@pulumi/eks 2.8.1 → 3.0.0-alpha.6

package/cluster.js

@@ -1,832 +1,133 @@
 "use strict";
-// Copyright 2016-2022, Pulumi Corporation.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
+// *** WARNING: this file was generated by pulumi-gen-eks. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClusterInternal = exports.createCluster = exports.Cluster = exports.AccessEntryType = exports.AuthenticationMode = exports.createCore = exports.getRoleProvider = exports.ClusterCreationRoleProvider = exports.generateKubeconfig = void 0;
-const aws = require("@pulumi/aws");
-const k8s = require("@pulumi/kubernetes");
+exports.Cluster = void 0;
 const pulumi = require("@pulumi/pulumi");
-const childProcess = require("child_process");
-const fs = require("fs");
-const https = require("https");
-const HttpsProxyAgent = require("https-proxy-agent");
-const process = require("process");
-const tmp = require("tmp");
-const url = require("url");
-const authenticationMode_1 = require("./authenticationMode");
-const cert_thumprint_1 = require("./cert-thumprint");
-const cni_1 = require("./cni");
-const dashboard_1 = require("./dashboard");
-const dependencies_1 = require("./dependencies");
-const nodegroup_1 = require("./nodegroup");
-const securitygroup_1 = require("./securitygroup");
-const servicerole_1 = require("./servicerole");
-const storageclass_1 = require("./storageclass");
-function createOrGetInstanceProfile(name, parent, instanceRoleName, instanceProfileName, provider) {
-    let instanceProfile;
-    if (instanceProfileName) {
-        instanceProfile = aws.iam.InstanceProfile.get(`${name}-instanceProfile`, instanceProfileName, undefined, { parent, provider });
-    }
-    else {
-        instanceProfile = new aws.iam.InstanceProfile(`${name}-instanceProfile`, {
-            role: instanceRoleName,
-        }, { parent, provider });
-    }
-    return instanceProfile;
-}
-/** @internal */
-function generateKubeconfig(clusterName, clusterEndpoint, includeProfile, certData, opts) {
-    let args = ["eks", "get-token", "--cluster-name", clusterName, "--output", "json"];
-    const env = [
-        {
-            name: "KUBERNETES_EXEC_INFO",
-            value: `{"apiVersion": "client.authentication.k8s.io/v1beta1"}`,
-        },
-    ];
-    if (opts === null || opts === void 0 ? void 0 : opts.roleArn) {
-        args = [...args, "--role", opts.roleArn];
-    }
-    if (includeProfile && (opts === null || opts === void 0 ? void 0 : opts.profileName)) {
-        env.push({ name: "AWS_PROFILE", value: opts.profileName });
-    }
-    return pulumi.all([args, env]).apply(([tokenArgs, envvars]) => {
-        return {
-            apiVersion: "v1",
-            clusters: [
-                {
-                    cluster: {
-                        server: clusterEndpoint,
-                        "certificate-authority-data": certData,
-                    },
-                    name: "kubernetes",
-                },
-            ],
-            contexts: [
-                {
-                    context: {
-                        cluster: "kubernetes",
-                        user: "aws",
-                    },
-                    name: "aws",
-                },
-            ],
-            "current-context": "aws",
-            kind: "Config",
-            users: [
-                {
-                    name: "aws",
-                    user: {
-                        exec: {
-                            apiVersion: "client.authentication.k8s.io/v1beta1",
-                            command: "aws",
-                            args: tokenArgs,
-                            env: envvars,
-                        },
-                    },
-                },
-            ],
-        };
-    });
-}
-exports.generateKubeconfig = generateKubeconfig;
+const inputs = require("./types/input");
+const utilities = require("./utilities");
 /**
- * ClusterCreationRoleProvider is a component that wraps creating a role provider that can be passed to
- * `new eks.Cluster("test", { creationRoleProvider: ... })`. This can be used to provide a
- * specific role to use for the creation of the EKS cluster different from the role being used
- * to run the Pulumi deployment.
+ * Cluster is a component that wraps the AWS and Kubernetes resources necessary to run an EKS cluster, its worker nodes, its optional StorageClasses, and an optional deployment of the Kubernetes Dashboard.
+ *
+ * ## Example Usage
+ *
+ * ### Provisioning a New EKS Cluster
+ *
+ * <!--Start PulumiCodeChooser -->
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as eks from "@pulumi/eks";
+ *
+ * // Create an EKS cluster with the default configuration.
+ * const cluster = new eks.Cluster("cluster", {});
+ *
+ * // Export the cluster's kubeconfig.
+ * export const kubeconfig = cluster.kubeconfig;
+ * ```
+ * <!--End PulumiCodeChooser -->
  */
-class ClusterCreationRoleProvider extends pulumi.ComponentResource {
+class Cluster extends pulumi.ComponentResource {
     /**
-     * Creates a role provider that can be passed to `new eks.Cluster("test", { creationRoleProvider: ... })`.
-     * This can be used to provide a specific role to use for the creation of the EKS cluster different from
-     * the role being used to run the Pulumi deployment.
-     *
-     * @param name The _unique_ name of this component.
-     * @param args The arguments for this component.
-     * @param opts A bag of options that control this component's behavior.
+     * Returns true if the given object is an instance of Cluster.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
      */
-    constructor(name, args, opts) {
-        super("eks:index:ClusterCreationRoleProvider", name, args, opts);
-        const result = getRoleProvider(name, args === null || args === void 0 ? void 0 : args.region, args === null || args === void 0 ? void 0 : args.profile, this, opts === null || opts === void 0 ? void 0 : opts.provider);
-        this.role = result.role;
-        this.provider = result.provider;
-        this.registerOutputs(undefined);
-    }
-}
-exports.ClusterCreationRoleProvider = ClusterCreationRoleProvider;
-/**
- * getRoleProvider creates a role provider that can be passed to `new eks.Cluster("test", {
- * creationRoleProvider: ... })`.  This can be used to provide a specific role to use for the
- * creation of the EKS cluster different from the role being used to run the Pulumi deployment.
