# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import json
import warnings
import pulumi
import pulumi.runtime
from typing import Union
from . import utilities, tables

class Cluster(pulumi.CustomResource):
    addon_job_timeout: pulumi.Output[float]
    """
    RKE k8s cluster addon deployment timeout in seconds for status check (int)
    """
    addons: pulumi.Output[str]
    """
    RKE k8s cluster user addons YAML manifest to be deployed (string)
    """
    addons_includes: pulumi.Output[list]
    """
    RKE k8s cluster user addons YAML manifest urls or paths to be deployed (list)
    """
    api_server_url: pulumi.Output[str]
    """
    (Computed) RKE k8s cluster api server url (string)
    """
    authentication: pulumi.Output[dict]
    """
    RKE k8s cluster authentication configuration (list maxitems:1)

      * `sans` (`list`) - List of additional hostnames and IPs to include in the api server PKI cert (list)
      * `strategy` (`str`) - Authentication strategy that will be used in RKE k8s cluster. Default: `x509` (string)
      * `webhook` (`dict`) - Webhook configuration options (list maxitem: 1)
        * `cacheTimeout` (`str`) - Controls how long to cache authentication decisions (string)
        * `configFile` (`str`) - Multiline string that represent a custom webhook config file (string)
    """
    authorization: pulumi.Output[dict]
    """
    RKE k8s cluster authorization mode configuration (list maxitems:1)

      * `mode` (`str`) - RKE mode for authorization. `rbac` and `none` modes are available. Default `rbac` (string)
      * `options` (`dict`) - Network provider options (map)
    """
    bastion_host: pulumi.Output[dict]
    """
    RKE k8s cluster bastion Host configuration (list maxitems:1)

      * `address` (`str`) - Address ip for node (string)
      * `port` (`str`) - Port used for SSH communication. Default `22` (string)
      * `ssh_agent_auth` (`bool`) - SSH Agent Auth enable (bool)
      * `sshCert` (`str`) - SSH Certificate (string)
      * `ssh_cert_path` (`str`) - SSH Certificate path (string)
      * `sshKey` (`str`) - SSH Private Key (string)
      * `ssh_key_path` (`str`) - SSH Private Key path (string)
      * `user` (`str`) - Registry user (string)
    """
    ca_crt: pulumi.Output[str]
    """
    (Computed/Sensitive) RKE k8s cluster CA certificate (string)
    """
    cert_dir: pulumi.Output[str]
    """
    Specify a certificate dir path (string)
    """
    certificates: pulumi.Output[list]
    """
    (Computed/Sensitive) RKE k8s cluster certificates (string)

      * `certificate` (`str`)
      * `commonName` (`str`)
      * `config` (`str`)
      * `configEnvName` (`str`)
      * `configPath` (`str`)
      * `envName` (`str`)
      * `id` (`str`) - (Computed) The ID of the resource (string)
      * `key` (`str`) - TLS key for etcd service (string)
      * `keyEnvName` (`str`)
      * `keyPath` (`str`)
      * `name` (`str`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
      * `ouName` (`str`)
      * `path` (`str`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
    """
    client_cert: pulumi.Output[str]
    """
    (Computed/Sensitive) RKE k8s cluster client certificate (string)
    """
    client_key: pulumi.Output[str]
    """
    (Computed/Sensitive) RKE k8s cluster client key (string)
    """
    cloud_provider: pulumi.Output[dict]
    """
    Calico cloud provider (string)

      * `awsCloudConfig` (`dict`) - Use aws_cloud_provider instead
        * `global` (`dict`) - (list maxitems:1)
          * `disableSecurityGroupIngress` (`bool`) - Disables the automatic ingress creation. Default `false` (bool)
          * `disableStrictZoneCheck` (`bool`) - Setting this to true will disable the check and provide a warning that the check was skipped. Default `false` (bool)
          * `elbSecurityGroup` (`str`) - Use these ELB security groups instead create new (string)
          * `kubernetesClusterId` (`str`) - The cluster id we'll use to identify our cluster resources (string)
          * `kubernetesClusterTag` (`str`) - Legacy cluster id we'll use to identify our cluster resources (string)
          * `roleArn` (`str`) - IAM role to assume when interaction with AWS APIs (string)
          * `routeTableId` (`str`) - Enables using a specific RouteTable (string)
          * `subnetId` (`str`) - (string)
          * `vpc` (`str`) - The AWS VPC flag enables the possibility to run the master components on a different aws account, on a different cloud provider or on-premises. If the flag is set also the KubernetesClusterTag must be provided (string)
          * `zone` (`str`) - The AWS zone (string)

        * `serviceOverrides` (`list`) - (list)
          * `key` (`str`) - TLS key for etcd service (string)
          * `region` (`str`) - Region for S3 service (string)
          * `service` (`str`) - (string)
          * `signingMethod` (`str`) - (string)
          * `signingName` (`str`) - (string)
          * `signingRegion` (`str`) - (string)
          * `url` (`str`) - Registry URL (string)

      * `awsCloudProvider` (`dict`) - AWS Cloud Provider config [rke-aws-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/aws/) (list maxitems:1)
        * `global` (`dict`) - (list maxitems:1)
          * `disableSecurityGroupIngress` (`bool`) - Disables the automatic ingress creation. Default `false` (bool)
          * `disableStrictZoneCheck` (`bool`) - Setting this to true will disable the check and provide a warning that the check was skipped. Default `false` (bool)
          * `elbSecurityGroup` (`str`) - Use these ELB security groups instead create new (string)
          * `kubernetesClusterId` (`str`) - The cluster id we'll use to identify our cluster resources (string)
          * `kubernetesClusterTag` (`str`) - Legacy cluster id we'll use to identify our cluster resources (string)
          * `roleArn` (`str`) - IAM role to assume when interaction with AWS APIs (string)
          * `routeTableId` (`str`) - Enables using a specific RouteTable (string)
          * `subnetId` (`str`) - (string)
          * `vpc` (`str`) - The AWS VPC flag enables the possibility to run the master components on a different aws account, on a different cloud provider or on-premises. If the flag is set also the KubernetesClusterTag must be provided (string)
          * `zone` (`str`) - The AWS zone (string)

        * `serviceOverrides` (`list`) - (list)
          * `key` (`str`) - TLS key for etcd service (string)
          * `region` (`str`) - Region for S3 service (string)
          * `service` (`str`) - (string)
          * `signingMethod` (`str`) - (string)
          * `signingName` (`str`) - (string)
          * `signingRegion` (`str`) - (string)
          * `url` (`str`) - Registry URL (string)

      * `azureCloudConfig` (`dict`) - Use azure_cloud_provider instead
        * `aadClientCertPassword` (`str`) - (string)
        * `aadClientCertPath` (`str`) - (string)
        * `aadClientId` (`str`) - (string)
        * `aadClientSecret` (`str`) - (string)
        * `cloud` (`str`) - (string)
        * `cloudProviderBackoff` (`bool`) - (bool)
        * `cloudProviderBackoffDuration` (`float`) - (int)
        * `cloudProviderBackoffExponent` (`float`) - (int)
        * `cloudProviderBackoffJitter` (`float`) - (int)
        * `cloudProviderBackoffRetries` (`float`) - (int)
        * `cloudProviderRateLimit` (`bool`) - (bool)
        * `cloudProviderRateLimitBucket` (`float`) - (int)
        * `cloudProviderRateLimitQps` (`float`) - (int)
        * `loadBalancerSku` (`str`)
        * `location` (`str`) - (string)
        * `maximumLoadBalancerRuleCount` (`float`) - (int)
        * `primaryAvailabilitySetName` (`str`) - (string)
        * `primaryScaleSetName` (`str`) - (string)
        * `resourceGroup` (`str`) - (string)
        * `routeTableName` (`str`) - (string)
        * `securityGroupName` (`str`) - (string)
        * `subnetName` (`str`) - (string)
        * `subscriptionId` (`str`) - (string)
        * `tenantId` (`str`) - Required if `tenant_name` not provided. (string)
        * `useInstanceMetadata` (`bool`) - (bool)
        * `useManagedIdentityExtension` (`bool`) - (bool)
        * `vmType` (`str`) - (string)
        * `vnetName` (`str`) - (string)
        * `vnetResourceGroup` (`str`) - (string)

      * `azureCloudProvider` (`dict`) - Azure Cloud Provider config [rke-azure-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/azure/) (list maxitems:1)
        * `aadClientCertPassword` (`str`) - (string)
        * `aadClientCertPath` (`str`) - (string)
        * `aadClientId` (`str`) - (string)
        * `aadClientSecret` (`str`) - (string)
        * `cloud` (`str`) - (string)
        * `cloudProviderBackoff` (`bool`) - (bool)
        * `cloudProviderBackoffDuration` (`float`) - (int)
        * `cloudProviderBackoffExponent` (`float`) - (int)
        * `cloudProviderBackoffJitter` (`float`) - (int)
        * `cloudProviderBackoffRetries` (`float`) - (int)
        * `cloudProviderRateLimit` (`bool`) - (bool)
        * `cloudProviderRateLimitBucket` (`float`) - (int)
        * `cloudProviderRateLimitQps` (`float`) - (int)
        * `loadBalancerSku` (`str`)
        * `location` (`str`) - (string)
        * `maximumLoadBalancerRuleCount` (`float`) - (int)
        * `primaryAvailabilitySetName` (`str`) - (string)
        * `primaryScaleSetName` (`str`) - (string)
        * `resourceGroup` (`str`) - (string)
        * `routeTableName` (`str`) - (string)
        * `securityGroupName` (`str`) - (string)
        * `subnetName` (`str`) - (string)
        * `subscriptionId` (`str`) - (string)
        * `tenantId` (`str`) - Required if `tenant_name` not provided. (string)
        * `useInstanceMetadata` (`bool`) - (bool)
        * `useManagedIdentityExtension` (`bool`) - (bool)
        * `vmType` (`str`) - (string)
        * `vnetName` (`str`) - (string)
        * `vnetResourceGroup` (`str`) - (string)

      * `customCloudConfig` (`str`) - Use custom_cloud_provider instead
      * `customCloudProvider` (`str`) - Custom Cloud Provider config (string)
      * `name` (`str`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
      * `openstackCloudConfig` (`dict`) - Use openstack_cloud_provider instead
        * `blockStorage` (`dict`) - (list maxitems:1)
          * `bsVersion` (`str`) - (string)
          * `ignoreVolumeAz` (`bool`) - (string)
          * `trustDevicePath` (`bool`) - (string)

        * `global` (`dict`) - (list maxitems:1)
          * `authUrl` (`str`) - (string)
          * `caFile` (`str`) - (string)
          * `domainId` (`str`) - Required if `domain_name` not provided. (string)
          * `domainName` (`str`) - Required if `domain_id` not provided. (string)
          * `password` (`str`) - Registry password (string)
          * `region` (`str`) - Region for S3 service (string)
          * `tenantId` (`str`) - Required if `tenant_name` not provided. (string)
          * `tenantName` (`str`) - Required if `tenant_id` not provided. (string)
          * `trustId` (`str`) - (string)
          * `userId` (`str`) - Required if `username` not provided. (string)
          * `username` (`str`) - Required if `user_id` not provided. (string)

        * `loadBalancer` (`dict`) - (list maxitems:1)
          * `createMonitor` (`bool`) - (bool)
          * `floatingNetworkId` (`str`) - (string)
          * `lbMethod` (`str`) - (string)
          * `lbProvider` (`str`) - (string)
          * `lbVersion` (`str`) - (string)
          * `manageSecurityGroups` (`bool`) - (bool)
          * `monitorDelay` (`str`) - Default `60s` (string)
          * `monitorMaxRetries` (`float`) - Default 5 (int)
          * `monitorTimeout` (`str`) - Default `30s` (string)
          * `subnetId` (`str`) - (string)
          * `useOctavia` (`bool`) - (bool)

        * `metadata` (`dict`) - (list maxitems:1)
          * `requestTimeout` (`float`) - (int)
          * `searchOrder` (`str`) - (string)

        * `route` (`dict`) - (list maxitems:1)
          * `routerId` (`str`) - (string)

      * `openstackCloudProvider` (`dict`) - Openstack Cloud Provider config [rke-openstack-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/openstack/) (list maxitems:1)
        * `blockStorage` (`dict`) - (list maxitems:1)
          * `bsVersion` (`str`) - (string)
          * `ignoreVolumeAz` (`bool`) - (string)
          * `trustDevicePath` (`bool`) - (string)

        * `global` (`dict`) - (list maxitems:1)
          * `authUrl` (`str`) - (string)
          * `caFile` (`str`) - (string)
          * `domainId` (`str`) - Required if `domain_name` not provided. (string)
          * `domainName` (`str`) - Required if `domain_id` not provided. (string)
          * `password` (`str`) - Registry password (string)
          * `region` (`str`) - Region for S3 service (string)
          * `tenantId` (`str`) - Required if `tenant_name` not provided. (string)
          * `tenantName` (`str`) - Required if `tenant_id` not provided. (string)
          * `trustId` (`str`) - (string)
          * `userId` (`str`) - Required if `username` not provided. (string)
          * `username` (`str`) - Required if `user_id` not provided. (string)

        * `loadBalancer` (`dict`) - (list maxitems:1)
          * `createMonitor` (`bool`) - (bool)
          * `floatingNetworkId` (`str`) - (string)
          * `lbMethod` (`str`) - (string)
          * `lbProvider` (`str`) - (string)
          * `lbVersion` (`str`) - (string)
          * `manageSecurityGroups` (`bool`) - (bool)
          * `monitorDelay` (`str`) - Default `60s` (string)
          * `monitorMaxRetries` (`float`) - Default 5 (int)
          * `monitorTimeout` (`str`) - Default `30s` (string)
          * `subnetId` (`str`) - (string)
          * `useOctavia` (`bool`) - (bool)

        * `metadata` (`dict`) - (list maxitems:1)
          * `requestTimeout` (`float`) - (int)
          * `searchOrder` (`str`) - (string)

        * `route` (`dict`) - (list maxitems:1)
          * `routerId` (`str`) - (string)

      * `vsphereCloudConfig` (`dict`) - Use vsphere_cloud_provider instead
        * `disk` (`dict`) - (list maxitems:1)
          * `scsiControllerType` (`str`) - (string)

        * `global` (`dict`) - (list maxitems:1)
          * `datacenter` (`str`) - (string)
          * `datacenters` (`str`) - (string)
          * `datastore` (`str`) - (string)
          * `insecureFlag` (`bool`) - (bool)
          * `password` (`str`) - Registry password (string)
          * `port` (`str`) - Port used for SSH communication. Default `22` (string)
          * `soapRoundtripCount` (`float`) - (int)
          * `user` (`str`) - Registry user (string)
          * `vmName` (`str`) - (string)
          * `vmUuid` (`str`) - (string)
          * `workingDir` (`str`) - (string)

        * `network` (`dict`) - (list maxitems:1)
          * `publicNetwork` (`str`) - (string)

        * `virtualCenters` (`list`) - (List)
          * `datacenters` (`str`) - (string)
          * `name` (`str`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
          * `password` (`str`) - Registry password (string)
          * `port` (`str`) - Port used for SSH communication. Default `22` (string)
          * `soapRoundtripCount` (`float`) - (int)
          * `user` (`str`) - Registry user (string)

        * `workspace` (`dict`) - (list maxitems:1)
          * `datacenter` (`str`) - (string)
          * `defaultDatastore` (`str`) - (string)
          * `folder` (`str`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
          * `resourcepoolPath` (`str`) - (string)
          * `server` (`str`) - (string)

      * `vsphereCloudProvider` (`dict`) - Vsphere Cloud Provider config [rke-vsphere-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere/) Extra argument `name` is required on `virtual_center` configuration. (list maxitems:1)
        * `disk` (`dict`) - (list maxitems:1)
          * `scsiControllerType` (`str`) - (string)

        * `global` (`dict`) - (list maxitems:1)
          * `datacenter` (`str`) - (string)
          * `datacenters` (`str`) - (string)
          * `datastore` (`str`) - (string)
          * `insecureFlag` (`bool`) - (bool)
          * `password` (`str`) - Registry password (string)
          * `port` (`str`) - Port used for SSH communication. Default `22` (string)
          * `soapRoundtripCount` (`float`) - (int)
          * `user` (`str`) - Registry user (string)
          * `vmName` (`str`) - (string)
          * `vmUuid` (`str`) - (string)
          * `workingDir` (`str`) - (string)

        * `network` (`dict`) - (list maxitems:1)
          * `publicNetwork` (`str`) - (string)

        * `virtualCenters` (`list`) - (List)
          * `datacenters` (`str`) - (string)
          * `name` (`str`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
          * `password` (`str`) - Registry password (string)
          * `port` (`str`) - Port used for SSH communication. Default `22` (string)
          * `soapRoundtripCount` (`float`) - (int)
          * `user` (`str`) - Registry user (string)

