{
  "tagging" : {
    "permissions" : [ "eks:TagResource", "eks:UntagResource" ],
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "tagProperty" : "/properties/Tags",
    "cloudFormationSystemTags" : true
  },
  "typeName" : "AWS::EKS::Cluster",
  "readOnlyProperties" : [ "/properties/Id", "/properties/Arn", "/properties/Endpoint", "/properties/CertificateAuthorityData", "/properties/ClusterSecurityGroupId", "/properties/EncryptionConfigKeyArn", "/properties/OpenIdConnectIssuerUrl", "/properties/KubernetesNetworkConfig/ServiceIpv6Cidr" ],
  "description" : "An object representing an Amazon EKS cluster.",
  "createOnlyProperties" : [ "/properties/OutpostConfig", "/properties/EncryptionConfig", "/properties/KubernetesNetworkConfig/IpFamily", "/properties/KubernetesNetworkConfig/ServiceIpv4Cidr", "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions", "/properties/Name", "/properties/RoleArn", "/properties/BootstrapSelfManagedAddons" ],
  "primaryIdentifier" : [ "/properties/Name" ],
  "required" : [ "RoleArn", "ResourcesVpcConfig" ],
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-eks.git",
  "handlers" : {
    "read" : {
      "permissions" : [ "eks:DescribeCluster" ]
    },
    "create" : {
      "permissions" : [ "eks:CreateCluster", "eks:DescribeCluster", "eks:TagResource", "eks:CreateAccessEntry", "iam:PassRole", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:CreateServiceLinkedRole", "iam:CreateInstanceProfile", "iam:TagInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:GetInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "kms:DescribeKey", "kms:CreateGrant" ]
    },
    "update" : {
      "permissions" : [ "iam:PassRole", "eks:UpdateClusterConfig", "eks:UpdateClusterVersion", "eks:DescribeCluster", "eks:DescribeUpdate", "eks:TagResource", "eks:UntagResource" ],
      "timeoutInMinutes" : 2160
    },
    "list" : {
      "permissions" : [ "eks:ListClusters" ]
    },
    "delete" : {
      "permissions" : [ "eks:DeleteCluster", "eks:DescribeCluster" ]
    }
  },
  "writeOnlyProperties" : [ "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions", "/properties/BootstrapSelfManagedAddons", "/properties/Force" ],
  "additionalProperties" : false,
  "definitions" : {
    "AccessConfig" : {
      "description" : "An object representing the Access Config to use for the cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "AuthenticationMode" : {
          "description" : "Specify the authentication mode that should be used to create your cluster.",
          "type" : "string",
          "enum" : [ "CONFIG_MAP", "API_AND_CONFIG_MAP", "API" ]
        },
        "BootstrapClusterCreatorAdminPermissions" : {
          "description" : "Set this value to false to avoid creating a default cluster admin Access Entry using the IAM principal used to create the cluster.",
          "type" : "boolean"
        }
      }
    },
    "EncryptionConfig" : {
      "description" : "The encryption configuration for the cluster",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Resources" : {
          "description" : "Specifies the resources to be encrypted. The only supported value is \"secrets\".",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "type" : "string"
          }
        },
        "Provider" : {
          "description" : "The encryption provider for the cluster.",
          "$ref" : "#/definitions/Provider"
        }
      }
    },
    "LoggingTypeConfig" : {
      "description" : "Enabled Logging Type",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Type" : {
          "description" : "name of the log type",
          "type" : "string",
          "enum" : [ "api", "audit", "authenticator", "controllerManager", "scheduler" ]
        }
      }
    },
    "ClusterLogging" : {
      "description" : "The cluster control plane logging configuration for your cluster. ",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "EnabledTypes" : {
          "$ref" : "#/definitions/EnabledTypes"
        }
      }
    },
    "ElasticLoadBalancing" : {
      "description" : "Todo: add description",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Enabled" : {
          "description" : "Todo: add description",
          "type" : "boolean"
        }
      }
    },
    "KubernetesNetworkConfig" : {
      "description" : "The Kubernetes network configuration for the cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "ServiceIpv4Cidr" : {
          "description" : "The CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. ",
          "type" : "string"
        },
        "ServiceIpv6Cidr" : {
          "description" : "The CIDR block to assign Kubernetes service IP addresses from.",
          "type" : "string"
        },
        "IpFamily" : {
          "description" : "Ipv4 or Ipv6. You can only specify ipv6 for 1.21 and later clusters that use version 1.10.1 or later of the Amazon VPC CNI add-on",
          "type" : "string",
          "enum" : [ "ipv4", "ipv6" ]
        },
        "ElasticLoadBalancing" : {
          "description" : "Todo: add description",
          "$ref" : "#/definitions/ElasticLoadBalancing"
        }
      }
    },
    "BlockStorage" : {
      "description" : "Todo: add description",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Enabled" : {
          "description" : "Todo: add description",
          "type" : "boolean"
        }
      }
    },
    "EtcdPlacement" : {
      "description" : "The placement configuration for the etcd instances of your local Amazon EKS cluster on an AWS Outpost.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "SpreadLevel" : {
          "description" : "Optional parameter to specify the placement group spread level for etcd instances. If not provided, EKS will deploy etcd instances without a placement group.",
          "type" : "string"
        }
      }
    },
    "RemotePodNetworks" : {
      "description" : "Network configuration of pods run on-premises with EKS Hybrid Nodes.",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/RemotePodNetwork"
