnet.
+     *  - Mixed (recommended): Set both `privateSubnetIds` and `publicSubnetIds`.
+     *    - Default all worker nodes to run in private subnets, and use the public subnets for internet-facing load balancers.
      *
-     * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/access-entries.html
-     */
-    accessEntries?: {
-        [key: string]: AccessEntry;
-    };
-}
-/**
- * FargateProfile defines how Kubernetes pods are executed in Fargate. See
- * aws.eks.FargateProfileArgs for reference.
- */
-export interface FargateProfile {
-    /**
-     * Specify a custom role to use for executing pods in Fargate. Defaults to creating a new role
-     * with the `arn:[partition]:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy` policy attached.
-     */
-    podExecutionRoleArn?: pulumi.Input<string>;
-    /**
-     * Specify the subnets in which to execute Fargate tasks for pods.  Defaults to the private
-     * subnets associated with the cluster.
-     */
-    subnetIds?: pulumi.Input<pulumi.Input<string>[]>;
-    /**
-     * Specify the namespace and label selectors to use for launching pods into Fargate.
+     * See for more details: https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html.Note: The use of `subnetIds`, along with `publicSubnetIds` and/or `privateSubnetIds` is mutually exclusive. The use of `publicSubnetIds` and `privateSubnetIds` is encouraged.
      */
-    selectors?: pulumi.Input<pulumi.Input<aws.types.input.eks.FargateProfileSelector>[]>;
-}
-/**
- * ClusterNodeGroupOptions describes the configuration options accepted by a cluster
- * to create its own node groups. It's a subset of NodeGroupOptions.
- */
-export interface ClusterNodeGroupOptions extends NodeGroupBaseOptions {
-}
-export interface AccessEntry {
+    publicSubnetIds?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The IAM Principal ARN which requires Authentication access to the EKS cluster.
+     * Optional mappings from AWS IAM roles to Kubernetes users and groups. Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`
      */
-    principalArn: pulumi.Input<string>;
+    roleMappings?: pulumi.Input<pulumi.Input<inputs.RoleMappingArgs>[]>;
     /**
-     * Defaults to the principalArn if the principal is a user, else defaults to assume-role/session-name.
+     * IAM Service Role for EKS to use to manage the cluster.
      */
-    username?: pulumi.Input<string>;
+    serviceRole?: pulumi.Input<pulumiAws.iam.Role>;
     /**
-     * A list of groups within Kubernetes to which the IAM principal is mapped to.
+     * If this toggle is set to true, the EKS cluster will be created without node group attached. Defaults to false, unless `fargate` input is provided.
      */
-    kubernetesGroups?: pulumi.Input<pulumi.Input<string>[]>;
+    skipDefaultNodeGroup?: boolean;
     /**
-     * The access policies to associate to the access entry.
+     * An optional set of StorageClasses to enable for the cluster. If this is a single volume type rather than a map, a single StorageClass will be created for that volume type.
+     *
+     * Note: As of Kubernetes v1.11+ on EKS, a default `gp2` storage class will always be created automatically for the cluster by the EKS service. See https://docs.aws.amazon.com/eks/latest/userguide/storage-classes.html
      */
-    accessPolicies?: {
-        [key: string]: pulumi.Input<AccessPolicyAssociation>;
+    storageClasses?: string | {
+        [key: string]: inputs.StorageClassArgs;
     };
     /**
-     * The tags to apply to the AccessEntry.
-     */
-    tags?: InputTags;
-    /**
-     * The type of the new access entry. Valid values are STANDARD, FARGATE_LINUX, EC2_LINUX, and EC2_WINDOWS.
+     * The set of all subnets, public and private, to use for the worker node groups on the EKS cluster. These subnets are automatically tagged by EKS for Kubernetes purposes.
      *
-     * Defaults to STANDARD which provides the standard workflow. EC2_LINUX and EC2_WINDOWS types disallow users
-     * to input a kubernetesGroup, and prevent associating access policies..