- */
-function getRoleProvider(name, region, profile, parent, provider) {
-    const partition = aws.getPartitionOutput({}, { parent }).partition;
-    const accountId = pulumi.output(aws.getCallerIdentity({}, { parent })).accountId;
-    const iamRole = new aws.iam.Role(`${name}-eksClusterCreatorRole`, {
-        assumeRolePolicy: pulumi.interpolate `{
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "arn:${partition}:iam::${accountId}:root"
-                },
-                "Action": "sts:AssumeRole"
-                }
-            ]
-        }`,
-        description: `Admin access to eks-${name}`,
-    }, { parent, provider });
-    // `eks:*` is needed to create/read/update/delete the EKS cluster, `iam:PassRole` is needed to pass the EKS service role to the cluster
-    // https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html
-    const rolePolicy = new aws.iam.RolePolicy(`${name}-eksClusterCreatorPolicy`, {
-        role: iamRole,
-        policy: {
-            Version: "2012-10-17",
-            Statement: [
-                {
-                    Effect: "Allow",
-                    Action: "eks:*",
-                    Resource: "*",
-                },
-                {
-                    Effect: "Allow",
-                    Action: "iam:PassRole",
-                    Resource: "*",
-                },
-            ],
-        },
-    }, { parent: iamRole, provider });
-    const creatorProvider = new aws.Provider(`${name}-eksClusterCreatorEntity`, {
-        region: region,
-        profile: profile,
-        assumeRole: {
-            roleArn: iamRole.arn.apply((arn) => __awaiter(this, void 0, void 0, function* () {
-                // wait 30 seconds to assume the IAM Role https://github.com/pulumi/pulumi-aws/issues/673
-                if (!pulumi.runtime.isDryRun()) {
-                    yield new Promise((resolve) => setTimeout(resolve, 30 * 1000));
-                }
-                return arn;
-            })),
-        },
-    }, { parent: iamRole, provider });
-    return {
-        role: iamRole,
-        provider: creatorProvider,
-    };
-}
-exports.getRoleProvider = getRoleProvider;
-/**
- * Create the core components and settings required for the EKS cluster.
- */
-function createCore(name, rawArgs, parent, provider) {
-    // Check to ensure that a compatible version of aws CLI is installed, as we'll need it in order
-    // to retrieve a token to login to the EKS cluster later.
-    (0, dependencies_1.assertCompatibleAWSCLIExists)();
-    // Check to ensure that a compatible kubectl is installed, as we'll need it in order to deploy
-    // k8s resources later.
-    (0, dependencies_1.assertCompatibleKubectlVersionExists)();
-    const args = (0, authenticationMode_1.validateAuthenticationMode)(rawArgs);
-    if (args.instanceRole && args.instanceRoles) {
-        throw new Error("instanceRole and instanceRoles are mutually exclusive, and cannot both be set.");
-    }
-    if (args.subnetIds && (args.publicSubnetIds || args.privateSubnetIds)) {
-        throw new Error("subnetIds, and the use of publicSubnetIds and/or privateSubnetIds are mutually exclusive. Choose a single approach.");
-    }
-    if (args.nodeGroupOptions &&
-        (args.nodeSubnetIds ||
-            args.nodeAssociatePublicIpAddress ||
-            args.instanceType ||
-            args.instanceProfileName ||
-            args.nodePublicKey ||
-            args.nodeRootVolumeSize ||
-            args.nodeUserData ||
-            args.minSize ||
-            args.maxSize ||
-            args.desiredCapacity ||
-            args.nodeAmiId ||
-            args.gpu)) {
-        throw new Error("Setting nodeGroupOptions, and any set of singular node group option(s) on the cluster, is mutually exclusive. Choose a single approach.");
-    }
-    // Configure the node group options.
-    const nodeGroupOptions = args.nodeGroupOptions || {
-        nodeSubnetIds: args.nodeSubnetIds,
-        nodeAssociatePublicIpAddress: args.nodeAssociatePublicIpAddress,
-        instanceType: args.instanceType,
-        nodePublicKey: args.nodePublicKey,
-        nodeRootVolumeEncrypted: args.nodeRootVolumeEncrypted,
-        nodeRootVolumeSize: args.nodeRootVolumeSize,
-        nodeUserData: args.nodeUserData,
-        minSize: args.minSize,
-        maxSize: args.maxSize,
-        desiredCapacity: args.desiredCapacity,
-        amiId: args.nodeAmiId,
-        gpu: args.gpu,
-        version: args.version,
-    };
-    const { partition, dnsSuffix } = aws.getPartitionOutput({}, { parent });
-    // Configure default networking architecture.
-    let vpcId = args.vpcId;
-    let clusterSubnetIds = [];
-    // If no VPC is set, use the default VPC's subnets.
-    if (!args.vpcId) {
-        const invokeOpts = { parent, async: true };
-        const vpc = aws.ec2.getVpc({ default: true }, invokeOpts);
-        vpcId = vpc.then((v) => v.id);
-        clusterSubnetIds = vpc
-            .then((v) => aws.ec2.getSubnets({ filters: [{ name: "vpc-id", values: [v.id] }] }, invokeOpts))
-            .then((subnets) => subnets.ids);
-    }
-    // Form the subnetIds to use on the cluster from either:
-    //  - subnetIds
-    //  - A combination of privateSubnetIds and/or publicSubnetIds.
-    if (args.subnetIds !== undefined) {
-        clusterSubnetIds = args.subnetIds;
-    }
-    else if (args.publicSubnetIds !== undefined || args.privateSubnetIds !== undefined) {
-        clusterSubnetIds = pulumi
-            .all([args.publicSubnetIds || [], args.privateSubnetIds || []])
-            .apply(([publicIds, privateIds]) => {
-            return [...publicIds, ...privateIds];
-        });
-    }
-    // Create the EKS service role
-    let eksRole;
-    if (args.serviceRole) {
-        eksRole = pulumi.output(args.serviceRole);
-    }
-    else {
-        eksRole = new servicerole_1.ServiceRole(`${name}-eksRole`, {
-            service: "eks.amazonaws.com",
-            description: "Allows EKS to manage clusters on your behalf.",
-            managedPolicyArns: [
-                {
-                    id: "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
-                    arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEKSClusterPolicy`,
-                },
-            ],
-            tags: args.tags,
-        }, { parent, provider }).role;
-    }
-    // Create the EKS cluster security group
-    let eksClusterSecurityGroup;
-    if (args.clusterSecurityGroup) {
-        eksClusterSecurityGroup = args.clusterSecurityGroup;
-    }
-    else {
-        eksClusterSecurityGroup = new aws.ec2.SecurityGroup(`${name}-eksClusterSecurityGroup`, {
-            vpcId: vpcId,
-            revokeRulesOnDelete: true,
-            tags: pulumi.all([args.tags, args.clusterSecurityGroupTags]).apply(([tags, clusterSecurityGroupTags]) => (Object.assign(Object.assign({ Name: `${name}-eksClusterSecurityGroup` }, clusterSecurityGroupTags), tags))),
-        }, { parent, provider });
-        const eksClusterInternetEgressRule = new aws.ec2.SecurityGroupRule(`${name}-eksClusterInternetEgressRule`, {
-            description: "Allow internet access.",
-            type: "egress",
-            fromPort: 0,
-            toPort: 0,
-            protocol: "-1",
-            cidrBlocks: ["0.0.0.0/0"],
-            securityGroupId: eksClusterSecurityGroup.id,
-        }, { parent, provider });
-    }
-    // Create the cluster encryption provider for using envelope encryption on
-    // Kubernetes secrets.