      }
    },
    "ControlPlaneScalingConfig" : {
      "description" : "Configuration for provisioned control plane scaling.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Tier" : {
          "description" : "The scaling tier for the provisioned control plane.",
          "type" : "string",
          "enum" : [ "standard", "tier-xl", "tier-2xl", "tier-4xl", "tier-8xl", "tier-ultra" ]
        }
      }
    },
    "OutpostConfig" : {
      "description" : "An object representing the Outpost configuration to use for AWS EKS outpost cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "EtcdPlacement" : {
          "description" : "An object representing the placement configuration for the etcd instances of your local Amazon EKS cluster on an AWS Outpost.",
          "$ref" : "#/definitions/EtcdPlacement"
        },
        "OutpostArns" : {
          "description" : "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. Only a single Outpost ARN is supported.",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "minItems" : 1,
            "type" : "string"
          }
        },
        "ControlPlanePlacement" : {
          "description" : "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost.",
          "$ref" : "#/definitions/ControlPlanePlacement"
        },
        "EtcdInstanceType" : {
          "description" : "The EC2 instance type for etcd instances of your local Amazon EKS cluster on AWS Outposts. This instance type applies to all etcd instances and cannot be changed after cluster creation.",
          "type" : "string"
        },
        "ControlPlaneInstanceType" : {
          "description" : "The EC2 instance type for the Kubernetes control plane instances of your local Amazon EKS cluster on AWS Outposts. This instance type applies to all control plane instances and cannot be changed after cluster creation.",
          "type" : "string"
        }
      },
      "required" : [ "OutpostArns", "ControlPlaneInstanceType" ]
    },
    "RemotePodNetwork" : {
      "description" : "Network configuration of pods run on-premises with EKS Hybrid Nodes.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Cidrs" : {
          "description" : "Specifies the list of remote pod CIDRs.",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "minItems" : 1,
            "type" : "string"
          }
        }
      },
      "required" : [ "Cidrs" ]
    },
    "Logging" : {
      "description" : "Enable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs based on log types. By default, cluster control plane logs aren't exported to CloudWatch Logs.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "ClusterLogging" : {
          "description" : "The cluster control plane logging configuration for your cluster. ",
          "$ref" : "#/definitions/ClusterLogging"
        }
      }
    },
    "RemoteNodeNetworks" : {
      "description" : "Network configuration of nodes run on-premises with EKS Hybrid Nodes.",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/RemoteNodeNetwork"
      }
    },
    "ComputeConfig" : {
      "description" : "Todo: add description",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "NodePools" : {
          "description" : "Todo: add description",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "type" : "string"
          }
        },
        "NodeRoleArn" : {
          "description" : "Todo: add description",
          "type" : "string"
        },
        "Enabled" : {
          "description" : "Todo: add description",
          "type" : "boolean"
        }
      }
    },
    "StorageConfig" : {
      "description" : "Todo: add description",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "BlockStorage" : {
          "description" : "Todo: add description",
          "$ref" : "#/definitions/BlockStorage"
        }
      }
    },
    "EnabledTypes" : {
      "description" : "Enable control plane logs for your cluster, all log types will be disabled if the array is empty",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/LoggingTypeConfig"
      }
    },
    "ControlPlanePlacement" : {
      "description" : "The placement configuration for all the control plane instances of your local Amazon EKS cluster on an AWS Outpost.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "GroupName" : {
          "description" : "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.",
          "type" : "string"
        },
        "SpreadLevel" : {
          "description" : "Optional parameter to specify the placement group spread level for control plane instances. If not provided, EKS will deploy control plane instances without a placement group.",
          "type" : "string"
        }
      }
    },
    "ZonalShiftConfig" : {
      "description" : "The current zonal shift configuration to use for the cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Enabled" : {
          "description" : "Set this value to true to enable zonal shift for the cluster.",
          "type" : "boolean"
        }
      }
    },
    "DeletionProtection" : {
      "description" : "Set this value to true to enable deletion protection for the cluster.",
      "type" : "boolean"
    },
    "Provider" : {
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "KeyArn" : {
          "description" : "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric, created in the same region as the cluster, and if the KMS key was created in a different account, the user must have access to the KMS key.",
          "type" : "string"
        }
      }
    },
    "RemoteNodeNetwork" : {
      "description" : "Network configuration of nodes run on-premises with EKS Hybrid Nodes.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Cidrs" : {
          "description" : "Specifies the list of remote node CIDRs.",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "minItems" : 1,
            "type" : "string"
          }
        }
      },