        * `workspace` (`dict`) - (list maxitems:1)
          * `datacenter` (`str`) - (string)
          * `defaultDatastore` (`str`) - (string)
          * `folder` (`str`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
          * `resourcepoolPath` (`str`) - (string)
          * `server` (`str`) - (string)
    """
    cluster_cidr: pulumi.Output[str]
    """
    Cluster CIDR option for kube controller service (string)
    """
    cluster_dns_server: pulumi.Output[str]
    """
    Cluster DNS Server option for kubelet service (string)
    """
    cluster_domain: pulumi.Output[str]
    """
    Cluster Domain option for kubelet service. Default `cluster.local` (string)
    """
    cluster_name: pulumi.Output[str]
    """
    RKE k8s cluster name used in the kube config (string)
    """
    cluster_yaml: pulumi.Output[str]
    """
    RKE k8s cluster config yaml encoded. Provider arguments take precedence over this one (string)
    """
    control_plane_hosts: pulumi.Output[list]
    """
    (Computed) RKE k8s cluster control plane nodes (list)

      * `address` (`str`) - Address ip for node (string)
      * `nodeName` (`str`) - Name of the host provisioned via docker machine (string)
    """
    custom_certs: pulumi.Output[bool]
    """
    Use custom certificates from a cert dir (string)
    """
    delay_on_creation: pulumi.Output[float]
    """
    RKE k8s cluster delay on creation (int)
    """
    dind: pulumi.Output[bool]
    """
    Deploy RKE cluster on a dind environment. Default: `false` (bool)
    """
    dind_dns_server: pulumi.Output[str]
    """
    DinD RKE cluster dns (string)
    """
    dind_storage_driver: pulumi.Output[str]
    """
    DinD RKE cluster storage driver (string)
    """
    disable_port_check: pulumi.Output[bool]
    """
    Enable/Disable RKE k8s cluster port checking. Default `false` (bool)
    """
    dns: pulumi.Output[dict]
    """
    RKE k8s cluster DNS Config (list maxitems:1)

      * `nodeSelector` (`dict`) - Node selector key pair (map)
      * `provider` (`str`) - Monitoring provider (string)
      * `reverseCidrs` (`list`) - Reverse CIDRs  (list)
      * `upstreamNameservers` (`list`) - Upstream nameservers  (list)
    """
    etcd_hosts: pulumi.Output[list]
    """
    (Computed) RKE k8s cluster etcd nodes (list)

      * `address` (`str`) - Address ip for node (string)
      * `nodeName` (`str`) - Name of the host provisioned via docker machine (string)
    """
    ignore_docker_version: pulumi.Output[bool]
    """
    Enable/Disable RKE k8s cluster strict docker version checking. Default `false` (bool)
    """
    inactive_hosts: pulumi.Output[list]
    """
    (Computed) RKE k8s cluster inactive nodes (list)

      * `address` (`str`) - Address ip for node (string)
      * `nodeName` (`str`) - Name of the host provisioned via docker machine (string)
    """
    ingress: pulumi.Output[dict]
    """
    Docker image for ingress (string)

      * `dnsPolicy` (`str`) - Ingress controller DNS policy. `ClusterFirstWithHostNet`, `ClusterFirst`, `Default`, and `None` are supported. [K8S dns Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) (string)
      * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
      * `nodeSelector` (`dict`) - Node selector key pair (map)
      * `options` (`dict`) - Network provider options (map)
      * `provider` (`str`) - Monitoring provider (string)
    """
    internal_kube_config_yaml: pulumi.Output[str]
    """
    (Computed/Sensitive) RKE k8s cluster internal kube config yaml (string)
    """
    kube_admin_user: pulumi.Output[str]
    """
    (Computed) RKE k8s cluster admin user (string)
    """
    kube_config_yaml: pulumi.Output[str]
    """
    (Computed/Sensitive) RKE k8s cluster kube config yaml (string)
    """
    kubernetes_version: pulumi.Output[str]
    """
    K8s version to deploy. If kubernetes image is specified, image version takes precedence. Default: `rke default` (string)
    """
    monitoring: pulumi.Output[dict]
    """
    RKE k8s cluster monitoring Config (list maxitems:1)

      * `nodeSelector` (`dict`) - Node selector key pair (map)
      * `options` (`dict`) - Network provider options (map)
      * `provider` (`str`) - Monitoring provider (string)
    """
    network: pulumi.Output[dict]
    """
    (list maxitems:1)

      * `calicoNetworkProvider` (`dict`) - Calico network provider config (list maxitems:1)
        * `cloud_provider` (`str`) - Calico cloud provider (string)

      * `canalNetworkProvider` (`dict`) - Canal network provider config (list maxitems:1)
        * `iface` (`str`) - Flannel network interface (string)

      * `flannelNetworkProvider` (`dict`) - Flannel network provider config (list maxitems:1)
        * `iface` (`str`) - Flannel network interface (string)

      * `mtu` (`float`) - Network provider MTU. Default `0` (int)
      * `options` (`dict`) - Network provider options (map)
      * `plugin` (`str`) - Network provider plugin. `calico`, `canal` (default), `flannel`, `none` and `weave` are supported. (string)
      * `weaveNetworkProvider` (`dict`) - Weave network provider config (list maxitems:1)
        * `password` (`str`) - Registry password (string)
    """
    nodes: pulumi.Output[list]
    """
    RKE k8s cluster nodes (list)

      * `address` (`str`) - Address ip for node (string)
      * `dockerSocket` (`str`) - Docker socket on the node that will be used in tunneling (string)
      * `hostnameOverride` (`str`) - Hostname override for node (string)
      * `internalAddress` (`str`) - Internal address that will be used for components communication (string)
      * `labels` (`dict`) - Node labels (map)
      * `nodeName` (`str`) - Name of the host provisioned via docker machine (string)
      * `port` (`str`) - Port used for SSH communication. Default `22` (string)
      * `roles` (`list`) - Node roles in k8s cluster. `controlplane`, `etcd` and `worker` are supported. (list)
      * `rolesDeprecated` (`str`)
      * `ssh_agent_auth` (`bool`) - SSH Agent Auth enable (bool)
      * `sshCert` (`str`) - SSH Certificate (string)
      * `ssh_cert_path` (`str`) - SSH Certificate path (string)
      * `sshKey` (`str`) - SSH Private Key (string)
      * `ssh_key_path` (`str`) - SSH Private Key path (string)
      * `taints` (`list`) - Node taints (list)
        * `effect` (`str`) - Taint effect. `NoExecute`, `NoSchedule` (default) and `PreferNoSchedule` are supported (string)
        * `key` (`str`) - TLS key for etcd service (string)
        * `value` (`str`) - Taint value (string)

      * `user` (`str`) - Registry user (string)
    """
    nodes_confs: pulumi.Output[list]
    prefix_path: pulumi.Output[str]
    """
    RKE k8s directory path (string)
    """
    private_registries: pulumi.Output[list]
    """
    RKE k8s cluster private docker registries (list)

      * `isDefault` (`bool`) - Set as default registry. Default `false` (bool)
      * `password` (`str`) - Registry password (string)
      * `url` (`str`) - Registry URL (string)
      * `user` (`str`) - Registry user (string)
    """
    restore: pulumi.Output[dict]
    """
    Restore cluster. Default `false` (bool)

      * `restore` (`bool`) - Restore cluster. Default `false` (bool)
      * `snapshotName` (`str`) - Snapshot name (string)
    """
    rke_cluster_yaml: pulumi.Output[str]
    """
    (Computed/Sensitive) RKE k8s cluster config yaml (string)
    """
    rke_state: pulumi.Output[str]
    """
    (Computed/Sensitive) RKE k8s cluster state (string)
    """
    rotate_certificates: pulumi.Output[dict]
    """
    RKE k8s cluster rotate certificates configuration (list maxitems:1)

      * `caCertificates` (`bool`) - Rotate CA Certificates. Default `false` (bool)
      * `services` (`list`) - Services to rotate their certs. `etcd`, `kubelet`, `kube-apiserver`, `kube-proxy`, `kube-scheduler` and `kube-controller-manager` are supported (list)
    """
    running_system_images: pulumi.Output[dict]
    """
    (Computed) RKE k8s cluster running system images list (list)

      * `alpine` (`str`) - Docker image for alpine (string)
      * `calicoCni` (`str`) - Docker image for calico_cni (string)
      * `calicoControllers` (`str`) - Docker image for calico_controllers (string)
      * `calicoCtl` (`str`) - Docker image for calico_ctl (string)
      * `calicoFlexVol` (`str`) - Docker image for calico_flex_vol (string)
      * `calicoNode` (`str`) - Docker image for calico_node (string)
      * `canalCni` (`str`) - Docker image for canal_cni (string)
      * `canalFlannel` (`str`) - Docker image for canal_flannel (string)
      * `canalFlexVol` (`str`) - Docker image for canal_flex_vol (string)
      * `canalNode` (`str`) - Docker image for canal_node (string)
      * `certDownloader` (`str`) - Docker image for cert_downloader (string)
      * `coredns` (`str`) - Docker image for coredns (string)
      * `corednsAutoscaler` (`str`) - Docker image for coredns_autoscaler (string)
      * `dnsmasq` (`str`) - Docker image for dnsmasq (string)
      * `etcd` (`str`) - Docker image for etcd (string)
      * `flannel` (`str`) - Docker image for flannel (string)
      * `flannelCni` (`str`) - Docker image for flannel_cni (string)
      * `ingress` (`str`) - Docker image for ingress (string)
      * `ingressBackend` (`str`) - Docker image for ingress_backend (string)
      * `kubeDns` (`str`) - Docker image for kube_dns (string)
      * `kubeDnsAutoscaler` (`str`) - Docker image for kube_dns_autoscaler (string)
      * `kubeDnsSidecar` (`str`) - Docker image for kube_dns_sidecar (string)
      * `kubernetes` (`str`) - Docker image for kubernetes (string)
      * `kubernetesServicesSidecar` (`str`) - Docker image for kubernetes_services_sidecar (string)
      * `metricsServer` (`str`) - Docker image for metrics_server (string)
      * `nginxProxy` (`str`) - Docker image for nginx_proxy (string)
      * `nodelocal` (`str`) - Docker image for nodelocal (string)
      * `podInfraContainer` (`str`) - Docker image for pod_infra_container (string)
      * `weaveCni` (`str`) - Docker image for weave_cni (string)
      * `weaveNode` (`str`) - Docker image for weave_node (string)
      * `windowsPodInfraContainer` (`str`) - Docker image for windows_pod_infra_container (string)
    """
    services: pulumi.Output[dict]
    """
    Services to rotate their certs. `etcd`, `kubelet`, `kube-apiserver`, `kube-proxy`, `kube-scheduler` and `kube-controller-manager` are supported (list)

      * `etcd` (`dict`) - Docker image for etcd (string)
        * `backupConfig` (`dict`) - Backup options for etcd service. Just for Rancher v2.2.x (list maxitems:1)
          * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)
          * `intervalHours` (`float`) - Interval hours for etcd backup. Default `12` (int)
          * `retention` (`float`) - Retention for etcd backup. Default `6` (int)
          * `s3BackupConfig` (`dict`) - S3 config options for etcd backup (list maxitems:1)
            * `accessKey` (`str`) - Access key for S3 service (string)
            * `bucketName` (`str`) - Bucket name for S3 service (string)
            * `customCa` (`str`) - Base64 encoded custom CA for S3 service. Use filebase64(<FILE>) for encoding file. Available from Rancher v2.2.5 (string)
            * `endpoint` (`str`) - Endpoint for S3 service (string)
            * `folder` (`str`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
            * `region` (`str`) - Region for S3 service (string)
            * `secretKey` (`str`) - Secret key for S3 service (string)

          * `safeTimestamp` (`bool`) - Safe timestamp for etcd backup. Default: `false` (bool)

        * `caCert` (`str`) - TLS CA certificate for etcd service (string)
        * `cert` (`str`) - TLS certificate for etcd service (string)
        * `creation` (`str`) - Creation option for etcd service (string)
        * `externalUrls` (`list`) - External urls for etcd service (list)
        * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
        * `extraBinds` (`list`) - Extra binds for scheduler service (list)
        * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
        * `gid` (`float`) - Etcd service GID. Default: `0`. For Rancher v2.3.x or above (int)
        * `image` (`str`) - Docker image for scheduler service (string)
        * `key` (`str`) - TLS key for etcd service (string)
        * `path` (`str`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
        * `retention` (`str`) - Retention for etcd backup. Default `6` (int)
        * `snapshot` (`bool`) - Snapshot option for etcd service. Default `true` (bool)
        * `uid` (`float`) - Etcd service UID. Default: `0`. For Rancher v2.3.x or above (int)

      * `kubeApi` (`dict`) - Kube API options for RKE services (list maxitems:1)
        * `alwaysPullImages` (`bool`) - Enable [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages) Admission controller plugin. [Rancher docs](https://rancher.com/docs/rke/latest/en/config-options/services/#kubernetes-api-server-options) Default: `false` (bool)
        * `auditLog` (`dict`) - K8s audit log configuration. (list maxitem: 1)
          * `configuration` (`dict`) - Audit log configuration. (list maxtiem: 1)
            * `format` (`str`) - Audit log format. Default: `json` (string)
            * `maxAge` (`float`) - Audit log max age. Default: `30` (int)
            * `maxBackup` (`float`) - Audit log max backup. Default: `10` (int)
            * `maxSize` (`float`) - Audit log max size. Default: `100` (int)
            * `path` (`str`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
            * `policy` (`str`) - Audit policy json encoded definition. `"apiVersion"` and `"kind":"Policy","rules"` fields are required in the json. Ex. `jsonencode({"apiVersion":"audit.k8s.io/v1","kind":"Policy","rules":[{"level":"RequestResponse","resources":[{"group":"","resources":["pods"]}]}]})` [More info](https://rancher.com/docs/rke/latest/en/config-options/audit-log/) (string)

          * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)

        * `eventRateLimit` (`dict`) - K8s event rate limit configuration. (list maxitem: 1)
          * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)

        * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
        * `extraBinds` (`list`) - Extra binds for scheduler service (list)
        * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
        * `image` (`str`) - Docker image for scheduler service (string)
        * `podSecurityPolicy` (`bool`) - Pod Security Policy option for kube API service. Default `false` (bool)
        * `secretsEncryptionConfig` (`dict`) - [Encrypt k8s secret data configration](https://rancher.com/docs/rke/latest/en/config-options/secrets-encryption/). (list maxitem: 1)
          * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)

        * `serviceClusterIpRange` (`str`) - Service Cluster ip Range option for kube controller service (string)
        * `serviceNodePortRange` (`str`) - Service Node Port Range option for kube API service (string)

      * `kubeController` (`dict`) - Kube Controller options for RKE services (list maxitems:1)
        * `cluster_cidr` (`str`) - Cluster CIDR option for kube controller service (string)
        * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
        * `extraBinds` (`list`) - Extra binds for scheduler service (list)
        * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
        * `image` (`str`) - Docker image for scheduler service (string)
        * `serviceClusterIpRange` (`str`) - Service Cluster ip Range option for kube controller service (string)

      * `kubelet` (`dict`) - Kubelet options for RKE services (list maxitems:1)
        * `cluster_dns_server` (`str`) - Cluster DNS Server option for kubelet service (string)
        * `cluster_domain` (`str`) - Cluster Domain option for kubelet service. Default `cluster.local` (string)
        * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
        * `extraBinds` (`list`) - Extra binds for scheduler service (list)
        * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
        * `failSwapOn` (`bool`) - Enable or disable failing when swap on is not supported (bool)
          * `generate_serving_certificate` [Generate a certificate signed by the kube-ca](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-serving-certificate-requirements). Default `false` (bool)
        * `generateServingCertificate` (`bool`)
        * `image` (`str`) - Docker image for scheduler service (string)
        * `infraContainerImage` (`str`) - Infra container image for kubelet service (string)

      * `kubeproxy` (`dict`) - Kubeproxy options for RKE services (list maxitems:1)
        * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
        * `extraBinds` (`list`) - Extra binds for scheduler service (list)
        * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
        * `image` (`str`) - Docker image for scheduler service (string)

      * `scheduler` (`dict`) - Scheduler options for RKE services (list maxitems:1)
        * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
        * `extraBinds` (`list`) - Extra binds for scheduler service (list)
        * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
        * `image` (`str`) - Docker image for scheduler service (string)
    """
    services_etcd_deprecated: pulumi.Output[dict]
    """
    Use services.etcd instead (list maxitems:1)

      * `backupConfig` (`dict`) - Backup options for etcd service. Just for Rancher v2.2.x (list maxitems:1)
        * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)
        * `intervalHours` (`float`) - Interval hours for etcd backup. Default `12` (int)
        * `retention` (`float`) - Retention for etcd backup. Default `6` (int)
        * `s3BackupConfig` (`dict`) - S3 config options for etcd backup (list maxitems:1)
          * `accessKey` (`str`) - Access key for S3 service (string)
          * `bucketName` (`str`) - Bucket name for S3 service (string)
          * `customCa` (`str`) - Base64 encoded custom CA for S3 service. Use filebase64(<FILE>) for encoding file. Available from Rancher v2.2.5 (string)
          * `endpoint` (`str`) - Endpoint for S3 service (string)
          * `folder` (`str`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
          * `region` (`str`) - Region for S3 service (string)
          * `secretKey` (`str`) - Secret key for S3 service (string)