-    let encryptionProvider;
-    let encryptionConfig;
-    if (args.encryptionConfigKeyArn) {
-        encryptionProvider = pulumi.output(args.encryptionConfigKeyArn).apply((keyArn) => ({
-            keyArn,
-        }));
-        encryptionConfig = encryptionProvider.apply((ep) => ({
-            provider: ep,
-            resources: ["secrets"], // Only valid values are: "secrets"
-        }));
-    }
-    let kubernetesNetworkConfig;
-    if (args.kubernetesServiceIpAddressRange || args.ipFamily) {
-        kubernetesNetworkConfig = pulumi
-            .all([args.kubernetesServiceIpAddressRange, args.ipFamily])
-            .apply(([serviceIpv4Cidr, ipFamily = "ipv4"]) => ({
-            serviceIpv4Cidr: ipFamily === "ipv4" ? serviceIpv4Cidr : undefined,
-            ipFamily: ipFamily,
-        }));
-    }
-    // Create the EKS cluster
-    const eksCluster = new aws.eks.Cluster(`${name}-eksCluster`, {
-        name: args.name,
-        roleArn: eksRole.apply((r) => r.arn),
-        vpcConfig: {
-            securityGroupIds: [eksClusterSecurityGroup.id],
-            subnetIds: clusterSubnetIds,
-            endpointPrivateAccess: args.endpointPrivateAccess,
-            endpointPublicAccess: args.endpointPublicAccess,
-            publicAccessCidrs: args.publicAccessCidrs,
-        },
-        version: args.version,
-        enabledClusterLogTypes: args.enabledClusterLogTypes,
-        defaultAddonsToRemoves: args.defaultAddonsToRemove,
-        tags: pulumi.all([args.tags, args.clusterTags]).apply(([tags, clusterTags]) => (Object.assign(Object.assign({ Name: `${name}-eksCluster` }, clusterTags), tags))),
-        encryptionConfig,
-        kubernetesNetworkConfig,
-        accessConfig: args.authenticationMode
-            ? {
-                authenticationMode: args.authenticationMode,
-                // Explicitely grants the principal creating the cluster admin access to the cluster.
-                // This is the default behavior of EKS when no accessConfig is provided.
-                // It is required for this component because it deploys charts to the cluster.
-                bootstrapClusterCreatorAdminPermissions: true,
-            }
-            : undefined,
-    }, {
-        parent,
-        provider: args.creationRoleProvider ? args.creationRoleProvider.provider : provider,
-        // ignore changes to the bootstrapClusterCreatorAdminPermissions field because it has bi-modal default behavior
-        // in upstream and would cause replacements for users upgrading from older versions of the EKS provider (<=2.7.3).
-        // See https://github.com/pulumi/pulumi-aws/issues/3997#issuecomment-2223201333 for more details.
-        ignoreChanges: ["accessConfig.bootstrapClusterCreatorAdminPermissions"],
-    });
-    // Instead of using the kubeconfig directly, we also add a wait of up to 5 minutes or until we
-    // can reach the API server for the Output that provides access to the kubeconfig string so that
-    // there is time for the cluster API server to become completely available.  Ideally we
-    // would rely on the EKS API only returning once this was available, but we have seen frequent
-    // cases where it is not yet available immediately after provisioning - possibly due to DNS
-    // propagation delay or other non-deterministic factors.
-    const endpoint = eksCluster.endpoint.apply((clusterEndpoint) => __awaiter(this, void 0, void 0, function* () {
-        if (!pulumi.runtime.isDryRun() && args.endpointPublicAccess) {
-            // For up to 300 seconds, try to contact the API cluster healthz
-            // endpoint, and verify that it is reachable.
-            const healthz = `${clusterEndpoint}/healthz`;
-            const agent = createHttpAgent(args.proxy);
-            const maxRetries = 60;
-            const reqTimeoutMilliseconds = 1000; // HTTPS request timeout
-            const timeoutMilliseconds = 5000; // Retry timeout
-            for (let i = 0; i < maxRetries; i++) {
-                try {
-                    yield new Promise((resolve, reject) => {
-                        const options = Object.assign(Object.assign({}, url.parse(healthz)), { rejectUnauthorized: false, agent: agent, timeout: reqTimeoutMilliseconds });
-                        const req = https.request(options, (res) => {
-                            res.statusCode === 200 ? resolve(undefined) : reject(); // Verify healthz returns 200
-                        });
-                        req.on("timeout", reject);
-                        req.on("error", reject);
-                        req.end();
-                    });
-                    pulumi.log.info(`Cluster is ready`, eksCluster, undefined, true);
-                    break;
-                }
-                catch (e) {
-                    const retrySecondsLeft = ((maxRetries - i) * timeoutMilliseconds) / 1000;
-                    pulumi.log.info(`Waiting up to (${retrySecondsLeft}) more seconds for cluster readiness...`, eksCluster, undefined, true);
-                }
-                yield new Promise((resolve) => setTimeout(resolve, timeoutMilliseconds));
-            }
-        }
-        return clusterEndpoint;
-    }));
-    // Compute the required kubeconfig. Note that we do not export this value: we want the exported config to
-    // depend on the autoscaling group we'll create later so that nothing attempts to use the EKS cluster before
-    // its worker nodes have come up.
-    const genKubeconfig = (useProfileName) => {
-        const kubeconfig = pulumi
-            .all([
-            eksCluster.name,
-            endpoint,
-            eksCluster.certificateAuthority,
-            args.providerCredentialOpts,
-        ])
-            .apply(([clusterName, clusterEndpoint, clusterCertificateAuthority, providerCredentialOpts,]) => {
-            let config = {};
-            if (args.creationRoleProvider) {
-                config = args.creationRoleProvider.role.arn.apply((arn) => {
-                    const opts = { roleArn: arn };
-                    return generateKubeconfig(clusterName, clusterEndpoint, useProfileName, clusterCertificateAuthority === null || clusterCertificateAuthority === void 0 ? void 0 : clusterCertificateAuthority.data, opts);
-                });
-            }
-            else if (providerCredentialOpts) {
-                config = generateKubeconfig(clusterName, clusterEndpoint, useProfileName, clusterCertificateAuthority === null || clusterCertificateAuthority === void 0 ? void 0 : clusterCertificateAuthority.data, providerCredentialOpts);
-            }
-            else {
-                config = generateKubeconfig(clusterName, clusterEndpoint, useProfileName, clusterCertificateAuthority === null || clusterCertificateAuthority === void 0 ? void 0 : clusterCertificateAuthority.data);
-            }
-            return config;
-        });
-        return kubeconfig;
-    };
-    // We need 2 forms of kubeconfig, one with the profile name and one without. The one with the profile name
-    // is required to interact with the cluster by this provider. The one without is used by the user to interact
-    // with the cluster and enable multi-user access.