-     */
-    type?: pulumi.Input<AccessEntryType>;
-}
-export interface AccessPolicyAssociation {
-    /**
-     * The ARN of the access policy to associate with the principal
-     */
-    policyArn: pulumi.Input<string>;
-    /**
-     * The scope of the access policy association. This controls whether the access policy is scoped to the cluster or to a particular namespace.
-     */
-    accessScope: aws.types.input.eks.AccessPolicyAssociationAccessScope;
-}
-export declare const AuthenticationMode: {
-    /**
-     * Only Access Entries will be used for authenticating to the Kubernetes API.
-     */
-    readonly API: "API";
-    /**
-     * Only aws-auth ConfigMap will be used for authenticating to the Kubernetes API.
+     * If `vpcId` is not set, the cluster will use the AWS account's default VPC subnets.
      *
-     * @deprecated The aws-auth ConfigMap is deprecated. The recommended method to manage access to Kubernetes APIs is Access Entries with the AuthenticationMode API.
-     * For more information and instructions how to upgrade, see https://docs.aws.amazon.com/eks/latest/userguide/migrating-access-entries.html.
-     */
-    readonly CONFIG_MAP: "CONFIG_MAP";
-    /**
-     * Both aws-auth ConfigMap and Access Entries can be used for authenticating to the Kubernetes API.
+     * If the list of subnets includes both public and private subnets, the worker nodes will only be attached to the private subnets, and the public subnets will be used for internet-facing load balancers.
      *
-     * @deprecated The aws-auth ConfigMap is deprecated. The recommended method to manage access to Kubernetes APIs is Access Entries with the AuthenticationMode API.
-     * For more information and instructions how to upgrade, see https://docs.aws.amazon.com/eks/latest/userguide/migrating-access-entries.html.
-     */
-    readonly API_AND_CONFIG_MAP: "API_AND_CONFIG_MAP";
-};
-/**
- * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
- * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam
- */
-export type AuthenticationMode = (typeof AuthenticationMode)[keyof typeof AuthenticationMode];
-export declare const AccessEntryType: {
-    /**
-     * Standard Access Entry Workflow. Allows users to input a username and kubernetesGroup, and to associate access policies.
-     */
-    readonly STANDARD: "STANDARD";
-    /**
-     * For IAM roles used with AWS Fargate profiles.
-     */
-    readonly FARGATE_LINUX: "FARGATE_LINUX";
-    /**
-     * For IAM roles associated with self-managed Linux node groups. Allows the nodes to join the cluster.
-     */
-    readonly EC2_LINUX: "EC2_LINUX";
-    /**
-     * For IAM roles associated with self-managed Windows node groups. Allows the nodes to join the cluster.
-     */
-    readonly EC2_WINDOWS: "EC2_WINDOWS";
-};
-/**
- * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
- * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam
- */
-export type AccessEntryType = (typeof AccessEntryType)[keyof typeof AccessEntryType];
-/**
- * Cluster is a component that wraps the AWS and Kubernetes resources necessary to run an EKS cluster, its worker
- * nodes, its optional StorageClasses, and an optional deployment of the Kubernetes Dashboard.
- */
-export declare class Cluster extends pulumi.ComponentResource {
-    /**
-     * A kubeconfig that can be used to connect to the EKS cluster.
-     */
-    readonly kubeconfig: pulumi.Output<any>;
-    /**
-     * A kubeconfig that can be used to connect to the EKS cluster as a JSON string.
-     */
-    readonly kubeconfigJson: pulumi.Output<string>;
-    /**
-     * The AWS resource provider.
-     */
-    readonly awsProvider: pulumi.ProviderResource;
-    /**
-     * A Kubernetes resource provider that can be used to deploy into this cluster. For example, the code below will
-     * create a new Pod in the EKS cluster.
-     *
-     *     let eks = new Cluster("eks");
-     *     let pod = new kubernetes.core.v1.Pod("pod", { ... }, { provider: eks.provider });
+     * See for more details: https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html.
      *
+     * Note: The use of `subnetIds`, along with `publicSubnetIds` and/or `privateSubnetIds` is mutually exclusive. The use of `publicSubnetIds` and `privateSubnetIds` is encouraged.