        * `safeTimestamp` (`bool`) - Safe timestamp for etcd backup. Default: `false` (bool)

      * `caCert` (`str`) - TLS CA certificate for etcd service (string)
      * `cert` (`str`) - TLS certificate for etcd service (string)
      * `creation` (`str`) - Creation option for etcd service (string)
      * `externalUrls` (`list`) - External urls for etcd service (list)
      * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
      * `extraBinds` (`list`) - Extra binds for scheduler service (list)
      * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
      * `gid` (`float`) - Etcd service GID. Default: `0`. For Rancher v2.3.x or above (int)
      * `image` (`str`) - Docker image for scheduler service (string)
      * `key` (`str`) - TLS key for etcd service (string)
      * `path` (`str`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
      * `retention` (`str`) - Retention for etcd backup. Default `6` (int)
      * `snapshot` (`bool`) - Snapshot option for etcd service. Default `true` (bool)
      * `uid` (`float`) - Etcd service UID. Default: `0`. For Rancher v2.3.x or above (int)
    """
    services_kube_api_deprecated: pulumi.Output[dict]
    """
    Use services.kube_api instead (list maxitems:1)

      * `alwaysPullImages` (`bool`) - Enable [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages) Admission controller plugin. [Rancher docs](https://rancher.com/docs/rke/latest/en/config-options/services/#kubernetes-api-server-options) Default: `false` (bool)
      * `auditLog` (`dict`) - K8s audit log configuration. (list maxitem: 1)
        * `configuration` (`dict`) - Audit log configuration. (list maxtiem: 1)
          * `format` (`str`) - Audit log format. Default: `json` (string)
          * `maxAge` (`float`) - Audit log max age. Default: `30` (int)
          * `maxBackup` (`float`) - Audit log max backup. Default: `10` (int)
          * `maxSize` (`float`) - Audit log max size. Default: `100` (int)
          * `path` (`str`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
          * `policy` (`str`) - Audit policy json encoded definition. `"apiVersion"` and `"kind":"Policy","rules"` fields are required in the json. Ex. `jsonencode({"apiVersion":"audit.k8s.io/v1","kind":"Policy","rules":[{"level":"RequestResponse","resources":[{"group":"","resources":["pods"]}]}]})` [More info](https://rancher.com/docs/rke/latest/en/config-options/audit-log/) (string)

        * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)

      * `eventRateLimit` (`dict`) - K8s event rate limit configuration. (list maxitem: 1)
        * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)

      * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
      * `extraBinds` (`list`) - Extra binds for scheduler service (list)
      * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
      * `image` (`str`) - Docker image for scheduler service (string)
      * `podSecurityPolicy` (`bool`) - Pod Security Policy option for kube API service. Default `false` (bool)
      * `secretsEncryptionConfig` (`dict`) - [Encrypt k8s secret data configration](https://rancher.com/docs/rke/latest/en/config-options/secrets-encryption/). (list maxitem: 1)
        * `enabled` (`bool`) - Enable secrets encryption. Default: `false` (bool)

      * `serviceClusterIpRange` (`str`) - Service Cluster ip Range option for kube controller service (string)
      * `serviceNodePortRange` (`str`) - Service Node Port Range option for kube API service (string)
    """
    services_kube_controller_deprecated: pulumi.Output[dict]
    """
    Use services.kube_controller instead (list maxitems:1)

      * `cluster_cidr` (`str`) - Cluster CIDR option for kube controller service (string)
      * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
      * `extraBinds` (`list`) - Extra binds for scheduler service (list)
      * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
      * `image` (`str`) - Docker image for scheduler service (string)
      * `serviceClusterIpRange` (`str`) - Service Cluster ip Range option for kube controller service (string)
    """
    services_kube_proxy_deprecated: pulumi.Output[dict]
    """
    Use services.kubeproxy instead (list maxitems:1)

      * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
      * `extraBinds` (`list`) - Extra binds for scheduler service (list)
      * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
      * `image` (`str`) - Docker image for scheduler service (string)
    """
    services_kube_scheduler_deprecated: pulumi.Output[dict]
    """
    Use services.scheduler instead (list maxitems:1)

      * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
      * `extraBinds` (`list`) - Extra binds for scheduler service (list)
      * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
      * `image` (`str`) - Docker image for scheduler service (string)
    """
    services_kubelet_deprecated: pulumi.Output[dict]
    """
    Use services.kubelet instead (list maxitems:1)

      * `cluster_dns_server` (`str`) - Cluster DNS Server option for kubelet service (string)
      * `cluster_domain` (`str`) - Cluster Domain option for kubelet service. Default `cluster.local` (string)
      * `extraArgs` (`dict`) - Extra arguments for scheduler service (map)
      * `extraBinds` (`list`) - Extra binds for scheduler service (list)
      * `extraEnvs` (`list`) - Extra environment for scheduler service (list)
      * `failSwapOn` (`bool`) - Enable or disable failing when swap on is not supported (bool)
        * `generate_serving_certificate` [Generate a certificate signed by the kube-ca](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-serving-certificate-requirements). Default `false` (bool)
      * `generateServingCertificate` (`bool`)
      * `image` (`str`) - Docker image for scheduler service (string)
      * `infraContainerImage` (`str`) - Infra container image for kubelet service (string)
    """
    ssh_agent_auth: pulumi.Output[bool]
    """
    SSH Agent Auth enable (bool)
    """
    ssh_cert_path: pulumi.Output[str]
    """
    SSH Certificate path (string)
    """
    ssh_key_path: pulumi.Output[str]
    """
    SSH Private Key path (string)
    """
    system_images: pulumi.Output[dict]
    """
    RKE k8s cluster system images list (list maxitems:1)

      * `alpine` (`str`) - Docker image for alpine (string)
      * `calicoCni` (`str`) - Docker image for calico_cni (string)
      * `calicoControllers` (`str`) - Docker image for calico_controllers (string)
      * `calicoCtl` (`str`) - Docker image for calico_ctl (string)
      * `calicoFlexVol` (`str`) - Docker image for calico_flex_vol (string)
      * `calicoNode` (`str`) - Docker image for calico_node (string)
      * `canalCni` (`str`) - Docker image for canal_cni (string)
      * `canalFlannel` (`str`) - Docker image for canal_flannel (string)
      * `canalFlexVol` (`str`) - Docker image for canal_flex_vol (string)
      * `canalNode` (`str`) - Docker image for canal_node (string)
      * `certDownloader` (`str`) - Docker image for cert_downloader (string)
      * `coredns` (`str`) - Docker image for coredns (string)
      * `corednsAutoscaler` (`str`) - Docker image for coredns_autoscaler (string)
      * `dnsmasq` (`str`) - Docker image for dnsmasq (string)
      * `etcd` (`str`) - Docker image for etcd (string)
      * `flannel` (`str`) - Docker image for flannel (string)
      * `flannelCni` (`str`) - Docker image for flannel_cni (string)
      * `ingress` (`str`) - Docker image for ingress (string)
      * `ingressBackend` (`str`) - Docker image for ingress_backend (string)
      * `kubeDns` (`str`) - Docker image for kube_dns (string)
      * `kubeDnsAutoscaler` (`str`) - Docker image for kube_dns_autoscaler (string)
      * `kubeDnsSidecar` (`str`) - Docker image for kube_dns_sidecar (string)
      * `kubernetes` (`str`) - Docker image for kubernetes (string)
      * `kubernetesServicesSidecar` (`str`) - Docker image for kubernetes_services_sidecar (string)
      * `metricsServer` (`str`) - Docker image for metrics_server (string)
      * `nginxProxy` (`str`) - Docker image for nginx_proxy (string)
      * `nodelocal` (`str`) - Docker image for nodelocal (string)
      * `podInfraContainer` (`str`) - Docker image for pod_infra_container (string)
      * `weaveCni` (`str`) - Docker image for weave_cni (string)
      * `weaveNode` (`str`) - Docker image for weave_node (string)
      * `windowsPodInfraContainer` (`str`) - Docker image for windows_pod_infra_container (string)
    """
    update_only: pulumi.Output[bool]
    """
    Skip idempotent deployment of control and etcd plane. Default `false` (bool)
    """
    upgrade_strategy: pulumi.Output[dict]
    """
    RKE k8s cluster upgrade strategy (list maxitems:1)

      * `drain` (`bool`) - RKE drain nodes. Default: `false` (bool)
      * `drainInput` (`dict`) - RKE drain node input (list Maxitems: 1)
        * `deleteLocalData` (`bool`) - Delete RKE node local data. Default: `false` (bool)
        * `force` (`bool`) - Force RKE node drain. Default: `false` (bool)
        * `gracePeriod` (`float`) - RKE node drain grace period. Default: `-1` (int)
        * `ignoreDaemonSets` (`bool`) - Ignore RKE daemon sets. Default: `true` (bool)
        * `timeout` (`float`) - RKE node drain timeout. Default: `60` (int)

      * `maxUnavailableControlplane` (`str`) - RKE max unavailable controlplane nodes. Default: `1` (string)
      * `maxUnavailableWorker` (`str`) - RKE max unavailable worker nodes. Default: `10%` (string)
    """
    worker_hosts: pulumi.Output[list]
    """
    (Computed) RKE k8s cluster worker nodes (list)

      * `address` (`str`) - Address ip for node (string)
      * `nodeName` (`str`) - Name of the host provisioned via docker machine (string)
    """
    def __init__(__self__, resource_name, opts=None, addon_job_timeout=None, addons=None, addons_includes=None, authentication=None, authorization=None, bastion_host=None, cert_dir=None, cloud_provider=None, cluster_name=None, cluster_yaml=None, custom_certs=None, delay_on_creation=None, dind=None, dind_dns_server=None, dind_storage_driver=None, disable_port_check=None, dns=None, ignore_docker_version=None, ingress=None, kubernetes_version=None, monitoring=None, network=None, nodes=None, nodes_confs=None, prefix_path=None, private_registries=None, restore=None, rotate_certificates=None, services=None, services_etcd_deprecated=None, services_kube_api_deprecated=None, services_kube_controller_deprecated=None, services_kube_proxy_deprecated=None, services_kube_scheduler_deprecated=None, services_kubelet_deprecated=None, ssh_agent_auth=None, ssh_cert_path=None, ssh_key_path=None, system_images=None, update_only=None, upgrade_strategy=None, __props__=None, __name__=None, __opts__=None):
        """
        Provides RKE cluster resource. This can be used to create RKE clusters and retrieve their information.

        RKE clusters can be defined in the provider:
        - Using cluster_yaml: The full RKE cluster is defined in an RKE cluster.yml file.
        - Using the TF provider arguments to define the entire cluster.
        - Using a combination of both the cluster_yaml and TF provider arguments. The TF arguments will override the cluster_yaml options if collisions occur.

        > This content is derived from https://github.com/rancher/terraform-provider-rke/blob/master/website/docs/r/cluster.html.markdown.

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[float] addon_job_timeout: RKE k8s cluster addon deployment timeout in seconds for status check (int)
        :param pulumi.Input[str] addons: RKE k8s cluster user addons YAML manifest to be deployed (string)
        :param pulumi.Input[list] addons_includes: RKE k8s cluster user addons YAML manifest urls or paths to be deployed (list)
        :param pulumi.Input[dict] authentication: RKE k8s cluster authentication configuration (list maxitems:1)
        :param pulumi.Input[dict] authorization: RKE k8s cluster authorization mode configuration (list maxitems:1)
        :param pulumi.Input[dict] bastion_host: RKE k8s cluster bastion Host configuration (list maxitems:1)
        :param pulumi.Input[str] cert_dir: Specify a certificate dir path (string)
        :param pulumi.Input[dict] cloud_provider: Calico cloud provider (string)
        :param pulumi.Input[str] cluster_name: RKE k8s cluster name used in the kube config (string)
        :param pulumi.Input[str] cluster_yaml: RKE k8s cluster config yaml encoded. Provider arguments take precedence over this one (string)
        :param pulumi.Input[bool] custom_certs: Use custom certificates from a cert dir (string)
        :param pulumi.Input[float] delay_on_creation: RKE k8s cluster delay on creation (int)
        :param pulumi.Input[bool] dind: Deploy RKE cluster on a dind environment. Default: `false` (bool)
        :param pulumi.Input[str] dind_dns_server: DinD RKE cluster dns (string)
        :param pulumi.Input[str] dind_storage_driver: DinD RKE cluster storage driver (string)
        :param pulumi.Input[bool] disable_port_check: Enable/Disable RKE k8s cluster port checking. Default `false` (bool)
        :param pulumi.Input[dict] dns: RKE k8s cluster DNS Config (list maxitems:1)
        :param pulumi.Input[bool] ignore_docker_version: Enable/Disable RKE k8s cluster strict docker version checking. Default `false` (bool)
        :param pulumi.Input[dict] ingress: Docker image for ingress (string)
        :param pulumi.Input[str] kubernetes_version: K8s version to deploy. If kubernetes image is specified, image version takes precedence. Default: `rke default` (string)
        :param pulumi.Input[dict] monitoring: RKE k8s cluster monitoring Config (list maxitems:1)
        :param pulumi.Input[dict] network: (list maxitems:1)
        :param pulumi.Input[list] nodes: RKE k8s cluster nodes (list)
        :param pulumi.Input[str] prefix_path: RKE k8s directory path (string)
        :param pulumi.Input[list] private_registries: RKE k8s cluster private docker registries (list)
        :param pulumi.Input[dict] restore: Restore cluster. Default `false` (bool)
        :param pulumi.Input[dict] rotate_certificates: RKE k8s cluster rotate certificates configuration (list maxitems:1)
        :param pulumi.Input[dict] services: Services to rotate their certs. `etcd`, `kubelet`, `kube-apiserver`, `kube-proxy`, `kube-scheduler` and `kube-controller-manager` are supported (list)
        :param pulumi.Input[dict] services_etcd_deprecated: Use services.etcd instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_api_deprecated: Use services.kube_api instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_controller_deprecated: Use services.kube_controller instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_proxy_deprecated: Use services.kubeproxy instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_scheduler_deprecated: Use services.scheduler instead (list maxitems:1)
        :param pulumi.Input[dict] services_kubelet_deprecated: Use services.kubelet instead (list maxitems:1)
        :param pulumi.Input[bool] ssh_agent_auth: SSH Agent Auth enable (bool)
        :param pulumi.Input[str] ssh_cert_path: SSH Certificate path (string)
        :param pulumi.Input[str] ssh_key_path: SSH Private Key path (string)
        :param pulumi.Input[dict] system_images: RKE k8s cluster system images list (list maxitems:1)
        :param pulumi.Input[bool] update_only: Skip idempotent deployment of control and etcd plane. Default `false` (bool)
        :param pulumi.Input[dict] upgrade_strategy: RKE k8s cluster upgrade strategy (list maxitems:1)

        The **authentication** object supports the following:

          * `sans` (`pulumi.Input[list]`) - List of additional hostnames and IPs to include in the api server PKI cert (list)
          * `strategy` (`pulumi.Input[str]`) - Authentication strategy that will be used in RKE k8s cluster. Default: `x509` (string)
          * `webhook` (`pulumi.Input[dict]`) - Webhook configuration options (list maxitem: 1)
            * `cacheTimeout` (`pulumi.Input[str]`) - Controls how long to cache authentication decisions (string)
            * `configFile` (`pulumi.Input[str]`) - Multiline string that represent a custom webhook config file (string)

        The **authorization** object supports the following:

          * `mode` (`pulumi.Input[str]`) - RKE mode for authorization. `rbac` and `none` modes are available. Default `rbac` (string)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)

        The **bastion_host** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
          * `ssh_agent_auth` (`pulumi.Input[bool]`) - SSH Agent Auth enable (bool)
          * `sshCert` (`pulumi.Input[str]`) - SSH Certificate (string)
          * `ssh_cert_path` (`pulumi.Input[str]`) - SSH Certificate path (string)
          * `sshKey` (`pulumi.Input[str]`) - SSH Private Key (string)
          * `ssh_key_path` (`pulumi.Input[str]`) - SSH Private Key path (string)
          * `user` (`pulumi.Input[str]`) - Registry user (string)

        The **cloud_provider** object supports the following:

          * `awsCloudConfig` (`pulumi.Input[dict]`) - Use aws_cloud_provider instead
            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `disableSecurityGroupIngress` (`pulumi.Input[bool]`) - Disables the automatic ingress creation. Default `false` (bool)
              * `disableStrictZoneCheck` (`pulumi.Input[bool]`) - Setting this to true will disable the check and provide a warning that the check was skipped. Default `false` (bool)
              * `elbSecurityGroup` (`pulumi.Input[str]`) - Use these ELB security groups instead create new (string)
              * `kubernetesClusterId` (`pulumi.Input[str]`) - The cluster id we'll use to identify our cluster resources (string)
              * `kubernetesClusterTag` (`pulumi.Input[str]`) - Legacy cluster id we'll use to identify our cluster resources (string)
              * `roleArn` (`pulumi.Input[str]`) - IAM role to assume when interaction with AWS APIs (string)
              * `routeTableId` (`pulumi.Input[str]`) - Enables using a specific RouteTable (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `vpc` (`pulumi.Input[str]`) - The AWS VPC flag enables the possibility to run the master components on a different aws account, on a different cloud provider or on-premises. If the flag is set also the KubernetesClusterTag must be provided (string)
              * `zone` (`pulumi.Input[str]`) - The AWS zone (string)