-    const kubeconfig = genKubeconfig(true);
-    const kubeconfigWithoutProfile = genKubeconfig(false);
-    const k8sProvider = new k8s.Provider(`${name}-eks-k8s`, {
-        kubeconfig: kubeconfig.apply(JSON.stringify),
-        enableConfigMapMutable: args.enableConfigMapMutable,
-    }, { parent: parent });
-    const skipDefaultNodeGroup = args.skipDefaultNodeGroup || args.fargate;
-    let instanceRoles;
-    let defaultInstanceRole;
-    // Create role mappings of the instance roles specified for aws-auth.
-    if (args.instanceRoles) {
-        instanceRoles = pulumi.output(args.instanceRoles);
-    }
-    else if (args.instanceRole) {
-        // Create an instance profile if using a default node group
-        if (!skipDefaultNodeGroup) {
-            nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(name, parent, args.instanceRole, args.instanceProfileName);
-        }
-        instanceRoles = pulumi.output([args.instanceRole]);
-        defaultInstanceRole = pulumi.output(args.instanceRole);
-    }
-    else {
-        const instanceRole = new servicerole_1.ServiceRole(`${name}-instanceRole`, {
-            service: pulumi.interpolate `ec2.${dnsSuffix}`,
-            managedPolicyArns: [
-                {
-                    id: "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
-                    arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEKSWorkerNodePolicy`,
-                },
-                {
-                    id: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
-                    arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEKS_CNI_Policy`,
-                },
-                {
-                    id: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
-                    arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly`,
-                },
-            ],
-            tags: args.tags,
-        }, { parent, provider }).role;
-        defaultInstanceRole = instanceRole;
-        instanceRoles = pulumi.output([instanceRole]);
-        // Create a new policy for the role, if specified.
-        if (args.customInstanceRolePolicy) {
-            pulumi.log.warn("Option `customInstanceRolePolicy` has been deprecated. Please use `instanceRole` or `instanceRoles`. The role provided to either option should already include all required policies.", eksCluster);
-            const customRolePolicy = new aws.iam.RolePolicy(`${name}-EKSWorkerCustomPolicy`, {
-                role: instanceRole,
-                policy: args.customInstanceRolePolicy,
-            }, { parent, provider });
-        }
-        // Create an instance profile if using a default node group
-        if (!skipDefaultNodeGroup) {
-            nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(name, parent, instanceRole, args.instanceProfileName);
-        }
-    }
-    let eksNodeAccess = undefined;
-    if ((0, authenticationMode_1.supportsConfigMap)(args.authenticationMode)) {
-        // Create the aws-auth ConfigMap if the authentication mode supports it. This maps instance roles, regular IAM roles, and IAM users to
-        // Kubernetes RBAC users and groups.
-        const nodeAccessData = (0, authenticationMode_1.createAwsAuthData)(instanceRoles, args.roleMappings, args.userMappings);
-        eksNodeAccess = new k8s.core.v1.ConfigMap(`${name}-nodeAccess`, {
-            apiVersion: "v1",
-            immutable: false,
-            metadata: {
-                name: `aws-auth`,
-                namespace: "kube-system",
-                annotations: {
-                    "pulumi.com/patchForce": "true",
-                },
-            },
-            data: nodeAccessData,
-        }, { parent, provider: k8sProvider });
-    }
-    // Create the access entries if the authentication mode supports it.
-    let accessEntries = undefined;
-    if ((0, authenticationMode_1.supportsAccessEntries)(args.authenticationMode)) {
-        // This additionally maps the defaultInstanceRole to a EC2_LINUX access entry which allows the nodes to register & communicate with the EKS control plane.
-        if (defaultInstanceRole) {
-            accessEntries = (0, authenticationMode_1.createAccessEntries)(name, eksCluster.name, {
-                defaultNodeGroupInstanceRole: {
-                    principalArn: defaultInstanceRole.arn,
-                    type: exports.AccessEntryType.EC2_LINUX,
-                },
-            }, { parent, provider, dependsOn: [eksCluster] });
-        }
-        accessEntries = (accessEntries || []).concat((0, authenticationMode_1.createAccessEntries)(name, eksCluster.name, args.accessEntries || {}, {
-            parent,
-            provider,
-            dependsOn: [eksCluster],
-        }));
-    }
-    const authDependencies = [
-        ...(accessEntries ? accessEntries : []),
-        ...(eksNodeAccess ? [eksNodeAccess] : []),
-    ];
-    // Add any requested StorageClasses.
-    const storageClasses = args.storageClasses || {};
-    const userStorageClasses = {};
-    if (typeof storageClasses === "string") {
-        const storageClass = { type: storageClasses, default: true };
-        userStorageClasses[storageClasses] = pulumi.output((0, storageclass_1.createStorageClass)(`${name.toLowerCase()}-${storageClasses}`, storageClass, {
-            parent,
-            provider: k8sProvider,
-            dependsOn: authDependencies,
-        }));
-    }
-    else {
-        for (const key of Object.keys(storageClasses)) {
-            userStorageClasses[key] = pulumi.output((0, storageclass_1.createStorageClass)(`${name.toLowerCase()}-${key}`, storageClasses[key], {
-                parent,
-                provider: k8sProvider,
-                dependsOn: authDependencies,
-            }));
-        }
-    }
-    // Create the VPC CNI management resource.
-    let vpcCni;
-    if (!args.useDefaultVpcCni) {
-        vpcCni = new cni_1.VpcCni(`${name}-vpc-cni`, kubeconfig.apply(JSON.stringify), args.vpcCniOptions, { parent, dependsOn: authDependencies });
-    }
-    const fargateProfile = pulumi
-        .output(args.fargate)
-        .apply((argsFargate) => {
-        let result;
-        if (argsFargate) {
-            const fargate = argsFargate !== true ? argsFargate : {};
-            const podExecutionRoleArn = fargate.podExecutionRoleArn ||
-                new servicerole_1.ServiceRole(`${name}-podExecutionRole`, {
-                    service: "eks-fargate-pods.amazonaws.com",
-                    managedPolicyArns: [
-                        {
-                            id: "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy",
-                            arn: pulumi.interpolate `arn:${partition}:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy`,
-                        },
-                    ],
-                    tags: args.tags,
-                }, { parent, provider }).role.apply((r) => r.arn);
-            const selectors = fargate.selectors || [
-                // For `fargate: true`, default to including the `default` namespaces and
-                // `kube-system` namespaces so that all pods by default run in Fargate.
-                { namespace: "default" },
-                { namespace: "kube-system" },
-            ];
-            const reservedAwsPrefix = "eks";
-            let fargateProfileName = name;
-            const profileNameRegex = new RegExp("^" + reservedAwsPrefix + "-", "i"); // starts with (^) 'eks-', (i)gnore casing
-            if (fargateProfileName === reservedAwsPrefix || profileNameRegex.test(name)) {
-                fargateProfileName = fargateProfileName.replace("-", "_");
-                fargateProfileName = `${fargateProfileName}fargateProfile`;
-            }
-            else {
-                // default, and to maintain backwards compat for existing cluster fargate profiles.