      */
-    readonly provider: k8s.Provider;
-    /**
-     * The security group for the EKS cluster.
-     */
-    readonly clusterSecurityGroup: aws.ec2.SecurityGroup;
-    /**
-     * The service roles used by the EKS cluster.
-     */
-    readonly instanceRoles: pulumi.Output<aws.iam.Role[]>;
-    /**
-     * The security group for the cluster's nodes.
-     */
-    readonly nodeSecurityGroup: aws.ec2.SecurityGroup;
-    /**
-     * The ingress rule that gives node group access to cluster API server
-     */
-    readonly eksClusterIngressRule: aws.ec2.SecurityGroupRule;
+    subnetIds?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The default Node Group configuration, or undefined if `skipDefaultNodeGroup` was specified.
+     * Key-value mapping of tags that are automatically applied to all AWS resources directly under management with this cluster, which support tagging.
      */
-    readonly defaultNodeGroup: NodeGroupData | undefined;
+    tags?: pulumi.Input<{
+        [key: string]: pulumi.Input<string>;
+    }>;
     /**
-     * The EKS cluster.
+     * Use the default VPC CNI instead of creating a custom one. Should not be used in conjunction with `vpcCniOptions`.
      */
-    readonly eksCluster: aws.eks.Cluster;
+    useDefaultVpcCni?: boolean;
     /**
-     * The EKS cluster and its dependencies.
+     * Optional mappings from AWS IAM users to Kubernetes users and groups. Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
      */
-    readonly core: CoreData;
+    userMappings?: pulumi.Input<pulumi.Input<inputs.UserMappingArgs>[]>;
     /**
-     * Create a new EKS cluster with worker nodes, optional storage classes, and deploy the Kubernetes Dashboard if
-     * requested.
-     *
-     * @param name The _unique_ name of this component.
-     * @param args The arguments for this cluster.
-     * @param opts A bag of options that control this component's behavior.
+     * Desired Kubernetes master / control plane version. If you do not specify a value, the latest available version is used.
      */
-    constructor(name: string, args?: ClusterOptions, opts?: pulumi.ComponentResourceOptions);
+    version?: pulumi.Input<string>;
     /**
-     * Create a self-managed node group using CloudFormation and an ASG.
-     *
-     * See for more details:
-     * https://docs.aws.amazon.com/eks/latest/userguide/worker.html
+     * The configuration of the Amazon VPC CNI plugin for this instance. Defaults are described in the documentation for the VpcCniOptions type.
      */
-    createNodeGroup(name: string, args: ClusterNodeGroupOptions): NodeGroup;
+    vpcCniOptions?: inputs.VpcCniOptionsArgs;
     /**
-     * Generate a kubeconfig for cluster authentication that does not use the
-     * default AWS credential provider chain, and instead is scoped to
-     * the supported options in `KubeconfigOptions`.
-     *
-     * The kubeconfig generated is automatically stringified for ease of use
-     * with the pulumi/kubernetes provider.
-     *
-     * See for more details:
-     * - https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html
-     * - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html
-     * - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html
+     * The VPC in which to create the cluster and its worker nodes. If unset, the cluster will be created in the default VPC.
      */
-    getKubeconfig(args: KubeconfigOptions): pulumi.Output<string>;
+    vpcId?: pulumi.Input<string>;
+}
+export declare namespace Cluster {
+    /**
+     * The set of arguments for the Cluster.getKubeconfig method.
+     */
+    interface GetKubeconfigArgs {
+        /**
+         * AWS credential profile name to always use instead of the default AWS credential provider chain.
+         *
+         * The profile is passed to kubeconfig as an authentication environment setting.
+         */
+        profileName?: pulumi.Input<string>;
+        /**
+         * Role ARN to assume instead of the default AWS credential provider chain.
+         *
+         * The role is passed to kubeconfig as an authentication exec argument.
+         */
+        roleArn?: pulumi.Input<string>;
+    }
+    /**
+     * The results of the Cluster.getKubeconfig method.
+     */
+    interface GetKubeconfigResult {
+        /**
+         * The kubeconfig for the cluster.
+         */
+        readonly result: string;
+    }
 }