            * `serviceOverrides` (`pulumi.Input[list]`) - (list)
              * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `service` (`pulumi.Input[str]`) - (string)
              * `signingMethod` (`pulumi.Input[str]`) - (string)
              * `signingName` (`pulumi.Input[str]`) - (string)
              * `signingRegion` (`pulumi.Input[str]`) - (string)
              * `url` (`pulumi.Input[str]`) - Registry URL (string)

          * `awsCloudProvider` (`pulumi.Input[dict]`) - AWS Cloud Provider config [rke-aws-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/aws/) (list maxitems:1)
            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `disableSecurityGroupIngress` (`pulumi.Input[bool]`) - Disables the automatic ingress creation. Default `false` (bool)
              * `disableStrictZoneCheck` (`pulumi.Input[bool]`) - Setting this to true will disable the check and provide a warning that the check was skipped. Default `false` (bool)
              * `elbSecurityGroup` (`pulumi.Input[str]`) - Use these ELB security groups instead create new (string)
              * `kubernetesClusterId` (`pulumi.Input[str]`) - The cluster id we'll use to identify our cluster resources (string)
              * `kubernetesClusterTag` (`pulumi.Input[str]`) - Legacy cluster id we'll use to identify our cluster resources (string)
              * `roleArn` (`pulumi.Input[str]`) - IAM role to assume when interaction with AWS APIs (string)
              * `routeTableId` (`pulumi.Input[str]`) - Enables using a specific RouteTable (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `vpc` (`pulumi.Input[str]`) - The AWS VPC flag enables the possibility to run the master components on a different aws account, on a different cloud provider or on-premises. If the flag is set also the KubernetesClusterTag must be provided (string)
              * `zone` (`pulumi.Input[str]`) - The AWS zone (string)

            * `serviceOverrides` (`pulumi.Input[list]`) - (list)
              * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `service` (`pulumi.Input[str]`) - (string)
              * `signingMethod` (`pulumi.Input[str]`) - (string)
              * `signingName` (`pulumi.Input[str]`) - (string)
              * `signingRegion` (`pulumi.Input[str]`) - (string)
              * `url` (`pulumi.Input[str]`) - Registry URL (string)

          * `azureCloudConfig` (`pulumi.Input[dict]`) - Use azure_cloud_provider instead
            * `aadClientCertPassword` (`pulumi.Input[str]`) - (string)
            * `aadClientCertPath` (`pulumi.Input[str]`) - (string)
            * `aadClientId` (`pulumi.Input[str]`) - (string)
            * `aadClientSecret` (`pulumi.Input[str]`) - (string)
            * `cloud` (`pulumi.Input[str]`) - (string)
            * `cloudProviderBackoff` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderBackoffDuration` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffExponent` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffJitter` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffRetries` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimit` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderRateLimitBucket` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimitQps` (`pulumi.Input[float]`) - (int)
            * `loadBalancerSku` (`pulumi.Input[str]`)
            * `location` (`pulumi.Input[str]`) - (string)
            * `maximumLoadBalancerRuleCount` (`pulumi.Input[float]`) - (int)
            * `primaryAvailabilitySetName` (`pulumi.Input[str]`) - (string)
            * `primaryScaleSetName` (`pulumi.Input[str]`) - (string)
            * `resourceGroup` (`pulumi.Input[str]`) - (string)
            * `routeTableName` (`pulumi.Input[str]`) - (string)
            * `securityGroupName` (`pulumi.Input[str]`) - (string)
            * `subnetName` (`pulumi.Input[str]`) - (string)
            * `subscriptionId` (`pulumi.Input[str]`) - (string)
            * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
            * `useInstanceMetadata` (`pulumi.Input[bool]`) - (bool)
            * `useManagedIdentityExtension` (`pulumi.Input[bool]`) - (bool)
            * `vmType` (`pulumi.Input[str]`) - (string)
            * `vnetName` (`pulumi.Input[str]`) - (string)
            * `vnetResourceGroup` (`pulumi.Input[str]`) - (string)

          * `azureCloudProvider` (`pulumi.Input[dict]`) - Azure Cloud Provider config [rke-azure-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/azure/) (list maxitems:1)
            * `aadClientCertPassword` (`pulumi.Input[str]`) - (string)
            * `aadClientCertPath` (`pulumi.Input[str]`) - (string)
            * `aadClientId` (`pulumi.Input[str]`) - (string)
            * `aadClientSecret` (`pulumi.Input[str]`) - (string)
            * `cloud` (`pulumi.Input[str]`) - (string)
            * `cloudProviderBackoff` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderBackoffDuration` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffExponent` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffJitter` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffRetries` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimit` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderRateLimitBucket` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimitQps` (`pulumi.Input[float]`) - (int)
            * `loadBalancerSku` (`pulumi.Input[str]`)
            * `location` (`pulumi.Input[str]`) - (string)
            * `maximumLoadBalancerRuleCount` (`pulumi.Input[float]`) - (int)
            * `primaryAvailabilitySetName` (`pulumi.Input[str]`) - (string)
            * `primaryScaleSetName` (`pulumi.Input[str]`) - (string)
            * `resourceGroup` (`pulumi.Input[str]`) - (string)
            * `routeTableName` (`pulumi.Input[str]`) - (string)
            * `securityGroupName` (`pulumi.Input[str]`) - (string)
            * `subnetName` (`pulumi.Input[str]`) - (string)
            * `subscriptionId` (`pulumi.Input[str]`) - (string)
            * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
            * `useInstanceMetadata` (`pulumi.Input[bool]`) - (bool)
            * `useManagedIdentityExtension` (`pulumi.Input[bool]`) - (bool)
            * `vmType` (`pulumi.Input[str]`) - (string)
            * `vnetName` (`pulumi.Input[str]`) - (string)
            * `vnetResourceGroup` (`pulumi.Input[str]`) - (string)

          * `customCloudConfig` (`pulumi.Input[str]`) - Use custom_cloud_provider instead
          * `customCloudProvider` (`pulumi.Input[str]`) - Custom Cloud Provider config (string)
          * `name` (`pulumi.Input[str]`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
          * `openstackCloudConfig` (`pulumi.Input[dict]`) - Use openstack_cloud_provider instead
            * `blockStorage` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `bsVersion` (`pulumi.Input[str]`) - (string)
              * `ignoreVolumeAz` (`pulumi.Input[bool]`) - (string)
              * `trustDevicePath` (`pulumi.Input[bool]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `authUrl` (`pulumi.Input[str]`) - (string)
              * `caFile` (`pulumi.Input[str]`) - (string)
              * `domainId` (`pulumi.Input[str]`) - Required if `domain_name` not provided. (string)
              * `domainName` (`pulumi.Input[str]`) - Required if `domain_id` not provided. (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
              * `tenantName` (`pulumi.Input[str]`) - Required if `tenant_id` not provided. (string)
              * `trustId` (`pulumi.Input[str]`) - (string)
              * `userId` (`pulumi.Input[str]`) - Required if `username` not provided. (string)
              * `username` (`pulumi.Input[str]`) - Required if `user_id` not provided. (string)

            * `loadBalancer` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `createMonitor` (`pulumi.Input[bool]`) - (bool)
              * `floatingNetworkId` (`pulumi.Input[str]`) - (string)
              * `lbMethod` (`pulumi.Input[str]`) - (string)
              * `lbProvider` (`pulumi.Input[str]`) - (string)
              * `lbVersion` (`pulumi.Input[str]`) - (string)
              * `manageSecurityGroups` (`pulumi.Input[bool]`) - (bool)
              * `monitorDelay` (`pulumi.Input[str]`) - Default `60s` (string)
              * `monitorMaxRetries` (`pulumi.Input[float]`) - Default 5 (int)
              * `monitorTimeout` (`pulumi.Input[str]`) - Default `30s` (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `useOctavia` (`pulumi.Input[bool]`) - (bool)

            * `metadata` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `requestTimeout` (`pulumi.Input[float]`) - (int)
              * `searchOrder` (`pulumi.Input[str]`) - (string)

            * `route` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `routerId` (`pulumi.Input[str]`) - (string)

          * `openstackCloudProvider` (`pulumi.Input[dict]`) - Openstack Cloud Provider config [rke-openstack-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/openstack/) (list maxitems:1)
            * `blockStorage` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `bsVersion` (`pulumi.Input[str]`) - (string)
              * `ignoreVolumeAz` (`pulumi.Input[bool]`) - (string)
              * `trustDevicePath` (`pulumi.Input[bool]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `authUrl` (`pulumi.Input[str]`) - (string)
              * `caFile` (`pulumi.Input[str]`) - (string)
              * `domainId` (`pulumi.Input[str]`) - Required if `domain_name` not provided. (string)
              * `domainName` (`pulumi.Input[str]`) - Required if `domain_id` not provided. (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
              * `tenantName` (`pulumi.Input[str]`) - Required if `tenant_id` not provided. (string)
              * `trustId` (`pulumi.Input[str]`) - (string)
              * `userId` (`pulumi.Input[str]`) - Required if `username` not provided. (string)
              * `username` (`pulumi.Input[str]`) - Required if `user_id` not provided. (string)

            * `loadBalancer` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `createMonitor` (`pulumi.Input[bool]`) - (bool)
              * `floatingNetworkId` (`pulumi.Input[str]`) - (string)
              * `lbMethod` (`pulumi.Input[str]`) - (string)
              * `lbProvider` (`pulumi.Input[str]`) - (string)
              * `lbVersion` (`pulumi.Input[str]`) - (string)
              * `manageSecurityGroups` (`pulumi.Input[bool]`) - (bool)
              * `monitorDelay` (`pulumi.Input[str]`) - Default `60s` (string)
              * `monitorMaxRetries` (`pulumi.Input[float]`) - Default 5 (int)
              * `monitorTimeout` (`pulumi.Input[str]`) - Default `30s` (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `useOctavia` (`pulumi.Input[bool]`) - (bool)

            * `metadata` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `requestTimeout` (`pulumi.Input[float]`) - (int)
              * `searchOrder` (`pulumi.Input[str]`) - (string)

            * `route` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `routerId` (`pulumi.Input[str]`) - (string)

          * `vsphereCloudConfig` (`pulumi.Input[dict]`) - Use vsphere_cloud_provider instead
            * `disk` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `scsiControllerType` (`pulumi.Input[str]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `datastore` (`pulumi.Input[str]`) - (string)
              * `insecureFlag` (`pulumi.Input[bool]`) - (bool)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)
              * `vmName` (`pulumi.Input[str]`) - (string)
              * `vmUuid` (`pulumi.Input[str]`) - (string)
              * `workingDir` (`pulumi.Input[str]`) - (string)

            * `network` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `publicNetwork` (`pulumi.Input[str]`) - (string)

            * `virtualCenters` (`pulumi.Input[list]`) - (List)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `name` (`pulumi.Input[str]`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)

            * `workspace` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `defaultDatastore` (`pulumi.Input[str]`) - (string)
              * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
              * `resourcepoolPath` (`pulumi.Input[str]`) - (string)
              * `server` (`pulumi.Input[str]`) - (string)

          * `vsphereCloudProvider` (`pulumi.Input[dict]`) - Vsphere Cloud Provider config [rke-vsphere-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere/) Extra argument `name` is required on `virtual_center` configuration. (list maxitems:1)
            * `disk` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `scsiControllerType` (`pulumi.Input[str]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `datastore` (`pulumi.Input[str]`) - (string)
              * `insecureFlag` (`pulumi.Input[bool]`) - (bool)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)
              * `vmName` (`pulumi.Input[str]`) - (string)
              * `vmUuid` (`pulumi.Input[str]`) - (string)
              * `workingDir` (`pulumi.Input[str]`) - (string)

            * `network` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `publicNetwork` (`pulumi.Input[str]`) - (string)

            * `virtualCenters` (`pulumi.Input[list]`) - (List)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `name` (`pulumi.Input[str]`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)

            * `workspace` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `defaultDatastore` (`pulumi.Input[str]`) - (string)
              * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
              * `resourcepoolPath` (`pulumi.Input[str]`) - (string)
              * `server` (`pulumi.Input[str]`) - (string)

        The **dns** object supports the following:

          * `nodeSelector` (`pulumi.Input[dict]`) - Node selector key pair (map)
          * `provider` (`pulumi.Input[str]`) - Monitoring provider (string)
          * `reverseCidrs` (`pulumi.Input[list]`) - Reverse CIDRs  (list)
          * `upstreamNameservers` (`pulumi.Input[list]`) - Upstream nameservers  (list)

        The **ingress** object supports the following:

          * `dnsPolicy` (`pulumi.Input[str]`) - Ingress controller DNS policy. `ClusterFirstWithHostNet`, `ClusterFirst`, `Default`, and `None` are supported. [K8S dns Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) (string)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `nodeSelector` (`pulumi.Input[dict]`) - Node selector key pair (map)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)
          * `provider` (`pulumi.Input[str]`) - Monitoring provider (string)

        The **monitoring** object supports the following:

          * `nodeSelector` (`pulumi.Input[dict]`) - Node selector key pair (map)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)
          * `provider` (`pulumi.Input[str]`) - Monitoring provider (string)

        The **network** object supports the following:

          * `calicoNetworkProvider` (`pulumi.Input[dict]`) - Calico network provider config (list maxitems:1)
            * `cloud_provider` (`pulumi.Input[str]`) - Calico cloud provider (string)

          * `canalNetworkProvider` (`pulumi.Input[dict]`) - Canal network provider config (list maxitems:1)
            * `iface` (`pulumi.Input[str]`) - Flannel network interface (string)

          * `flannelNetworkProvider` (`pulumi.Input[dict]`) - Flannel network provider config (list maxitems:1)
            * `iface` (`pulumi.Input[str]`) - Flannel network interface (string)

          * `mtu` (`pulumi.Input[float]`) - Network provider MTU. Default `0` (int)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)
          * `plugin` (`pulumi.Input[str]`) - Network provider plugin. `calico`, `canal` (default), `flannel`, `none` and `weave` are supported. (string)
          * `weaveNetworkProvider` (`pulumi.Input[dict]`) - Weave network provider config (list maxitems:1)
            * `password` (`pulumi.Input[str]`) - Registry password (string)

        The **nodes** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `dockerSocket` (`pulumi.Input[str]`) - Docker socket on the node that will be used in tunneling (string)
          * `hostnameOverride` (`pulumi.Input[str]`) - Hostname override for node (string)
          * `internalAddress` (`pulumi.Input[str]`) - Internal address that will be used for components communication (string)
          * `labels` (`pulumi.Input[dict]`) - Node labels (map)
          * `nodeName` (`pulumi.Input[str]`) - Name of the host provisioned via docker machine (string)
          * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
          * `roles` (`pulumi.Input[list]`) - Node roles in k8s cluster. `controlplane`, `etcd` and `worker` are supported. (list)
          * `rolesDeprecated` (`pulumi.Input[str]`)
          * `ssh_agent_auth` (`pulumi.Input[bool]`) - SSH Agent Auth enable (bool)
          * `sshCert` (`pulumi.Input[str]`) - SSH Certificate (string)
          * `ssh_cert_path` (`pulumi.Input[str]`) - SSH Certificate path (string)
          * `sshKey` (`pulumi.Input[str]`) - SSH Private Key (string)
          * `ssh_key_path` (`pulumi.Input[str]`) - SSH Private Key path (string)
          * `taints` (`pulumi.Input[list]`) - Node taints (list)
            * `effect` (`pulumi.Input[str]`) - Taint effect. `NoExecute`, `NoSchedule` (default) and `PreferNoSchedule` are supported (string)
            * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
            * `value` (`pulumi.Input[str]`) - Taint value (string)

          * `user` (`pulumi.Input[str]`) - Registry user (string)

        The **private_registries** object supports the following:

          * `isDefault` (`pulumi.Input[bool]`) - Set as default registry. Default `false` (bool)
          * `password` (`pulumi.Input[str]`) - Registry password (string)
          * `url` (`pulumi.Input[str]`) - Registry URL (string)
          * `user` (`pulumi.Input[str]`) - Registry user (string)

        The **restore** object supports the following:

          * `restore` (`pulumi.Input[bool]`) - Restore cluster. Default `false` (bool)
          * `snapshotName` (`pulumi.Input[str]`) - Snapshot name (string)

        The **rotate_certificates** object supports the following:

          * `caCertificates` (`pulumi.Input[bool]`) - Rotate CA Certificates. Default `false` (bool)
          * `services` (`pulumi.Input[list]`) - Services to rotate their certs. `etcd`, `kubelet`, `kube-apiserver`, `kube-proxy`, `kube-scheduler` and `kube-controller-manager` are supported (list)

        The **services** object supports the following:

          * `etcd` (`pulumi.Input[dict]`) - Docker image for etcd (string)
            * `backupConfig` (`pulumi.Input[dict]`) - Backup options for etcd service. Just for Rancher v2.2.x (list maxitems:1)
              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)
              * `intervalHours` (`pulumi.Input[float]`) - Interval hours for etcd backup. Default `12` (int)
              * `retention` (`pulumi.Input[float]`) - Retention for etcd backup. Default `6` (int)
              * `s3BackupConfig` (`pulumi.Input[dict]`) - S3 config options for etcd backup (list maxitems:1)
                * `accessKey` (`pulumi.Input[str]`) - Access key for S3 service (string)
                * `bucketName` (`pulumi.Input[str]`) - Bucket name for S3 service (string)
                * `customCa` (`pulumi.Input[str]`) - Base64 encoded custom CA for S3 service. Use filebase64(<FILE>) for encoding file. Available from Rancher v2.2.5 (string)
                * `endpoint` (`pulumi.Input[str]`) - Endpoint for S3 service (string)
                * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
                * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
                * `secretKey` (`pulumi.Input[str]`) - Secret key for S3 service (string)

              * `safeTimestamp` (`pulumi.Input[bool]`) - Safe timestamp for etcd backup. Default: `false` (bool)

            * `caCert` (`pulumi.Input[str]`) - TLS CA certificate for etcd service (string)
            * `cert` (`pulumi.Input[str]`) - TLS certificate for etcd service (string)
            * `creation` (`pulumi.Input[str]`) - Creation option for etcd service (string)
            * `externalUrls` (`pulumi.Input[list]`) - External urls for etcd service (list)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `gid` (`pulumi.Input[float]`) - Etcd service GID. Default: `0`. For Rancher v2.3.x or above (int)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
            * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
            * `retention` (`pulumi.Input[str]`) - Retention for etcd backup. Default `6` (int)
            * `snapshot` (`pulumi.Input[bool]`) - Snapshot option for etcd service. Default `true` (bool)
            * `uid` (`pulumi.Input[float]`) - Etcd service UID. Default: `0`. For Rancher v2.3.x or above (int)

          * `kubeApi` (`pulumi.Input[dict]`) - Kube API options for RKE services (list maxitems:1)
            * `alwaysPullImages` (`pulumi.Input[bool]`) - Enable [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages) Admission controller plugin. [Rancher docs](https://rancher.com/docs/rke/latest/en/config-options/services/#kubernetes-api-server-options) Default: `false` (bool)
            * `auditLog` (`pulumi.Input[dict]`) - K8s audit log configuration. (list maxitem: 1)
              * `configuration` (`pulumi.Input[dict]`) - Audit log configuration. (list maxtiem: 1)
                * `format` (`pulumi.Input[str]`) - Audit log format. Default: `json` (string)
                * `maxAge` (`pulumi.Input[float]`) - Audit log max age. Default: `30` (int)
                * `maxBackup` (`pulumi.Input[float]`) - Audit log max backup. Default: `10` (int)
                * `maxSize` (`pulumi.Input[float]`) - Audit log max size. Default: `100` (int)
                * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
                * `policy` (`pulumi.Input[str]`) - Audit policy json encoded definition. `"apiVersion"` and `"kind":"Policy","rules"` fields are required in the json. Ex. `jsonencode({"apiVersion":"audit.k8s.io/v1","kind":"Policy","rules":[{"level":"RequestResponse","resources":[{"group":"","resources":["pods"]}]}]})` [More info](https://rancher.com/docs/rke/latest/en/config-options/audit-log/) (string)

              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

            * `eventRateLimit` (`pulumi.Input[dict]`) - K8s event rate limit configuration. (list maxitem: 1)
              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `podSecurityPolicy` (`pulumi.Input[bool]`) - Pod Security Policy option for kube API service. Default `false` (bool)
            * `secretsEncryptionConfig` (`pulumi.Input[dict]`) - [Encrypt k8s secret data configration](https://rancher.com/docs/rke/latest/en/config-options/secrets-encryption/). (list maxitem: 1)
              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

            * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)
            * `serviceNodePortRange` (`pulumi.Input[str]`) - Service Node Port Range option for kube API service (string)

          * `kubeController` (`pulumi.Input[dict]`) - Kube Controller options for RKE services (list maxitems:1)
            * `cluster_cidr` (`pulumi.Input[str]`) - Cluster CIDR option for kube controller service (string)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)

          * `kubelet` (`pulumi.Input[dict]`) - Kubelet options for RKE services (list maxitems:1)
            * `cluster_dns_server` (`pulumi.Input[str]`) - Cluster DNS Server option for kubelet service (string)
            * `cluster_domain` (`pulumi.Input[str]`) - Cluster Domain option for kubelet service. Default `cluster.local` (string)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `failSwapOn` (`pulumi.Input[bool]`) - Enable or disable failing when swap on is not supported (bool)
              * `generate_serving_certificate` [Generate a certificate signed by the kube-ca](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-serving-certificate-requirements). Default `false` (bool)
            * `generateServingCertificate` (`pulumi.Input[bool]`)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `infraContainerImage` (`pulumi.Input[str]`) - Infra container image for kubelet service (string)

          * `kubeproxy` (`pulumi.Input[dict]`) - Kubeproxy options for RKE services (list maxitems:1)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

          * `scheduler` (`pulumi.Input[dict]`) - Scheduler options for RKE services (list maxitems:1)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

        The **services_etcd_deprecated** object supports the following:

          * `backupConfig` (`pulumi.Input[dict]`) - Backup options for etcd service. Just for Rancher v2.2.x (list maxitems:1)
            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)
            * `intervalHours` (`pulumi.Input[float]`) - Interval hours for etcd backup. Default `12` (int)
            * `retention` (`pulumi.Input[float]`) - Retention for etcd backup. Default `6` (int)
            * `s3BackupConfig` (`pulumi.Input[dict]`) - S3 config options for etcd backup (list maxitems:1)
              * `accessKey` (`pulumi.Input[str]`) - Access key for S3 service (string)
              * `bucketName` (`pulumi.Input[str]`) - Bucket name for S3 service (string)
              * `customCa` (`pulumi.Input[str]`) - Base64 encoded custom CA for S3 service. Use filebase64(<FILE>) for encoding file. Available from Rancher v2.2.5 (string)
              * `endpoint` (`pulumi.Input[str]`) - Endpoint for S3 service (string)
              * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `secretKey` (`pulumi.Input[str]`) - Secret key for S3 service (string)

            * `safeTimestamp` (`pulumi.Input[bool]`) - Safe timestamp for etcd backup. Default: `false` (bool)

          * `caCert` (`pulumi.Input[str]`) - TLS CA certificate for etcd service (string)
          * `cert` (`pulumi.Input[str]`) - TLS certificate for etcd service (string)
          * `creation` (`pulumi.Input[str]`) - Creation option for etcd service (string)
          * `externalUrls` (`pulumi.Input[list]`) - External urls for etcd service (list)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `gid` (`pulumi.Input[float]`) - Etcd service GID. Default: `0`. For Rancher v2.3.x or above (int)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
          * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
          * `retention` (`pulumi.Input[str]`) - Retention for etcd backup. Default `6` (int)
          * `snapshot` (`pulumi.Input[bool]`) - Snapshot option for etcd service. Default `true` (bool)
          * `uid` (`pulumi.Input[float]`) - Etcd service UID. Default: `0`. For Rancher v2.3.x or above (int)

        The **services_kube_api_deprecated** object supports the following:

          * `alwaysPullImages` (`pulumi.Input[bool]`) - Enable [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages) Admission controller plugin. [Rancher docs](https://rancher.com/docs/rke/latest/en/config-options/services/#kubernetes-api-server-options) Default: `false` (bool)
          * `auditLog` (`pulumi.Input[dict]`) - K8s audit log configuration. (list maxitem: 1)
            * `configuration` (`pulumi.Input[dict]`) - Audit log configuration. (list maxtiem: 1)
              * `format` (`pulumi.Input[str]`) - Audit log format. Default: `json` (string)
              * `maxAge` (`pulumi.Input[float]`) - Audit log max age. Default: `30` (int)
              * `maxBackup` (`pulumi.Input[float]`) - Audit log max backup. Default: `10` (int)
              * `maxSize` (`pulumi.Input[float]`) - Audit log max size. Default: `100` (int)
              * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
              * `policy` (`pulumi.Input[str]`) - Audit policy json encoded definition. `"apiVersion"` and `"kind":"Policy","rules"` fields are required in the json. Ex. `jsonencode({"apiVersion":"audit.k8s.io/v1","kind":"Policy","rules":[{"level":"RequestResponse","resources":[{"group":"","resources":["pods"]}]}]})` [More info](https://rancher.com/docs/rke/latest/en/config-options/audit-log/) (string)

            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

          * `eventRateLimit` (`pulumi.Input[dict]`) - K8s event rate limit configuration. (list maxitem: 1)
            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `podSecurityPolicy` (`pulumi.Input[bool]`) - Pod Security Policy option for kube API service. Default `false` (bool)
          * `secretsEncryptionConfig` (`pulumi.Input[dict]`) - [Encrypt k8s secret data configration](https://rancher.com/docs/rke/latest/en/config-options/secrets-encryption/). (list maxitem: 1)
            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

          * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)
          * `serviceNodePortRange` (`pulumi.Input[str]`) - Service Node Port Range option for kube API service (string)

        The **services_kube_controller_deprecated** object supports the following:

          * `cluster_cidr` (`pulumi.Input[str]`) - Cluster CIDR option for kube controller service (string)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)

        The **services_kube_proxy_deprecated** object supports the following:

          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

        The **services_kube_scheduler_deprecated** object supports the following:

          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

        The **services_kubelet_deprecated** object supports the following:

          * `cluster_dns_server` (`pulumi.Input[str]`) - Cluster DNS Server option for kubelet service (string)
          * `cluster_domain` (`pulumi.Input[str]`) - Cluster Domain option for kubelet service. Default `cluster.local` (string)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `failSwapOn` (`pulumi.Input[bool]`) - Enable or disable failing when swap on is not supported (bool)
            * `generate_serving_certificate` [Generate a certificate signed by the kube-ca](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-serving-certificate-requirements). Default `false` (bool)
          * `generateServingCertificate` (`pulumi.Input[bool]`)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `infraContainerImage` (`pulumi.Input[str]`) - Infra container image for kubelet service (string)

        The **system_images** object supports the following:

          * `alpine` (`pulumi.Input[str]`) - Docker image for alpine (string)
          * `calicoCni` (`pulumi.Input[str]`) - Docker image for calico_cni (string)
          * `calicoControllers` (`pulumi.Input[str]`) - Docker image for calico_controllers (string)
          * `calicoCtl` (`pulumi.Input[str]`) - Docker image for calico_ctl (string)
          * `calicoFlexVol` (`pulumi.Input[str]`) - Docker image for calico_flex_vol (string)
          * `calicoNode` (`pulumi.Input[str]`) - Docker image for calico_node (string)
          * `canalCni` (`pulumi.Input[str]`) - Docker image for canal_cni (string)
          * `canalFlannel` (`pulumi.Input[str]`) - Docker image for canal_flannel (string)
          * `canalFlexVol` (`pulumi.Input[str]`) - Docker image for canal_flex_vol (string)
          * `canalNode` (`pulumi.Input[str]`) - Docker image for canal_node (string)
          * `certDownloader` (`pulumi.Input[str]`) - Docker image for cert_downloader (string)
          * `coredns` (`pulumi.Input[str]`) - Docker image for coredns (string)
          * `corednsAutoscaler` (`pulumi.Input[str]`) - Docker image for coredns_autoscaler (string)
          * `dnsmasq` (`pulumi.Input[str]`) - Docker image for dnsmasq (string)
          * `etcd` (`pulumi.Input[str]`) - Docker image for etcd (string)
          * `flannel` (`pulumi.Input[str]`) - Docker image for flannel (string)
          * `flannelCni` (`pulumi.Input[str]`) - Docker image for flannel_cni (string)
          * `ingress` (`pulumi.Input[str]`) - Docker image for ingress (string)
          * `ingressBackend` (`pulumi.Input[str]`) - Docker image for ingress_backend (string)
          * `kubeDns` (`pulumi.Input[str]`) - Docker image for kube_dns (string)
          * `kubeDnsAutoscaler` (`pulumi.Input[str]`) - Docker image for kube_dns_autoscaler (string)
          * `kubeDnsSidecar` (`pulumi.Input[str]`) - Docker image for kube_dns_sidecar (string)
          * `kubernetes` (`pulumi.Input[str]`) - Docker image for kubernetes (string)
          * `kubernetesServicesSidecar` (`pulumi.Input[str]`) - Docker image for kubernetes_services_sidecar (string)
          * `metricsServer` (`pulumi.Input[str]`) - Docker image for metrics_server (string)
          * `nginxProxy` (`pulumi.Input[str]`) - Docker image for nginx_proxy (string)
          * `nodelocal` (`pulumi.Input[str]`) - Docker image for nodelocal (string)
          * `podInfraContainer` (`pulumi.Input[str]`) - Docker image for pod_infra_container (string)
          * `weaveCni` (`pulumi.Input[str]`) - Docker image for weave_cni (string)
          * `weaveNode` (`pulumi.Input[str]`) - Docker image for weave_node (string)
          * `windowsPodInfraContainer` (`pulumi.Input[str]`) - Docker image for windows_pod_infra_container (string)

        The **upgrade_strategy** object supports the following:

          * `drain` (`pulumi.Input[bool]`) - RKE drain nodes. Default: `false` (bool)
          * `drainInput` (`pulumi.Input[dict]`) - RKE drain node input (list Maxitems: 1)
            * `deleteLocalData` (`pulumi.Input[bool]`) - Delete RKE node local data. Default: `false` (bool)
            * `force` (`pulumi.Input[bool]`) - Force RKE node drain. Default: `false` (bool)
            * `gracePeriod` (`pulumi.Input[float]`) - RKE node drain grace period. Default: `-1` (int)
            * `ignoreDaemonSets` (`pulumi.Input[bool]`) - Ignore RKE daemon sets. Default: `true` (bool)
            * `timeout` (`pulumi.Input[float]`) - RKE node drain timeout. Default: `60` (int)

          * `maxUnavailableControlplane` (`pulumi.Input[str]`) - RKE max unavailable controlplane nodes. Default: `1` (string)
          * `maxUnavailableWorker` (`pulumi.Input[str]`) - RKE max unavailable worker nodes. Default: `10%` (string)
        """
        if __name__ is not None:
            warnings.warn("explicit use of __name__ is deprecated", DeprecationWarning)
            resource_name = __name__
        if __opts__ is not None:
            warnings.warn("explicit use of __opts__ is deprecated, use 'opts' instead", DeprecationWarning)
            opts = __opts__
        if opts is None:
            opts = pulumi.ResourceOptions()
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.version is None:
            opts.version = utilities.get_version()
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = dict()