-                fargateProfileName = `${fargateProfileName}-fargateProfile`;
-            }
-            result = new aws.eks.FargateProfile(fargateProfileName, {
-                clusterName: eksCluster.name,
-                podExecutionRoleArn: podExecutionRoleArn,
-                selectors: selectors,
-                subnetIds: pulumi.output(clusterSubnetIds).apply((subnets) => {
-                    var _a;
-                    if (((_a = fargate.subnetIds) === null || _a === void 0 ? void 0 : _a.length) && fargate.subnetIds.length > 0) {
-                        return (0, nodegroup_1.computeWorkerSubnets)(parent, fargate.subnetIds);
-                    }
-                    else {
-                        return (0, nodegroup_1.computeWorkerSubnets)(parent, subnets);
-                    }
-                }),
-            }, { parent, dependsOn: eksNodeAccess ? [eksNodeAccess] : undefined, provider });
-            // Once the FargateProfile has been created, try to patch/remove the CoreDNS computeType annotation.  See
-            // https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html#fargate-gs-coredns.
-            pulumi.all([result.id, selectors, kubeconfig]).apply(([_, sels, kconfig]) => {
-                // Only patch CoreDNS if there is a selector in the FargateProfile which causes
-                // `kube-system` pods to launch in Fargate.
-                if (sels.findIndex((s) => s.namespace === "kube-system") !== -1) {
-                    // Only do the imperative patching during deployments, not previews.
-                    if (!pulumi.runtime.isDryRun()) {
-                        // Write the kubeconfig to a tmp file and use it to patch the `coredns`
-                        // deployment that AWS deployed already as part of cluster creation.
-                        const tmpKubeconfig = tmp.fileSync();
-                        fs.writeFileSync(tmpKubeconfig.fd, JSON.stringify(kconfig));
-                        // Determine if the CoreDNS deployment has a computeType annotation.
-                        const cmdGetAnnos = `kubectl get deployment coredns -n kube-system -o jsonpath='{.spec.template.metadata.annotations}'`;
-                        const getAnnosOutput = childProcess.execSync(cmdGetAnnos, {
-                            env: Object.assign(Object.assign({}, process.env), { KUBECONFIG: tmpKubeconfig.name }),
-                        });
-                        const getAnnosOutputStr = getAnnosOutput.toString();
-                        // See if getAnnosOutputStr contains the annotation we're looking for.
-                        if (!getAnnosOutputStr.includes("eks.amazonaws.com/compute-type")) {
-                            // No need to patch the deployment object since the annotation is not present. However, we need to re-create the CoreDNS pods since
-                            // the existing pods were created before the FargateProfile was created, and therefore will not have been scheduled by fargate-scheduler.
-                            // See: https://github.com/pulumi/pulumi-eks/issues/1030.
-                            const cmd = `kubectl rollout restart deployment coredns -n kube-system`;
-                            childProcess.execSync(cmd, {
-                                env: Object.assign(Object.assign({}, process.env), { KUBECONFIG: tmpKubeconfig.name }),
-                            });
-                            return;
-                        }
-                        const patch = [
-                            {
-                                op: "remove",
-                                path: "/spec/template/metadata/annotations/eks.amazonaws.com~1compute-type",
-                            },
-                        ];
-                        const cmd = `kubectl patch deployment coredns -n kube-system --type json -p='${JSON.stringify(patch)}'`;
-                        childProcess.execSync(cmd, {
-                            env: Object.assign(Object.assign({}, process.env), { KUBECONFIG: tmpKubeconfig.name }),
-                        });
-                    }
-                }
-            });
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
         }
-        return result;
-    });
-    // Setup OIDC provider to leverage IAM roles for k8s service accounts.
-    let oidcProvider;
-    if (args.createOidcProvider) {
-        // Retrieve the OIDC provider URL's intermediate root CA fingerprint.
-        const awsRegionName = pulumi.output(aws.getRegion({}, { parent, async: true })).name;
-        const eksOidcProviderUrl = pulumi.interpolate `https://oidc.eks.${awsRegionName}.${dnsSuffix}`;
-        const agent = createHttpAgent(args.proxy);
-        const fingerprint = (0, cert_thumprint_1.getIssuerCAThumbprint)(eksOidcProviderUrl, agent);
-        // Create the OIDC provider for the cluster.
-        oidcProvider = new aws.iam.OpenIdConnectProvider(`${name}-oidcProvider`, {
-            clientIdLists: ["sts.amazonaws.com"],
-            url: eksCluster.identities[0].oidcs[0].issuer,
-            thumbprintLists: [fingerprint],
-        }, { parent, provider });
+        return obj['__pulumiType'] === Cluster.__pulumiType;
     }
-    return {
-        vpcId: pulumi.output(vpcId),
-        subnetIds: args.subnetIds ? pulumi.output(args.subnetIds) : pulumi.output(clusterSubnetIds),
-        publicSubnetIds: args.publicSubnetIds ? pulumi.output(args.publicSubnetIds) : undefined,
-        privateSubnetIds: args.privateSubnetIds ? pulumi.output(args.privateSubnetIds) : undefined,
-        clusterSecurityGroup: eksClusterSecurityGroup,
-        cluster: eksCluster,
-        endpoint: endpoint,
-        nodeGroupOptions: nodeGroupOptions,
-        kubeconfig: kubeconfigWithoutProfile,
-        provider: k8sProvider,
-        awsProvider: provider,
-        vpcCni: vpcCni,
-        instanceRoles: instanceRoles,
-        eksNodeAccess: eksNodeAccess,
-        tags: args.tags,
-        nodeSecurityGroupTags: args.nodeSecurityGroupTags,
-        storageClasses: userStorageClasses,
-        fargateProfile: fargateProfile,
-        oidcProvider: oidcProvider,
-        encryptionConfig: encryptionConfig,
-        clusterIamRole: eksRole,
-        accessEntries: accessEntries ? pulumi.output(accessEntries) : undefined,
-    };
-}
-exports.createCore = createCore;
-/**
- * Create an HTTP Agent for use with HTTP(S) requests.
- * Using a proxy is supported.
- */
-function createHttpAgent(proxy) {
-    if (!proxy) {
-        // Attempt to default to the proxy env vars.
-        //
-        // Note: Envars used are a convention that were based on:
-        // - curl: https://curl.haxx.se/docs/manual.html
-        // - wget: https://www.gnu.org/software/wget/manual/html_node/Proxies.html
-        proxy =
-            process.env.HTTPS_PROXY ||
-                process.env.https_proxy ||
-                process.env.HTTP_PROXY ||
-                process.env.http_proxy;
-    }
-    if (proxy) {
-        /**
-         * Create an HTTP(s) proxy agent with the given options.