            __props__['addon_job_timeout'] = addon_job_timeout
            __props__['addons'] = addons
            __props__['addons_includes'] = addons_includes
            __props__['authentication'] = authentication
            __props__['authorization'] = authorization
            __props__['bastion_host'] = bastion_host
            __props__['cert_dir'] = cert_dir
            __props__['cloud_provider'] = cloud_provider
            __props__['cluster_name'] = cluster_name
            __props__['cluster_yaml'] = cluster_yaml
            __props__['custom_certs'] = custom_certs
            __props__['delay_on_creation'] = delay_on_creation
            __props__['dind'] = dind
            __props__['dind_dns_server'] = dind_dns_server
            __props__['dind_storage_driver'] = dind_storage_driver
            __props__['disable_port_check'] = disable_port_check
            __props__['dns'] = dns
            __props__['ignore_docker_version'] = ignore_docker_version
            __props__['ingress'] = ingress
            __props__['kubernetes_version'] = kubernetes_version
            __props__['monitoring'] = monitoring
            __props__['network'] = network
            __props__['nodes'] = nodes
            __props__['nodes_confs'] = nodes_confs
            __props__['prefix_path'] = prefix_path
            __props__['private_registries'] = private_registries
            __props__['restore'] = restore
            __props__['rotate_certificates'] = rotate_certificates
            __props__['services'] = services
            __props__['services_etcd_deprecated'] = services_etcd_deprecated
            __props__['services_kube_api_deprecated'] = services_kube_api_deprecated
            __props__['services_kube_controller_deprecated'] = services_kube_controller_deprecated
            __props__['services_kube_proxy_deprecated'] = services_kube_proxy_deprecated
            __props__['services_kube_scheduler_deprecated'] = services_kube_scheduler_deprecated
            __props__['services_kubelet_deprecated'] = services_kubelet_deprecated
            __props__['ssh_agent_auth'] = ssh_agent_auth
            __props__['ssh_cert_path'] = ssh_cert_path
            __props__['ssh_key_path'] = ssh_key_path
            __props__['system_images'] = system_images
            __props__['update_only'] = update_only
            __props__['upgrade_strategy'] = upgrade_strategy
            __props__['api_server_url'] = None
            __props__['ca_crt'] = None
            __props__['certificates'] = None
            __props__['client_cert'] = None
            __props__['client_key'] = None
            __props__['cluster_cidr'] = None
            __props__['cluster_dns_server'] = None
            __props__['cluster_domain'] = None
            __props__['control_plane_hosts'] = None
            __props__['etcd_hosts'] = None
            __props__['inactive_hosts'] = None
            __props__['internal_kube_config_yaml'] = None
            __props__['kube_admin_user'] = None
            __props__['kube_config_yaml'] = None
            __props__['rke_cluster_yaml'] = None
            __props__['rke_state'] = None
            __props__['running_system_images'] = None
            __props__['worker_hosts'] = None
        super(Cluster, __self__).__init__(
            'rke:index/cluster:Cluster',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name, id, opts=None, addon_job_timeout=None, addons=None, addons_includes=None, api_server_url=None, authentication=None, authorization=None, bastion_host=None, ca_crt=None, cert_dir=None, certificates=None, client_cert=None, client_key=None, cloud_provider=None, cluster_cidr=None, cluster_dns_server=None, cluster_domain=None, cluster_name=None, cluster_yaml=None, control_plane_hosts=None, custom_certs=None, delay_on_creation=None, dind=None, dind_dns_server=None, dind_storage_driver=None, disable_port_check=None, dns=None, etcd_hosts=None, ignore_docker_version=None, inactive_hosts=None, ingress=None, internal_kube_config_yaml=None, kube_admin_user=None, kube_config_yaml=None, kubernetes_version=None, monitoring=None, network=None, nodes=None, nodes_confs=None, prefix_path=None, private_registries=None, restore=None, rke_cluster_yaml=None, rke_state=None, rotate_certificates=None, running_system_images=None, services=None, services_etcd_deprecated=None, services_kube_api_deprecated=None, services_kube_controller_deprecated=None, services_kube_proxy_deprecated=None, services_kube_scheduler_deprecated=None, services_kubelet_deprecated=None, ssh_agent_auth=None, ssh_cert_path=None, ssh_key_path=None, system_images=None, update_only=None, upgrade_strategy=None, worker_hosts=None):
        """
        Get an existing Cluster resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param str id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[float] addon_job_timeout: RKE k8s cluster addon deployment timeout in seconds for status check (int)
        :param pulumi.Input[str] addons: RKE k8s cluster user addons YAML manifest to be deployed (string)
        :param pulumi.Input[list] addons_includes: RKE k8s cluster user addons YAML manifest urls or paths to be deployed (list)
        :param pulumi.Input[str] api_server_url: (Computed) RKE k8s cluster api server url (string)
        :param pulumi.Input[dict] authentication: RKE k8s cluster authentication configuration (list maxitems:1)
        :param pulumi.Input[dict] authorization: RKE k8s cluster authorization mode configuration (list maxitems:1)
        :param pulumi.Input[dict] bastion_host: RKE k8s cluster bastion Host configuration (list maxitems:1)
        :param pulumi.Input[str] ca_crt: (Computed/Sensitive) RKE k8s cluster CA certificate (string)
        :param pulumi.Input[str] cert_dir: Specify a certificate dir path (string)
        :param pulumi.Input[list] certificates: (Computed/Sensitive) RKE k8s cluster certificates (string)
        :param pulumi.Input[str] client_cert: (Computed/Sensitive) RKE k8s cluster client certificate (string)
        :param pulumi.Input[str] client_key: (Computed/Sensitive) RKE k8s cluster client key (string)
        :param pulumi.Input[dict] cloud_provider: Calico cloud provider (string)
        :param pulumi.Input[str] cluster_cidr: Cluster CIDR option for kube controller service (string)
        :param pulumi.Input[str] cluster_dns_server: Cluster DNS Server option for kubelet service (string)
        :param pulumi.Input[str] cluster_domain: Cluster Domain option for kubelet service. Default `cluster.local` (string)
        :param pulumi.Input[str] cluster_name: RKE k8s cluster name used in the kube config (string)
        :param pulumi.Input[str] cluster_yaml: RKE k8s cluster config yaml encoded. Provider arguments take precedence over this one (string)
        :param pulumi.Input[list] control_plane_hosts: (Computed) RKE k8s cluster control plane nodes (list)
        :param pulumi.Input[bool] custom_certs: Use custom certificates from a cert dir (string)
        :param pulumi.Input[float] delay_on_creation: RKE k8s cluster delay on creation (int)
        :param pulumi.Input[bool] dind: Deploy RKE cluster on a dind environment. Default: `false` (bool)
        :param pulumi.Input[str] dind_dns_server: DinD RKE cluster dns (string)
        :param pulumi.Input[str] dind_storage_driver: DinD RKE cluster storage driver (string)
        :param pulumi.Input[bool] disable_port_check: Enable/Disable RKE k8s cluster port checking. Default `false` (bool)
        :param pulumi.Input[dict] dns: RKE k8s cluster DNS Config (list maxitems:1)
        :param pulumi.Input[list] etcd_hosts: (Computed) RKE k8s cluster etcd nodes (list)
        :param pulumi.Input[bool] ignore_docker_version: Enable/Disable RKE k8s cluster strict docker version checking. Default `false` (bool)
        :param pulumi.Input[list] inactive_hosts: (Computed) RKE k8s cluster inactive nodes (list)
        :param pulumi.Input[dict] ingress: Docker image for ingress (string)
        :param pulumi.Input[str] internal_kube_config_yaml: (Computed/Sensitive) RKE k8s cluster internal kube config yaml (string)
        :param pulumi.Input[str] kube_admin_user: (Computed) RKE k8s cluster admin user (string)
        :param pulumi.Input[str] kube_config_yaml: (Computed/Sensitive) RKE k8s cluster kube config yaml (string)
        :param pulumi.Input[str] kubernetes_version: K8s version to deploy. If kubernetes image is specified, image version takes precedence. Default: `rke default` (string)
        :param pulumi.Input[dict] monitoring: RKE k8s cluster monitoring Config (list maxitems:1)
        :param pulumi.Input[dict] network: (list maxitems:1)
        :param pulumi.Input[list] nodes: RKE k8s cluster nodes (list)
        :param pulumi.Input[str] prefix_path: RKE k8s directory path (string)
        :param pulumi.Input[list] private_registries: RKE k8s cluster private docker registries (list)
        :param pulumi.Input[dict] restore: Restore cluster. Default `false` (bool)
        :param pulumi.Input[str] rke_cluster_yaml: (Computed/Sensitive) RKE k8s cluster config yaml (string)
        :param pulumi.Input[str] rke_state: (Computed/Sensitive) RKE k8s cluster state (string)
        :param pulumi.Input[dict] rotate_certificates: RKE k8s cluster rotate certificates configuration (list maxitems:1)
        :param pulumi.Input[dict] running_system_images: (Computed) RKE k8s cluster running system images list (list)
        :param pulumi.Input[dict] services: Services to rotate their certs. `etcd`, `kubelet`, `kube-apiserver`, `kube-proxy`, `kube-scheduler` and `kube-controller-manager` are supported (list)
        :param pulumi.Input[dict] services_etcd_deprecated: Use services.etcd instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_api_deprecated: Use services.kube_api instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_controller_deprecated: Use services.kube_controller instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_proxy_deprecated: Use services.kubeproxy instead (list maxitems:1)
        :param pulumi.Input[dict] services_kube_scheduler_deprecated: Use services.scheduler instead (list maxitems:1)
        :param pulumi.Input[dict] services_kubelet_deprecated: Use services.kubelet instead (list maxitems:1)
        :param pulumi.Input[bool] ssh_agent_auth: SSH Agent Auth enable (bool)
        :param pulumi.Input[str] ssh_cert_path: SSH Certificate path (string)
        :param pulumi.Input[str] ssh_key_path: SSH Private Key path (string)
        :param pulumi.Input[dict] system_images: RKE k8s cluster system images list (list maxitems:1)
        :param pulumi.Input[bool] update_only: Skip idempotent deployment of control and etcd plane. Default `false` (bool)
        :param pulumi.Input[dict] upgrade_strategy: RKE k8s cluster upgrade strategy (list maxitems:1)
        :param pulumi.Input[list] worker_hosts: (Computed) RKE k8s cluster worker nodes (list)

        The **authentication** object supports the following:

          * `sans` (`pulumi.Input[list]`) - List of additional hostnames and IPs to include in the api server PKI cert (list)
          * `strategy` (`pulumi.Input[str]`) - Authentication strategy that will be used in RKE k8s cluster. Default: `x509` (string)
          * `webhook` (`pulumi.Input[dict]`) - Webhook configuration options (list maxitem: 1)
            * `cacheTimeout` (`pulumi.Input[str]`) - Controls how long to cache authentication decisions (string)
            * `configFile` (`pulumi.Input[str]`) - Multiline string that represent a custom webhook config file (string)

        The **authorization** object supports the following:

          * `mode` (`pulumi.Input[str]`) - RKE mode for authorization. `rbac` and `none` modes are available. Default `rbac` (string)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)

        The **bastion_host** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
          * `ssh_agent_auth` (`pulumi.Input[bool]`) - SSH Agent Auth enable (bool)
          * `sshCert` (`pulumi.Input[str]`) - SSH Certificate (string)
          * `ssh_cert_path` (`pulumi.Input[str]`) - SSH Certificate path (string)
          * `sshKey` (`pulumi.Input[str]`) - SSH Private Key (string)
          * `ssh_key_path` (`pulumi.Input[str]`) - SSH Private Key path (string)
          * `user` (`pulumi.Input[str]`) - Registry user (string)

        The **certificates** object supports the following:

          * `certificate` (`pulumi.Input[str]`)
          * `commonName` (`pulumi.Input[str]`)
          * `config` (`pulumi.Input[str]`)
          * `configEnvName` (`pulumi.Input[str]`)
          * `configPath` (`pulumi.Input[str]`)
          * `envName` (`pulumi.Input[str]`)
          * `id` (`pulumi.Input[str]`) - (Computed) The ID of the resource (string)
          * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
          * `keyEnvName` (`pulumi.Input[str]`)
          * `keyPath` (`pulumi.Input[str]`)
          * `name` (`pulumi.Input[str]`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
          * `ouName` (`pulumi.Input[str]`)
          * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)

        The **cloud_provider** object supports the following:

          * `awsCloudConfig` (`pulumi.Input[dict]`) - Use aws_cloud_provider instead
            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `disableSecurityGroupIngress` (`pulumi.Input[bool]`) - Disables the automatic ingress creation. Default `false` (bool)
              * `disableStrictZoneCheck` (`pulumi.Input[bool]`) - Setting this to true will disable the check and provide a warning that the check was skipped. Default `false` (bool)
              * `elbSecurityGroup` (`pulumi.Input[str]`) - Use these ELB security groups instead create new (string)
              * `kubernetesClusterId` (`pulumi.Input[str]`) - The cluster id we'll use to identify our cluster resources (string)
              * `kubernetesClusterTag` (`pulumi.Input[str]`) - Legacy cluster id we'll use to identify our cluster resources (string)
              * `roleArn` (`pulumi.Input[str]`) - IAM role to assume when interaction with AWS APIs (string)
              * `routeTableId` (`pulumi.Input[str]`) - Enables using a specific RouteTable (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `vpc` (`pulumi.Input[str]`) - The AWS VPC flag enables the possibility to run the master components on a different aws account, on a different cloud provider or on-premises. If the flag is set also the KubernetesClusterTag must be provided (string)
              * `zone` (`pulumi.Input[str]`) - The AWS zone (string)

            * `serviceOverrides` (`pulumi.Input[list]`) - (list)
              * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `service` (`pulumi.Input[str]`) - (string)
              * `signingMethod` (`pulumi.Input[str]`) - (string)
              * `signingName` (`pulumi.Input[str]`) - (string)
              * `signingRegion` (`pulumi.Input[str]`) - (string)
              * `url` (`pulumi.Input[str]`) - Registry URL (string)

          * `awsCloudProvider` (`pulumi.Input[dict]`) - AWS Cloud Provider config [rke-aws-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/aws/) (list maxitems:1)
            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `disableSecurityGroupIngress` (`pulumi.Input[bool]`) - Disables the automatic ingress creation. Default `false` (bool)
              * `disableStrictZoneCheck` (`pulumi.Input[bool]`) - Setting this to true will disable the check and provide a warning that the check was skipped. Default `false` (bool)
              * `elbSecurityGroup` (`pulumi.Input[str]`) - Use these ELB security groups instead create new (string)
              * `kubernetesClusterId` (`pulumi.Input[str]`) - The cluster id we'll use to identify our cluster resources (string)
              * `kubernetesClusterTag` (`pulumi.Input[str]`) - Legacy cluster id we'll use to identify our cluster resources (string)
              * `roleArn` (`pulumi.Input[str]`) - IAM role to assume when interaction with AWS APIs (string)
              * `routeTableId` (`pulumi.Input[str]`) - Enables using a specific RouteTable (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `vpc` (`pulumi.Input[str]`) - The AWS VPC flag enables the possibility to run the master components on a different aws account, on a different cloud provider or on-premises. If the flag is set also the KubernetesClusterTag must be provided (string)
              * `zone` (`pulumi.Input[str]`) - The AWS zone (string)

            * `serviceOverrides` (`pulumi.Input[list]`) - (list)
              * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `service` (`pulumi.Input[str]`) - (string)
              * `signingMethod` (`pulumi.Input[str]`) - (string)
              * `signingName` (`pulumi.Input[str]`) - (string)
              * `signingRegion` (`pulumi.Input[str]`) - (string)
              * `url` (`pulumi.Input[str]`) - Registry URL (string)

          * `azureCloudConfig` (`pulumi.Input[dict]`) - Use azure_cloud_provider instead
            * `aadClientCertPassword` (`pulumi.Input[str]`) - (string)
            * `aadClientCertPath` (`pulumi.Input[str]`) - (string)
            * `aadClientId` (`pulumi.Input[str]`) - (string)
            * `aadClientSecret` (`pulumi.Input[str]`) - (string)
            * `cloud` (`pulumi.Input[str]`) - (string)
            * `cloudProviderBackoff` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderBackoffDuration` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffExponent` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffJitter` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffRetries` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimit` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderRateLimitBucket` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimitQps` (`pulumi.Input[float]`) - (int)
            * `loadBalancerSku` (`pulumi.Input[str]`)
            * `location` (`pulumi.Input[str]`) - (string)
            * `maximumLoadBalancerRuleCount` (`pulumi.Input[float]`) - (int)
            * `primaryAvailabilitySetName` (`pulumi.Input[str]`) - (string)
            * `primaryScaleSetName` (`pulumi.Input[str]`) - (string)
            * `resourceGroup` (`pulumi.Input[str]`) - (string)
            * `routeTableName` (`pulumi.Input[str]`) - (string)
            * `securityGroupName` (`pulumi.Input[str]`) - (string)
            * `subnetName` (`pulumi.Input[str]`) - (string)
            * `subscriptionId` (`pulumi.Input[str]`) - (string)
            * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
            * `useInstanceMetadata` (`pulumi.Input[bool]`) - (bool)
            * `useManagedIdentityExtension` (`pulumi.Input[bool]`) - (bool)
            * `vmType` (`pulumi.Input[str]`) - (string)
            * `vnetName` (`pulumi.Input[str]`) - (string)
            * `vnetResourceGroup` (`pulumi.Input[str]`) - (string)

          * `azureCloudProvider` (`pulumi.Input[dict]`) - Azure Cloud Provider config [rke-azure-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/azure/) (list maxitems:1)
            * `aadClientCertPassword` (`pulumi.Input[str]`) - (string)
            * `aadClientCertPath` (`pulumi.Input[str]`) - (string)
            * `aadClientId` (`pulumi.Input[str]`) - (string)
            * `aadClientSecret` (`pulumi.Input[str]`) - (string)
            * `cloud` (`pulumi.Input[str]`) - (string)
            * `cloudProviderBackoff` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderBackoffDuration` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffExponent` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffJitter` (`pulumi.Input[float]`) - (int)
            * `cloudProviderBackoffRetries` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimit` (`pulumi.Input[bool]`) - (bool)
            * `cloudProviderRateLimitBucket` (`pulumi.Input[float]`) - (int)
            * `cloudProviderRateLimitQps` (`pulumi.Input[float]`) - (int)
            * `loadBalancerSku` (`pulumi.Input[str]`)
            * `location` (`pulumi.Input[str]`) - (string)
            * `maximumLoadBalancerRuleCount` (`pulumi.Input[float]`) - (int)
            * `primaryAvailabilitySetName` (`pulumi.Input[str]`) - (string)
            * `primaryScaleSetName` (`pulumi.Input[str]`) - (string)
            * `resourceGroup` (`pulumi.Input[str]`) - (string)
            * `routeTableName` (`pulumi.Input[str]`) - (string)
            * `securityGroupName` (`pulumi.Input[str]`) - (string)
            * `subnetName` (`pulumi.Input[str]`) - (string)
            * `subscriptionId` (`pulumi.Input[str]`) - (string)
            * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
            * `useInstanceMetadata` (`pulumi.Input[bool]`) - (bool)
            * `useManagedIdentityExtension` (`pulumi.Input[bool]`) - (bool)
            * `vmType` (`pulumi.Input[str]`) - (string)
            * `vnetName` (`pulumi.Input[str]`) - (string)
            * `vnetResourceGroup` (`pulumi.Input[str]`) - (string)

          * `customCloudConfig` (`pulumi.Input[str]`) - Use custom_cloud_provider instead
          * `customCloudProvider` (`pulumi.Input[str]`) - Custom Cloud Provider config (string)
          * `name` (`pulumi.Input[str]`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
          * `openstackCloudConfig` (`pulumi.Input[dict]`) - Use openstack_cloud_provider instead
            * `blockStorage` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `bsVersion` (`pulumi.Input[str]`) - (string)
              * `ignoreVolumeAz` (`pulumi.Input[bool]`) - (string)
              * `trustDevicePath` (`pulumi.Input[bool]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `authUrl` (`pulumi.Input[str]`) - (string)
              * `caFile` (`pulumi.Input[str]`) - (string)
              * `domainId` (`pulumi.Input[str]`) - Required if `domain_name` not provided. (string)
              * `domainName` (`pulumi.Input[str]`) - Required if `domain_id` not provided. (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
              * `tenantName` (`pulumi.Input[str]`) - Required if `tenant_id` not provided. (string)
              * `trustId` (`pulumi.Input[str]`) - (string)
              * `userId` (`pulumi.Input[str]`) - Required if `username` not provided. (string)
              * `username` (`pulumi.Input[str]`) - Required if `user_id` not provided. (string)

            * `loadBalancer` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `createMonitor` (`pulumi.Input[bool]`) - (bool)
              * `floatingNetworkId` (`pulumi.Input[str]`) - (string)
              * `lbMethod` (`pulumi.Input[str]`) - (string)
              * `lbProvider` (`pulumi.Input[str]`) - (string)
              * `lbVersion` (`pulumi.Input[str]`) - (string)
              * `manageSecurityGroups` (`pulumi.Input[bool]`) - (bool)
              * `monitorDelay` (`pulumi.Input[str]`) - Default `60s` (string)
              * `monitorMaxRetries` (`pulumi.Input[float]`) - Default 5 (int)
              * `monitorTimeout` (`pulumi.Input[str]`) - Default `30s` (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `useOctavia` (`pulumi.Input[bool]`) - (bool)

            * `metadata` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `requestTimeout` (`pulumi.Input[float]`) - (int)
              * `searchOrder` (`pulumi.Input[str]`) - (string)

            * `route` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `routerId` (`pulumi.Input[str]`) - (string)

          * `openstackCloudProvider` (`pulumi.Input[dict]`) - Openstack Cloud Provider config [rke-openstack-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/openstack/) (list maxitems:1)
            * `blockStorage` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `bsVersion` (`pulumi.Input[str]`) - (string)
              * `ignoreVolumeAz` (`pulumi.Input[bool]`) - (string)
              * `trustDevicePath` (`pulumi.Input[bool]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `authUrl` (`pulumi.Input[str]`) - (string)
              * `caFile` (`pulumi.Input[str]`) - (string)
              * `domainId` (`pulumi.Input[str]`) - Required if `domain_name` not provided. (string)
              * `domainName` (`pulumi.Input[str]`) - Required if `domain_id` not provided. (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `tenantId` (`pulumi.Input[str]`) - Required if `tenant_name` not provided. (string)
              * `tenantName` (`pulumi.Input[str]`) - Required if `tenant_id` not provided. (string)
              * `trustId` (`pulumi.Input[str]`) - (string)
              * `userId` (`pulumi.Input[str]`) - Required if `username` not provided. (string)
              * `username` (`pulumi.Input[str]`) - Required if `user_id` not provided. (string)

            * `loadBalancer` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `createMonitor` (`pulumi.Input[bool]`) - (bool)
              * `floatingNetworkId` (`pulumi.Input[str]`) - (string)
              * `lbMethod` (`pulumi.Input[str]`) - (string)
              * `lbProvider` (`pulumi.Input[str]`) - (string)
              * `lbVersion` (`pulumi.Input[str]`) - (string)
              * `manageSecurityGroups` (`pulumi.Input[bool]`) - (bool)
              * `monitorDelay` (`pulumi.Input[str]`) - Default `60s` (string)
              * `monitorMaxRetries` (`pulumi.Input[float]`) - Default 5 (int)
              * `monitorTimeout` (`pulumi.Input[str]`) - Default `30s` (string)
              * `subnetId` (`pulumi.Input[str]`) - (string)
              * `useOctavia` (`pulumi.Input[bool]`) - (bool)

            * `metadata` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `requestTimeout` (`pulumi.Input[float]`) - (int)
              * `searchOrder` (`pulumi.Input[str]`) - (string)

            * `route` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `routerId` (`pulumi.Input[str]`) - (string)

          * `vsphereCloudConfig` (`pulumi.Input[dict]`) - Use vsphere_cloud_provider instead
            * `disk` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `scsiControllerType` (`pulumi.Input[str]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `datastore` (`pulumi.Input[str]`) - (string)
              * `insecureFlag` (`pulumi.Input[bool]`) - (bool)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)
              * `vmName` (`pulumi.Input[str]`) - (string)
              * `vmUuid` (`pulumi.Input[str]`) - (string)
              * `workingDir` (`pulumi.Input[str]`) - (string)

            * `network` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `publicNetwork` (`pulumi.Input[str]`) - (string)

            * `virtualCenters` (`pulumi.Input[list]`) - (List)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `name` (`pulumi.Input[str]`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)

            * `workspace` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `defaultDatastore` (`pulumi.Input[str]`) - (string)
              * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
              * `resourcepoolPath` (`pulumi.Input[str]`) - (string)
              * `server` (`pulumi.Input[str]`) - (string)

          * `vsphereCloudProvider` (`pulumi.Input[dict]`) - Vsphere Cloud Provider config [rke-vsphere-cloud-provider](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/vsphere/) Extra argument `name` is required on `virtual_center` configuration. (list maxitems:1)
            * `disk` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `scsiControllerType` (`pulumi.Input[str]`) - (string)

            * `global` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `datastore` (`pulumi.Input[str]`) - (string)
              * `insecureFlag` (`pulumi.Input[bool]`) - (bool)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)
              * `vmName` (`pulumi.Input[str]`) - (string)
              * `vmUuid` (`pulumi.Input[str]`) - (string)
              * `workingDir` (`pulumi.Input[str]`) - (string)

            * `network` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `publicNetwork` (`pulumi.Input[str]`) - (string)

            * `virtualCenters` (`pulumi.Input[list]`) - (List)
              * `datacenters` (`pulumi.Input[str]`) - (string)
              * `name` (`pulumi.Input[str]`) - Name of virtualcenter config for Vsphere Cloud Provider config (string)
              * `password` (`pulumi.Input[str]`) - Registry password (string)
              * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
              * `soapRoundtripCount` (`pulumi.Input[float]`) - (int)
              * `user` (`pulumi.Input[str]`) - Registry user (string)

            * `workspace` (`pulumi.Input[dict]`) - (list maxitems:1)
              * `datacenter` (`pulumi.Input[str]`) - (string)
              * `defaultDatastore` (`pulumi.Input[str]`) - (string)
              * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
              * `resourcepoolPath` (`pulumi.Input[str]`) - (string)
              * `server` (`pulumi.Input[str]`) - (string)

        The **control_plane_hosts** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `nodeName` (`pulumi.Input[str]`) - Name of the host provisioned via docker machine (string)

        The **dns** object supports the following:

          * `nodeSelector` (`pulumi.Input[dict]`) - Node selector key pair (map)
          * `provider` (`pulumi.Input[str]`) - Monitoring provider (string)
          * `reverseCidrs` (`pulumi.Input[list]`) - Reverse CIDRs  (list)
          * `upstreamNameservers` (`pulumi.Input[list]`) - Upstream nameservers  (list)

        The **etcd_hosts** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `nodeName` (`pulumi.Input[str]`) - Name of the host provisioned via docker machine (string)

        The **inactive_hosts** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `nodeName` (`pulumi.Input[str]`) - Name of the host provisioned via docker machine (string)

        The **ingress** object supports the following:

          * `dnsPolicy` (`pulumi.Input[str]`) - Ingress controller DNS policy. `ClusterFirstWithHostNet`, `ClusterFirst`, `Default`, and `None` are supported. [K8S dns Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) (string)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `nodeSelector` (`pulumi.Input[dict]`) - Node selector key pair (map)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)
          * `provider` (`pulumi.Input[str]`) - Monitoring provider (string)

        The **monitoring** object supports the following:

          * `nodeSelector` (`pulumi.Input[dict]`) - Node selector key pair (map)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)
          * `provider` (`pulumi.Input[str]`) - Monitoring provider (string)

        The **network** object supports the following:

          * `calicoNetworkProvider` (`pulumi.Input[dict]`) - Calico network provider config (list maxitems:1)
            * `cloud_provider` (`pulumi.Input[str]`) - Calico cloud provider (string)

          * `canalNetworkProvider` (`pulumi.Input[dict]`) - Canal network provider config (list maxitems:1)
            * `iface` (`pulumi.Input[str]`) - Flannel network interface (string)

          * `flannelNetworkProvider` (`pulumi.Input[dict]`) - Flannel network provider config (list maxitems:1)
            * `iface` (`pulumi.Input[str]`) - Flannel network interface (string)

          * `mtu` (`pulumi.Input[float]`) - Network provider MTU. Default `0` (int)
          * `options` (`pulumi.Input[dict]`) - Network provider options (map)
          * `plugin` (`pulumi.Input[str]`) - Network provider plugin. `calico`, `canal` (default), `flannel`, `none` and `weave` are supported. (string)
          * `weaveNetworkProvider` (`pulumi.Input[dict]`) - Weave network provider config (list maxitems:1)
            * `password` (`pulumi.Input[str]`) - Registry password (string)

        The **nodes** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `dockerSocket` (`pulumi.Input[str]`) - Docker socket on the node that will be used in tunneling (string)
          * `hostnameOverride` (`pulumi.Input[str]`) - Hostname override for node (string)
          * `internalAddress` (`pulumi.Input[str]`) - Internal address that will be used for components communication (string)
          * `labels` (`pulumi.Input[dict]`) - Node labels (map)
          * `nodeName` (`pulumi.Input[str]`) - Name of the host provisioned via docker machine (string)
          * `port` (`pulumi.Input[str]`) - Port used for SSH communication. Default `22` (string)
          * `roles` (`pulumi.Input[list]`) - Node roles in k8s cluster. `controlplane`, `etcd` and `worker` are supported. (list)
          * `rolesDeprecated` (`pulumi.Input[str]`)
          * `ssh_agent_auth` (`pulumi.Input[bool]`) - SSH Agent Auth enable (bool)
          * `sshCert` (`pulumi.Input[str]`) - SSH Certificate (string)
          * `ssh_cert_path` (`pulumi.Input[str]`) - SSH Certificate path (string)
          * `sshKey` (`pulumi.Input[str]`) - SSH Private Key (string)
          * `ssh_key_path` (`pulumi.Input[str]`) - SSH Private Key path (string)
          * `taints` (`pulumi.Input[list]`) - Node taints (list)
            * `effect` (`pulumi.Input[str]`) - Taint effect. `NoExecute`, `NoSchedule` (default) and `PreferNoSchedule` are supported (string)
            * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
            * `value` (`pulumi.Input[str]`) - Taint value (string)

          * `user` (`pulumi.Input[str]`) - Registry user (string)

        The **private_registries** object supports the following:

          * `isDefault` (`pulumi.Input[bool]`) - Set as default registry. Default `false` (bool)
          * `password` (`pulumi.Input[str]`) - Registry password (string)
          * `url` (`pulumi.Input[str]`) - Registry URL (string)
          * `user` (`pulumi.Input[str]`) - Registry user (string)

        The **restore** object supports the following:

          * `restore` (`pulumi.Input[bool]`) - Restore cluster. Default `false` (bool)
          * `snapshotName` (`pulumi.Input[str]`) - Snapshot name (string)

        The **rotate_certificates** object supports the following:

          * `caCertificates` (`pulumi.Input[bool]`) - Rotate CA Certificates. Default `false` (bool)
          * `services` (`pulumi.Input[list]`) - Services to rotate their certs. `etcd`, `kubelet`, `kube-apiserver`, `kube-proxy`, `kube-scheduler` and `kube-controller-manager` are supported (list)

        The **running_system_images** object supports the following:

          * `alpine` (`pulumi.Input[str]`) - Docker image for alpine (string)
          * `calicoCni` (`pulumi.Input[str]`) - Docker image for calico_cni (string)
          * `calicoControllers` (`pulumi.Input[str]`) - Docker image for calico_controllers (string)
          * `calicoCtl` (`pulumi.Input[str]`) - Docker image for calico_ctl (string)
          * `calicoFlexVol` (`pulumi.Input[str]`) - Docker image for calico_flex_vol (string)
          * `calicoNode` (`pulumi.Input[str]`) - Docker image for calico_node (string)
          * `canalCni` (`pulumi.Input[str]`) - Docker image for canal_cni (string)
          * `canalFlannel` (`pulumi.Input[str]`) - Docker image for canal_flannel (string)
          * `canalFlexVol` (`pulumi.Input[str]`) - Docker image for canal_flex_vol (string)
          * `canalNode` (`pulumi.Input[str]`) - Docker image for canal_node (string)
          * `certDownloader` (`pulumi.Input[str]`) - Docker image for cert_downloader (string)
          * `coredns` (`pulumi.Input[str]`) - Docker image for coredns (string)
          * `corednsAutoscaler` (`pulumi.Input[str]`) - Docker image for coredns_autoscaler (string)
          * `dnsmasq` (`pulumi.Input[str]`) - Docker image for dnsmasq (string)
          * `etcd` (`pulumi.Input[str]`) - Docker image for etcd (string)
          * `flannel` (`pulumi.Input[str]`) - Docker image for flannel (string)
          * `flannelCni` (`pulumi.Input[str]`) - Docker image for flannel_cni (string)
          * `ingress` (`pulumi.Input[str]`) - Docker image for ingress (string)
          * `ingressBackend` (`pulumi.Input[str]`) - Docker image for ingress_backend (string)
          * `kubeDns` (`pulumi.Input[str]`) - Docker image for kube_dns (string)
          * `kubeDnsAutoscaler` (`pulumi.Input[str]`) - Docker image for kube_dns_autoscaler (string)
          * `kubeDnsSidecar` (`pulumi.Input[str]`) - Docker image for kube_dns_sidecar (string)
          * `kubernetes` (`pulumi.Input[str]`) - Docker image for kubernetes (string)
          * `kubernetesServicesSidecar` (`pulumi.Input[str]`) - Docker image for kubernetes_services_sidecar (string)
          * `metricsServer` (`pulumi.Input[str]`) - Docker image for metrics_server (string)
          * `nginxProxy` (`pulumi.Input[str]`) - Docker image for nginx_proxy (string)
          * `nodelocal` (`pulumi.Input[str]`) - Docker image for nodelocal (string)
          * `podInfraContainer` (`pulumi.Input[str]`) - Docker image for pod_infra_container (string)
          * `weaveCni` (`pulumi.Input[str]`) - Docker image for weave_cni (string)
          * `weaveNode` (`pulumi.Input[str]`) - Docker image for weave_node (string)
          * `windowsPodInfraContainer` (`pulumi.Input[str]`) - Docker image for windows_pod_infra_container (string)

        The **services** object supports the following:

          * `etcd` (`pulumi.Input[dict]`) - Docker image for etcd (string)
            * `backupConfig` (`pulumi.Input[dict]`) - Backup options for etcd service. Just for Rancher v2.2.x (list maxitems:1)
              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)
              * `intervalHours` (`pulumi.Input[float]`) - Interval hours for etcd backup. Default `12` (int)
              * `retention` (`pulumi.Input[float]`) - Retention for etcd backup. Default `6` (int)
              * `s3BackupConfig` (`pulumi.Input[dict]`) - S3 config options for etcd backup (list maxitems:1)
                * `accessKey` (`pulumi.Input[str]`) - Access key for S3 service (string)
                * `bucketName` (`pulumi.Input[str]`) - Bucket name for S3 service (string)
                * `customCa` (`pulumi.Input[str]`) - Base64 encoded custom CA for S3 service. Use filebase64(<FILE>) for encoding file. Available from Rancher v2.2.5 (string)
                * `endpoint` (`pulumi.Input[str]`) - Endpoint for S3 service (string)
                * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
                * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
                * `secretKey` (`pulumi.Input[str]`) - Secret key for S3 service (string)

              * `safeTimestamp` (`pulumi.Input[bool]`) - Safe timestamp for etcd backup. Default: `false` (bool)

            * `caCert` (`pulumi.Input[str]`) - TLS CA certificate for etcd service (string)
            * `cert` (`pulumi.Input[str]`) - TLS certificate for etcd service (string)
            * `creation` (`pulumi.Input[str]`) - Creation option for etcd service (string)
            * `externalUrls` (`pulumi.Input[list]`) - External urls for etcd service (list)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `gid` (`pulumi.Input[float]`) - Etcd service GID. Default: `0`. For Rancher v2.3.x or above (int)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
            * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
            * `retention` (`pulumi.Input[str]`) - Retention for etcd backup. Default `6` (int)
            * `snapshot` (`pulumi.Input[bool]`) - Snapshot option for etcd service. Default `true` (bool)
            * `uid` (`pulumi.Input[float]`) - Etcd service UID. Default: `0`. For Rancher v2.3.x or above (int)