-         *
-         * The agent connects to the proxy and issues a HTTP CONNECT
-         * method to the proxy, which connects to the dest.
-         *
-         * Note: CONNECT is not cacheable.
-         *
-         * See for more details:
-         *  - https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT
-         *  - https://www.npmjs.com/package/https-proxy-agent
-         */
-        return HttpsProxyAgent(Object.assign(Object.assign({}, url.parse(proxy)), { rejectUnauthorized: false }));
-    }
-    return new https.Agent({
-        // Cached sessions can result in the certificate not being
-        // available since its already been "accepted." Disable caching.
-        maxCachedSessions: 0,
-    });
-}
-/* tslint:disable-next-line */ // Generating the enum object for AuthenticationMode like codegen does
-exports.AuthenticationMode = {
-    /**
-     * Only Access Entries will be used for authenticating to the Kubernetes API.
-     */
-    API: "API",
-    /**
-     * Only aws-auth ConfigMap will be used for authenticating to the Kubernetes API.
-     *
-     * @deprecated The aws-auth ConfigMap is deprecated. The recommended method to manage access to Kubernetes APIs is Access Entries with the AuthenticationMode API.
-     * For more information and instructions how to upgrade, see https://docs.aws.amazon.com/eks/latest/userguide/migrating-access-entries.html.
-     */
-    CONFIG_MAP: "CONFIG_MAP",
-    /**
-     * Both aws-auth ConfigMap and Access Entries can be used for authenticating to the Kubernetes API.
-     *
-     * @deprecated The aws-auth ConfigMap is deprecated. The recommended method to manage access to Kubernetes APIs is Access Entries with the AuthenticationMode API.
-     * For more information and instructions how to upgrade, see https://docs.aws.amazon.com/eks/latest/userguide/migrating-access-entries.html.
-     */
-    API_AND_CONFIG_MAP: "API_AND_CONFIG_MAP",
-};
-/* tslint:disable-next-line */ // Generating the enum object for AccessEntryType like codegen does
-exports.AccessEntryType = {
-    /**
-     * Standard Access Entry Workflow. Allows users to input a username and kubernetesGroup, and to associate access policies.
-     */
-    STANDARD: "STANDARD",
-    /**
-     * For IAM roles used with AWS Fargate profiles.
-     */
-    FARGATE_LINUX: "FARGATE_LINUX",
-    /**
-     * For IAM roles associated with self-managed Linux node groups. Allows the nodes to join the cluster.
-     */
-    EC2_LINUX: "EC2_LINUX",
-    /**
-     * For IAM roles associated with self-managed Windows node groups. Allows the nodes to join the cluster.
-     */
-    EC2_WINDOWS: "EC2_WINDOWS",
-};
-/**
- * Cluster is a component that wraps the AWS and Kubernetes resources necessary to run an EKS cluster, its worker
- * nodes, its optional StorageClasses, and an optional deployment of the Kubernetes Dashboard.
- */
-class Cluster extends pulumi.ComponentResource {
     /**
-     * Create a new EKS cluster with worker nodes, optional storage classes, and deploy the Kubernetes Dashboard if
-     * requested.
+     * Create a Cluster resource with the given unique name, arguments, and options.
      *
-     * @param name The _unique_ name of this component.
-     * @param args The arguments for this cluster.
-     * @param opts A bag of options that control this component's behavior.
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
      */
     constructor(name, args, opts) {
-        const type = "eks:index:Cluster";
-        if (opts === null || opts === void 0 ? void 0 : opts.urn) {
-            const props = {
-                kubeconfig: undefined,
-                eksCluster: undefined,
-            };
-            super(type, name, props, opts);
-            return;
+        let resourceInputs = {};
+        opts = opts || {};
+        if (!opts.id) {
+            resourceInputs["accessEntries"] = args ? args.accessEntries : undefined;
+            resourceInputs["authenticationMode"] = args ? args.authenticationMode : undefined;
+            resourceInputs["clusterSecurityGroup"] = args ? args.clusterSecurityGroup : undefined;
+            resourceInputs["clusterSecurityGroupTags"] = args ? args.clusterSecurityGroupTags : undefined;
+            resourceInputs["clusterTags"] = args ? args.clusterTags : undefined;
+            resourceInputs["corednsAddonOptions"] = args ? (args.corednsAddonOptions ? inputs.coreDnsAddonOptionsArgsProvideDefaults(args.corednsAddonOptions) : undefined) : undefined;
+            resourceInputs["createOidcProvider"] = args ? args.createOidcProvider : undefined;
+            resourceInputs["creationRoleProvider"] = args ? args.creationRoleProvider : undefined;
+            resourceInputs["defaultAddonsToRemove"] = args ? args.defaultAddonsToRemove : undefined;
+            resourceInputs["desiredCapacity"] = args ? args.desiredCapacity : undefined;
+            resourceInputs["enableConfigMapMutable"] = args ? args.enableConfigMapMutable : undefined;
+            resourceInputs["enabledClusterLogTypes"] = args ? args.enabledClusterLogTypes : undefined;
+            resourceInputs["encryptionConfigKeyArn"] = args ? args.encryptionConfigKeyArn : undefined;
+            resourceInputs["endpointPrivateAccess"] = args ? args.endpointPrivateAccess : undefined;
+            resourceInputs["endpointPublicAccess"] = args ? args.endpointPublicAccess : undefined;
+            resourceInputs["fargate"] = args ? args.fargate : undefined;
+            resourceInputs["gpu"] = args ? args.gpu : undefined;
+            resourceInputs["instanceProfileName"] = args ? args.instanceProfileName : undefined;
+            resourceInputs["instanceRole"] = args ? args.instanceRole : undefined;
+            resourceInputs["instanceRoles"] = args ? args.instanceRoles : undefined;
+            resourceInputs["instanceType"] = args ? args.instanceType : undefined;
+            resourceInputs["ipFamily"] = args ? args.ipFamily : undefined;
+            resourceInputs["kubeProxyAddonOptions"] = args ? (args.kubeProxyAddonOptions ? inputs.kubeProxyAddonOptionsArgsProvideDefaults(args.kubeProxyAddonOptions) : undefined) : undefined;
+            resourceInputs["kubernetesServiceIpAddressRange"] = args ? args.kubernetesServiceIpAddressRange : undefined;
+            resourceInputs["maxSize"] = args ? args.maxSize : undefined;
+            resourceInputs["minSize"] = args ? args.minSize : undefined;
+            resourceInputs["name"] = args ? args.name : undefined;
+            resourceInputs["nodeAmiId"] = args ? args.nodeAmiId : undefined;