          * `kubeApi` (`pulumi.Input[dict]`) - Kube API options for RKE services (list maxitems:1)
            * `alwaysPullImages` (`pulumi.Input[bool]`) - Enable [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages) Admission controller plugin. [Rancher docs](https://rancher.com/docs/rke/latest/en/config-options/services/#kubernetes-api-server-options) Default: `false` (bool)
            * `auditLog` (`pulumi.Input[dict]`) - K8s audit log configuration. (list maxitem: 1)
              * `configuration` (`pulumi.Input[dict]`) - Audit log configuration. (list maxtiem: 1)
                * `format` (`pulumi.Input[str]`) - Audit log format. Default: `json` (string)
                * `maxAge` (`pulumi.Input[float]`) - Audit log max age. Default: `30` (int)
                * `maxBackup` (`pulumi.Input[float]`) - Audit log max backup. Default: `10` (int)
                * `maxSize` (`pulumi.Input[float]`) - Audit log max size. Default: `100` (int)
                * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
                * `policy` (`pulumi.Input[str]`) - Audit policy json encoded definition. `"apiVersion"` and `"kind":"Policy","rules"` fields are required in the json. Ex. `jsonencode({"apiVersion":"audit.k8s.io/v1","kind":"Policy","rules":[{"level":"RequestResponse","resources":[{"group":"","resources":["pods"]}]}]})` [More info](https://rancher.com/docs/rke/latest/en/config-options/audit-log/) (string)

              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

            * `eventRateLimit` (`pulumi.Input[dict]`) - K8s event rate limit configuration. (list maxitem: 1)
              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `podSecurityPolicy` (`pulumi.Input[bool]`) - Pod Security Policy option for kube API service. Default `false` (bool)
            * `secretsEncryptionConfig` (`pulumi.Input[dict]`) - [Encrypt k8s secret data configration](https://rancher.com/docs/rke/latest/en/config-options/secrets-encryption/). (list maxitem: 1)
              * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

            * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)
            * `serviceNodePortRange` (`pulumi.Input[str]`) - Service Node Port Range option for kube API service (string)

          * `kubeController` (`pulumi.Input[dict]`) - Kube Controller options for RKE services (list maxitems:1)
            * `cluster_cidr` (`pulumi.Input[str]`) - Cluster CIDR option for kube controller service (string)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)

          * `kubelet` (`pulumi.Input[dict]`) - Kubelet options for RKE services (list maxitems:1)
            * `cluster_dns_server` (`pulumi.Input[str]`) - Cluster DNS Server option for kubelet service (string)
            * `cluster_domain` (`pulumi.Input[str]`) - Cluster Domain option for kubelet service. Default `cluster.local` (string)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `failSwapOn` (`pulumi.Input[bool]`) - Enable or disable failing when swap on is not supported (bool)
              * `generate_serving_certificate` [Generate a certificate signed by the kube-ca](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-serving-certificate-requirements). Default `false` (bool)
            * `generateServingCertificate` (`pulumi.Input[bool]`)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
            * `infraContainerImage` (`pulumi.Input[str]`) - Infra container image for kubelet service (string)

          * `kubeproxy` (`pulumi.Input[dict]`) - Kubeproxy options for RKE services (list maxitems:1)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

          * `scheduler` (`pulumi.Input[dict]`) - Scheduler options for RKE services (list maxitems:1)
            * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
            * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
            * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
            * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

        The **services_etcd_deprecated** object supports the following:

          * `backupConfig` (`pulumi.Input[dict]`) - Backup options for etcd service. Just for Rancher v2.2.x (list maxitems:1)
            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)
            * `intervalHours` (`pulumi.Input[float]`) - Interval hours for etcd backup. Default `12` (int)
            * `retention` (`pulumi.Input[float]`) - Retention for etcd backup. Default `6` (int)
            * `s3BackupConfig` (`pulumi.Input[dict]`) - S3 config options for etcd backup (list maxitems:1)
              * `accessKey` (`pulumi.Input[str]`) - Access key for S3 service (string)
              * `bucketName` (`pulumi.Input[str]`) - Bucket name for S3 service (string)
              * `customCa` (`pulumi.Input[str]`) - Base64 encoded custom CA for S3 service. Use filebase64(<FILE>) for encoding file. Available from Rancher v2.2.5 (string)
              * `endpoint` (`pulumi.Input[str]`) - Endpoint for S3 service (string)
              * `folder` (`pulumi.Input[str]`) - Folder for S3 service. Available from Rancher v2.2.7 (string)
              * `region` (`pulumi.Input[str]`) - Region for S3 service (string)
              * `secretKey` (`pulumi.Input[str]`) - Secret key for S3 service (string)

            * `safeTimestamp` (`pulumi.Input[bool]`) - Safe timestamp for etcd backup. Default: `false` (bool)

          * `caCert` (`pulumi.Input[str]`) - TLS CA certificate for etcd service (string)
          * `cert` (`pulumi.Input[str]`) - TLS certificate for etcd service (string)
          * `creation` (`pulumi.Input[str]`) - Creation option for etcd service (string)
          * `externalUrls` (`pulumi.Input[list]`) - External urls for etcd service (list)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `gid` (`pulumi.Input[float]`) - Etcd service GID. Default: `0`. For Rancher v2.3.x or above (int)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `key` (`pulumi.Input[str]`) - TLS key for etcd service (string)
          * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
          * `retention` (`pulumi.Input[str]`) - Retention for etcd backup. Default `6` (int)
          * `snapshot` (`pulumi.Input[bool]`) - Snapshot option for etcd service. Default `true` (bool)
          * `uid` (`pulumi.Input[float]`) - Etcd service UID. Default: `0`. For Rancher v2.3.x or above (int)

        The **services_kube_api_deprecated** object supports the following:

          * `alwaysPullImages` (`pulumi.Input[bool]`) - Enable [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages) Admission controller plugin. [Rancher docs](https://rancher.com/docs/rke/latest/en/config-options/services/#kubernetes-api-server-options) Default: `false` (bool)
          * `auditLog` (`pulumi.Input[dict]`) - K8s audit log configuration. (list maxitem: 1)
            * `configuration` (`pulumi.Input[dict]`) - Audit log configuration. (list maxtiem: 1)
              * `format` (`pulumi.Input[str]`) - Audit log format. Default: `json` (string)
              * `maxAge` (`pulumi.Input[float]`) - Audit log max age. Default: `30` (int)
              * `maxBackup` (`pulumi.Input[float]`) - Audit log max backup. Default: `10` (int)
              * `maxSize` (`pulumi.Input[float]`) - Audit log max size. Default: `100` (int)
              * `path` (`pulumi.Input[str]`) - Audit log path. Default: `/var/log/kube-audit/audit-log.json` (string)
              * `policy` (`pulumi.Input[str]`) - Audit policy json encoded definition. `"apiVersion"` and `"kind":"Policy","rules"` fields are required in the json. Ex. `jsonencode({"apiVersion":"audit.k8s.io/v1","kind":"Policy","rules":[{"level":"RequestResponse","resources":[{"group":"","resources":["pods"]}]}]})` [More info](https://rancher.com/docs/rke/latest/en/config-options/audit-log/) (string)

            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

          * `eventRateLimit` (`pulumi.Input[dict]`) - K8s event rate limit configuration. (list maxitem: 1)
            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `podSecurityPolicy` (`pulumi.Input[bool]`) - Pod Security Policy option for kube API service. Default `false` (bool)
          * `secretsEncryptionConfig` (`pulumi.Input[dict]`) - [Encrypt k8s secret data configration](https://rancher.com/docs/rke/latest/en/config-options/secrets-encryption/). (list maxitem: 1)
            * `enabled` (`pulumi.Input[bool]`) - Enable secrets encryption. Default: `false` (bool)

          * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)
          * `serviceNodePortRange` (`pulumi.Input[str]`) - Service Node Port Range option for kube API service (string)

        The **services_kube_controller_deprecated** object supports the following:

          * `cluster_cidr` (`pulumi.Input[str]`) - Cluster CIDR option for kube controller service (string)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `serviceClusterIpRange` (`pulumi.Input[str]`) - Service Cluster ip Range option for kube controller service (string)

        The **services_kube_proxy_deprecated** object supports the following:

          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

        The **services_kube_scheduler_deprecated** object supports the following:

          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)

        The **services_kubelet_deprecated** object supports the following:

          * `cluster_dns_server` (`pulumi.Input[str]`) - Cluster DNS Server option for kubelet service (string)
          * `cluster_domain` (`pulumi.Input[str]`) - Cluster Domain option for kubelet service. Default `cluster.local` (string)
          * `extraArgs` (`pulumi.Input[dict]`) - Extra arguments for scheduler service (map)
          * `extraBinds` (`pulumi.Input[list]`) - Extra binds for scheduler service (list)
          * `extraEnvs` (`pulumi.Input[list]`) - Extra environment for scheduler service (list)
          * `failSwapOn` (`pulumi.Input[bool]`) - Enable or disable failing when swap on is not supported (bool)
            * `generate_serving_certificate` [Generate a certificate signed by the kube-ca](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-serving-certificate-requirements). Default `false` (bool)
          * `generateServingCertificate` (`pulumi.Input[bool]`)
          * `image` (`pulumi.Input[str]`) - Docker image for scheduler service (string)
          * `infraContainerImage` (`pulumi.Input[str]`) - Infra container image for kubelet service (string)

        The **system_images** object supports the following:

          * `alpine` (`pulumi.Input[str]`) - Docker image for alpine (string)
          * `calicoCni` (`pulumi.Input[str]`) - Docker image for calico_cni (string)
          * `calicoControllers` (`pulumi.Input[str]`) - Docker image for calico_controllers (string)
          * `calicoCtl` (`pulumi.Input[str]`) - Docker image for calico_ctl (string)
          * `calicoFlexVol` (`pulumi.Input[str]`) - Docker image for calico_flex_vol (string)
          * `calicoNode` (`pulumi.Input[str]`) - Docker image for calico_node (string)
          * `canalCni` (`pulumi.Input[str]`) - Docker image for canal_cni (string)
          * `canalFlannel` (`pulumi.Input[str]`) - Docker image for canal_flannel (string)
          * `canalFlexVol` (`pulumi.Input[str]`) - Docker image for canal_flex_vol (string)
          * `canalNode` (`pulumi.Input[str]`) - Docker image for canal_node (string)
          * `certDownloader` (`pulumi.Input[str]`) - Docker image for cert_downloader (string)
          * `coredns` (`pulumi.Input[str]`) - Docker image for coredns (string)
          * `corednsAutoscaler` (`pulumi.Input[str]`) - Docker image for coredns_autoscaler (string)
          * `dnsmasq` (`pulumi.Input[str]`) - Docker image for dnsmasq (string)
          * `etcd` (`pulumi.Input[str]`) - Docker image for etcd (string)
          * `flannel` (`pulumi.Input[str]`) - Docker image for flannel (string)
          * `flannelCni` (`pulumi.Input[str]`) - Docker image for flannel_cni (string)
          * `ingress` (`pulumi.Input[str]`) - Docker image for ingress (string)
          * `ingressBackend` (`pulumi.Input[str]`) - Docker image for ingress_backend (string)
          * `kubeDns` (`pulumi.Input[str]`) - Docker image for kube_dns (string)
          * `kubeDnsAutoscaler` (`pulumi.Input[str]`) - Docker image for kube_dns_autoscaler (string)
          * `kubeDnsSidecar` (`pulumi.Input[str]`) - Docker image for kube_dns_sidecar (string)
          * `kubernetes` (`pulumi.Input[str]`) - Docker image for kubernetes (string)
          * `kubernetesServicesSidecar` (`pulumi.Input[str]`) - Docker image for kubernetes_services_sidecar (string)
          * `metricsServer` (`pulumi.Input[str]`) - Docker image for metrics_server (string)
          * `nginxProxy` (`pulumi.Input[str]`) - Docker image for nginx_proxy (string)
          * `nodelocal` (`pulumi.Input[str]`) - Docker image for nodelocal (string)
          * `podInfraContainer` (`pulumi.Input[str]`) - Docker image for pod_infra_container (string)
          * `weaveCni` (`pulumi.Input[str]`) - Docker image for weave_cni (string)
          * `weaveNode` (`pulumi.Input[str]`) - Docker image for weave_node (string)
          * `windowsPodInfraContainer` (`pulumi.Input[str]`) - Docker image for windows_pod_infra_container (string)

        The **upgrade_strategy** object supports the following:

          * `drain` (`pulumi.Input[bool]`) - RKE drain nodes. Default: `false` (bool)
          * `drainInput` (`pulumi.Input[dict]`) - RKE drain node input (list Maxitems: 1)
            * `deleteLocalData` (`pulumi.Input[bool]`) - Delete RKE node local data. Default: `false` (bool)
            * `force` (`pulumi.Input[bool]`) - Force RKE node drain. Default: `false` (bool)
            * `gracePeriod` (`pulumi.Input[float]`) - RKE node drain grace period. Default: `-1` (int)
            * `ignoreDaemonSets` (`pulumi.Input[bool]`) - Ignore RKE daemon sets. Default: `true` (bool)
            * `timeout` (`pulumi.Input[float]`) - RKE node drain timeout. Default: `60` (int)

          * `maxUnavailableControlplane` (`pulumi.Input[str]`) - RKE max unavailable controlplane nodes. Default: `1` (string)
          * `maxUnavailableWorker` (`pulumi.Input[str]`) - RKE max unavailable worker nodes. Default: `10%` (string)

        The **worker_hosts** object supports the following:

          * `address` (`pulumi.Input[str]`) - Address ip for node (string)
          * `nodeName` (`pulumi.Input[str]`) - Name of the host provisioned via docker machine (string)
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = dict()

        __props__["addon_job_timeout"] = addon_job_timeout
        __props__["addons"] = addons
        __props__["addons_includes"] = addons_includes
        __props__["api_server_url"] = api_server_url
        __props__["authentication"] = authentication
        __props__["authorization"] = authorization
        __props__["bastion_host"] = bastion_host
        __props__["ca_crt"] = ca_crt
        __props__["cert_dir"] = cert_dir
        __props__["certificates"] = certificates
        __props__["client_cert"] = client_cert
        __props__["client_key"] = client_key
        __props__["cloud_provider"] = cloud_provider
        __props__["cluster_cidr"] = cluster_cidr
        __props__["cluster_dns_server"] = cluster_dns_server
        __props__["cluster_domain"] = cluster_domain
        __props__["cluster_name"] = cluster_name
        __props__["cluster_yaml"] = cluster_yaml
        __props__["control_plane_hosts"] = control_plane_hosts
        __props__["custom_certs"] = custom_certs
        __props__["delay_on_creation"] = delay_on_creation
        __props__["dind"] = dind
        __props__["dind_dns_server"] = dind_dns_server
        __props__["dind_storage_driver"] = dind_storage_driver
        __props__["disable_port_check"] = disable_port_check
        __props__["dns"] = dns
        __props__["etcd_hosts"] = etcd_hosts
        __props__["ignore_docker_version"] = ignore_docker_version
        __props__["inactive_hosts"] = inactive_hosts
        __props__["ingress"] = ingress
        __props__["internal_kube_config_yaml"] = internal_kube_config_yaml
        __props__["kube_admin_user"] = kube_admin_user
        __props__["kube_config_yaml"] = kube_config_yaml
        __props__["kubernetes_version"] = kubernetes_version
        __props__["monitoring"] = monitoring
        __props__["network"] = network
        __props__["nodes"] = nodes
        __props__["nodes_confs"] = nodes_confs
        __props__["prefix_path"] = prefix_path
        __props__["private_registries"] = private_registries
        __props__["restore"] = restore
        __props__["rke_cluster_yaml"] = rke_cluster_yaml
        __props__["rke_state"] = rke_state
        __props__["rotate_certificates"] = rotate_certificates
        __props__["running_system_images"] = running_system_images
        __props__["services"] = services
        __props__["services_etcd_deprecated"] = services_etcd_deprecated
        __props__["services_kube_api_deprecated"] = services_kube_api_deprecated
        __props__["services_kube_controller_deprecated"] = services_kube_controller_deprecated
        __props__["services_kube_proxy_deprecated"] = services_kube_proxy_deprecated
        __props__["services_kube_scheduler_deprecated"] = services_kube_scheduler_deprecated
        __props__["services_kubelet_deprecated"] = services_kubelet_deprecated
        __props__["ssh_agent_auth"] = ssh_agent_auth
        __props__["ssh_cert_path"] = ssh_cert_path
        __props__["ssh_key_path"] = ssh_key_path
        __props__["system_images"] = system_images
        __props__["update_only"] = update_only
        __props__["upgrade_strategy"] = upgrade_strategy
        __props__["worker_hosts"] = worker_hosts
        return Cluster(resource_name, opts=opts, __props__=__props__)
    def translate_output_property(self, prop):
        return tables._CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop

    def translate_input_property(self, prop):
        return tables._SNAKE_TO_CAMEL_CASE_TABLE.get(prop) or prop