+            resourceInputs["nodeAssociatePublicIpAddress"] = args ? args.nodeAssociatePublicIpAddress : undefined;
+            resourceInputs["nodeGroupOptions"] = args ? args.nodeGroupOptions : undefined;
+            resourceInputs["nodePublicKey"] = args ? args.nodePublicKey : undefined;
+            resourceInputs["nodeRootVolumeEncrypted"] = args ? args.nodeRootVolumeEncrypted : undefined;
+            resourceInputs["nodeRootVolumeSize"] = args ? args.nodeRootVolumeSize : undefined;
+            resourceInputs["nodeSecurityGroupTags"] = args ? args.nodeSecurityGroupTags : undefined;
+            resourceInputs["nodeSubnetIds"] = args ? args.nodeSubnetIds : undefined;
+            resourceInputs["nodeUserData"] = args ? args.nodeUserData : undefined;
+            resourceInputs["privateSubnetIds"] = args ? args.privateSubnetIds : undefined;
+            resourceInputs["providerCredentialOpts"] = args ? args.providerCredentialOpts : undefined;
+            resourceInputs["proxy"] = args ? args.proxy : undefined;
+            resourceInputs["publicAccessCidrs"] = args ? args.publicAccessCidrs : undefined;
+            resourceInputs["publicSubnetIds"] = args ? args.publicSubnetIds : undefined;
+            resourceInputs["roleMappings"] = args ? args.roleMappings : undefined;
+            resourceInputs["serviceRole"] = args ? args.serviceRole : undefined;
+            resourceInputs["skipDefaultNodeGroup"] = args ? args.skipDefaultNodeGroup : undefined;
+            resourceInputs["storageClasses"] = args ? args.storageClasses : undefined;
+            resourceInputs["subnetIds"] = args ? args.subnetIds : undefined;
+            resourceInputs["tags"] = args ? args.tags : undefined;
+            resourceInputs["useDefaultVpcCni"] = args ? args.useDefaultVpcCni : undefined;
+            resourceInputs["userMappings"] = args ? args.userMappings : undefined;
+            resourceInputs["version"] = args ? args.version : undefined;
+            resourceInputs["vpcCniOptions"] = args ? (args.vpcCniOptions ? inputs.vpcCniOptionsArgsProvideDefaults(args.vpcCniOptions) : undefined) : undefined;
+            resourceInputs["vpcId"] = args ? args.vpcId : undefined;
+            resourceInputs["awsProvider"] = undefined /*out*/;
+            resourceInputs["core"] = undefined /*out*/;
+            resourceInputs["defaultNodeGroup"] = undefined /*out*/;
+            resourceInputs["eksCluster"] = undefined /*out*/;
+            resourceInputs["eksClusterIngressRule"] = undefined /*out*/;
+            resourceInputs["kubeconfig"] = undefined /*out*/;
+            resourceInputs["kubeconfigJson"] = undefined /*out*/;
+            resourceInputs["nodeSecurityGroup"] = undefined /*out*/;
         }
-        super(type, name, args, opts);
-        const cluster = createCluster(name, this, args, opts);
-        this.kubeconfig = cluster.kubeconfig;
-        this.kubeconfigJson = cluster.kubeconfigJson;
-        this.provider = cluster.provider;
-        this.clusterSecurityGroup = cluster.clusterSecurityGroup;
-        this.instanceRoles = cluster.instanceRoles;
-        this.nodeSecurityGroup = cluster.nodeSecurityGroup;
-        this.eksClusterIngressRule = cluster.eksClusterIngressRule;
-        this.defaultNodeGroup = cluster.defaultNodeGroup;
-        this.eksCluster = cluster.eksCluster;
-        this.core = cluster.core;
-        this.registerOutputs({
-            kubeconfig: this.kubeconfig,
-            eksCluster: this.eksCluster,
-        });
-    }
-    /**
-     * Create a self-managed node group using CloudFormation and an ASG.
-     *
-     * See for more details:
-     * https://docs.aws.amazon.com/eks/latest/userguide/worker.html
-     */
-    createNodeGroup(name, args) {
-        const awsProvider = this.core.awsProvider ? { aws: this.core.awsProvider } : undefined;
-        return new nodegroup_1.NodeGroup(name, Object.assign(Object.assign({}, args), { cluster: this.core, nodeSecurityGroup: this.core.nodeGroupOptions.nodeSecurityGroup, clusterIngressRule: this.core.nodeGroupOptions.clusterIngressRule }), {
-            parent: this,
-            providers: Object.assign(Object.assign({}, awsProvider), { kubernetes: this.provider }),
-        });
+        else {
+            resourceInputs["awsProvider"] = undefined /*out*/;
+            resourceInputs["clusterSecurityGroup"] = undefined /*out*/;
+            resourceInputs["core"] = undefined /*out*/;
+            resourceInputs["defaultNodeGroup"] = undefined /*out*/;
+            resourceInputs["eksCluster"] = undefined /*out*/;
+            resourceInputs["eksClusterIngressRule"] = undefined /*out*/;
+            resourceInputs["instanceRoles"] = undefined /*out*/;
+            resourceInputs["kubeconfig"] = undefined /*out*/;
+            resourceInputs["kubeconfigJson"] = undefined /*out*/;
+            resourceInputs["nodeSecurityGroup"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(Cluster.__pulumiType, name, resourceInputs, opts, true /*remote*/);
     }
     /**
-     * Generate a kubeconfig for cluster authentication that does not use the
-     * default AWS credential provider chain, and instead is scoped to
-     * the supported options in `KubeconfigOptions`.
+     * Generate a kubeconfig for cluster authentication that does not use the default AWS credential provider chain, and instead is scoped to the supported options in `KubeconfigOptions`.
      *
-     * The kubeconfig generated is automatically stringified for ease of use
-     * with the pulumi/kubernetes provider.
+     * The kubeconfig generated is automatically stringified for ease of use with the pulumi/kubernetes provider.
      *
      * See for more details:
      * - https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html
@@ -834,143 +135,15 @@ class Cluster extends pulumi.ComponentResource {
      * - https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html
      */
     getKubeconfig(args) {
-        var _a;
-        const kc = generateKubeconfig(this.eksCluster.name, this.eksCluster.endpoint, true, (_a = this.eksCluster.certificateAuthority) === null || _a === void 0 ? void 0 : _a.data, args);
-        return pulumi.output(kc).apply(JSON.stringify);
+        args = args || {};
+        return pulumi.runtime.call("eks:index:Cluster/getKubeconfig", {
+            "__self__": this,
+            "profileName": args.profileName,
+            "roleArn": args.roleArn,
+        }, this);
     }
 }
 exports.Cluster = Cluster;
 /** @internal */
-function createCluster(name, self, args, opts) {
-    args = args || {};
-    // Check that AWS provider credential options are set for the kubeconfig
-    // to use with the given auth method.
-    if ((opts === null || opts === void 0 ? void 0 : opts.provider) && !args.providerCredentialOpts) {
-        throw new Error("It looks like you're using an explicit AWS provider. Please specify this provider in providerCredentialOpts.");
-    }
-    if (process.env.AWS_PROFILE && !args.providerCredentialOpts) {
-        args.providerCredentialOpts = {
-            profileName: process.env.AWS_PROFILE,
-        };
-    }
-    const awsConfig = new pulumi.Config("aws");
-    const awsProfile = awsConfig.get("profile");
-    if (awsProfile && !args.providerCredentialOpts) {
-        args.providerCredentialOpts = {
-            profileName: awsProfile,
-        };
-    }
-    // Create the core resources required by the cluster.
-    const core = createCore(name, args, self, opts === null || opts === void 0 ? void 0 : opts.provider);
-    // Create default node group security group and cluster ingress rule.
-    const [nodeSecurityGroup, eksClusterIngressRule] = (0, securitygroup_1.createNodeGroupSecurityGroup)(name, {
-        vpcId: core.vpcId,
-        clusterSecurityGroup: core.clusterSecurityGroup,
-        eksCluster: core.cluster,
-        tags: pulumi.all([args.tags, args.nodeSecurityGroupTags]).apply(([tags, nodeSecurityGroupTags]) => (Object.assign(Object.assign({}, nodeSecurityGroupTags), tags))),
-    }, self);
-    core.nodeGroupOptions.nodeSecurityGroup = nodeSecurityGroup;
-    core.nodeGroupOptions.clusterIngressRule = eksClusterIngressRule;
-    const skipDefaultNodeGroup = args.skipDefaultNodeGroup || args.fargate;
-    // Create the default worker node group and grant the workers access to the API server.
-    const configDeps = [core.kubeconfig];
-    let defaultNodeGroup = undefined;
-    if (!skipDefaultNodeGroup) {
-        defaultNodeGroup = (0, nodegroup_1.createNodeGroup)(name, Object.assign({ cluster: core }, core.nodeGroupOptions), self);
-        if (defaultNodeGroup.cfnStack) {
-            configDeps.push(defaultNodeGroup.cfnStack.id);
-        }
-    }
-    // Export the cluster's kubeconfig with a dependency upon the cluster's autoscaling group. This will help
-    // ensure that the cluster's consumers do not attempt to use the cluster until its workers are attached.
-    const kubeconfig = pulumi.all(configDeps).apply(([kc]) => kc);
-    const kubeconfigJson = kubeconfig.apply(JSON.stringify);
-    // Export a k8s provider with the above kubeconfig. Note that we do not export the provider we created earlier
-    // in order to help ensure that worker nodes are available before the provider can be used.
-    const provider = new k8s.Provider(`${name}-provider`, {
-        kubeconfig: kubeconfigJson,
-    }, { parent: self });
-    // If we need to deploy the Kubernetes dashboard, do so now.
-    if (args.deployDashboard) {
-        pulumi.log.warn("Option `deployDashboard` has been deprecated. Please consider using the Helm chart, or writing the dashboard directly in Pulumi.", core.cluster);
-        (0, dashboard_1.createDashboard)(name, {}, self, provider);
-    }
-    return {
-        core,
-        clusterSecurityGroup: core.clusterSecurityGroup,
-        eksCluster: core.cluster,
-        instanceRoles: core.instanceRoles,
-        awsProvider: core.awsProvider,
-        nodeSecurityGroup,
-        eksClusterIngressRule,
-        defaultNodeGroup,
-        kubeconfig,
-        kubeconfigJson,
-        provider,
-    };
-}
-exports.createCluster = createCluster;
-/**
- * This is a variant of `Cluster` that is used for the MLC `Cluster`. We don't just use `Cluster`,
- * because not all of its output properties are typed as `Output<T>`, which prevents it from being
- * able to be correctly "rehydrated" from a resource reference. So we use this copy instead rather
- * than modifying the public surface area of the existing `Cluster` class, which is still being
- * used directly by users using the Node.js SDK. Once we move Node.js over to the generated MLC SDK,
- * we can clean all this up. Internally, this leverages the same `createCluster` helper method that
- * `Cluster` uses.
- *
- * @internal
- */
-class ClusterInternal extends pulumi.ComponentResource {
-    constructor(name, args, opts) {
-        var _a;
-        const type = "eks:index:Cluster";
-        if (opts === null || opts === void 0 ? void 0 : opts.urn) {
-            const props = {
-                clusterSecurityGroup: undefined,
-                core: undefined,
-                defaultNodeGroup: undefined,
-                eksCluster: undefined,
-                eksClusterIngressRule: undefined,
-                instanceRoles: undefined,
-                kubeconfig: undefined,
-                kubeconfigJson: undefined,
-                nodeSecurityGroup: undefined,
-            };
-            super(type, name, props, opts);
-            return;
-        }
-        super(type, name, args, opts);
-        if ((_a = args === null || args === void 0 ? void 0 : args.creationRoleProvider) === null || _a === void 0 ? void 0 : _a.provider) {
-            throw new Error("The `creationRoleProvider.provider` option is not supported in non-nodejs Pulumi programs. Please use the `providerCredentialOpts` option instead.");
-        }
-        const cluster = createCluster(name, this, args, opts);
-        this.kubeconfig = cluster.kubeconfig;
-        this.kubeconfigJson = cluster.kubeconfigJson;
-        this.clusterSecurityGroup = pulumi.output(cluster.clusterSecurityGroup);
-        this.instanceRoles = cluster.instanceRoles;
-        this.nodeSecurityGroup = pulumi.output(cluster.nodeSecurityGroup);
-        this.eksClusterIngressRule = pulumi.output(cluster.eksClusterIngressRule);
-        this.defaultNodeGroup = pulumi.output(cluster.defaultNodeGroup);
-        this.eksCluster = pulumi.output(cluster.eksCluster);
-        this.core = pulumi.output(cluster.core);
-        this.registerOutputs({
-            clusterSecurityGroup: this.clusterSecurityGroup,
-            core: this.core,
-            defaultNodeGroup: this.defaultNodeGroup,
-            eksCluster: this.eksCluster,
-            eksClusterIngressRule: this.eksClusterIngressRule,
-            instanceRoles: this.instanceRoles,
-            kubeconfig: this.kubeconfig,
-            kubeconfigJson: this.kubeconfigJson,
-            nodeSecurityGroup: this.nodeSecurityGroup,
-        });
-    }
-    getKubeconfig(args) {
-        var _a;
-        const kc = generateKubeconfig(this.eksCluster.name, this.eksCluster.endpoint, true, (_a = this.eksCluster.certificateAuthority) === null || _a === void 0 ? void 0 : _a.data, args);
-        return pulumi.output(kc).apply(JSON.stringify);
-    }
-}
-exports.ClusterInternal = ClusterInternal;
+Cluster.__pulumiType = 'eks:index:Cluster';
 //# sourceMappingURL=cluster.js.map