      "required" : [ "Cidrs" ]
    },
    "RemoteNetworkConfig" : {
      "description" : "Configuration fields for specifying on-premises node and pod CIDRs that are external to the VPC passed during cluster creation.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "RemoteNodeNetworks" : {
          "description" : "Network configuration of nodes run on-premises with EKS Hybrid Nodes.",
          "$ref" : "#/definitions/RemoteNodeNetworks"
        },
        "RemotePodNetworks" : {
          "description" : "Network configuration of pods run on-premises with EKS Hybrid Nodes.",
          "$ref" : "#/definitions/RemotePodNetworks"
        }
      }
    },
    "UpgradePolicy" : {
      "description" : "An object representing the Upgrade Policy to use for the cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "SupportType" : {
          "description" : "Specify the support type for your cluster.",
          "type" : "string",
          "enum" : [ "STANDARD", "EXTENDED" ]
        }
      }
    },
    "Tag" : {
      "description" : "A key-value pair to associate with a resource.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Value" : {
          "minLength" : 0,
          "description" : "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "type" : "string",
          "maxLength" : 256
        },
        "Key" : {
          "minLength" : 1,
          "description" : "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "type" : "string",
          "maxLength" : 128
        }
      },
      "required" : [ "Key", "Value" ]
    },
    "ResourcesVpcConfig" : {
      "description" : "An object representing the VPC configuration to use for an Amazon EKS cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "EndpointPublicAccess" : {
          "description" : "Set this value to false to disable public access to your cluster's Kubernetes API server endpoint. If you disable public access, your cluster's Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter is true, which enables public access for your Kubernetes API server.",
          "type" : "boolean"
        },
        "ControlPlaneEgressMode" : {
          "description" : "Specify the egress mode for the cluster control plane. If you set this to CUSTOMER_ROUTED, the control plane routes traffic through your VPC subnets instead of using AWS managed networking.",
          "type" : "string"
        },
        "PublicAccessCidrs" : {
          "description" : "The CIDR blocks that are allowed access to your cluster's public Kubernetes API server endpoint. Communication to the endpoint from addresses outside of the CIDR blocks that you specify is denied. The default value is 0.0.0.0/0. If you've disabled private endpoint access and you have nodes or AWS Fargate pods in the cluster, then ensure that you specify the necessary CIDR blocks.",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "minItems" : 1,
            "type" : "string"
          }
        },
        "EndpointPrivateAccess" : {
          "description" : "Set this value to true to enable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster's VPC use the private VPC endpoint. The default value for this parameter is false, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or AWS Fargate pods in the cluster, then ensure that publicAccessCidrs includes the necessary CIDR blocks for communication with the nodes or Fargate pods.",
          "type" : "boolean"
        },
        "SecurityGroupIds" : {
          "description" : "Specify one or more security groups for the cross-account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane. If you don't specify a security group, the default security group for your VPC is used.",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "minItems" : 1,
            "type" : "string"
          }
        },
        "SubnetIds" : {
          "description" : "Specify subnets for your Amazon EKS nodes. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your nodes and the Kubernetes control plane.",
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "minItems" : 1,
            "type" : "string"
          }
        }
      },
      "required" : [ "SubnetIds" ]
    }
  },
  "properties" : {
    "Force" : {
      "default" : false,
      "description" : "Force cluster version update",
      "type" : "boolean"
    },
    "AccessConfig" : {
      "$ref" : "#/definitions/AccessConfig"
    },
    "CertificateAuthorityData" : {
      "description" : "The certificate-authority-data for your cluster.",
      "type" : "string"
    },
    "EncryptionConfig" : {
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "maxItems" : 1,
        "$ref" : "#/definitions/EncryptionConfig"
      }
    },
    "KubernetesNetworkConfig" : {
      "$ref" : "#/definitions/KubernetesNetworkConfig"
    },
    "Name" : {
      "minLength" : 1,
      "pattern" : "^[0-9A-Za-z][A-Za-z0-9\\-_]*",
      "description" : "The unique name to give to your cluster.",
      "type" : "string",
      "maxLength" : 100
    },
    "Endpoint" : {
      "description" : "The endpoint for your Kubernetes API server, such as https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com.",
      "type" : "string"
    },
    "Version" : {
      "pattern" : "1\\.\\d\\d",
      "description" : "The desired Kubernetes version for your cluster. If you don't specify a value here, the latest version available in Amazon EKS is used.",
      "type" : "string"
    },
    "ControlPlaneScalingConfig" : {
      "$ref" : "#/definitions/ControlPlaneScalingConfig"
    },
    "ClusterSecurityGroupId" : {
      "description" : "The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control plane to data plane communication.",
      "type" : "string"
    },
    "OutpostConfig" : {
      "$ref" : "#/definitions/OutpostConfig"
    },
    "Tags" : {
      "uniqueItems" : true,
      "description" : "An array of key-value pairs to apply to this resource.",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "OpenIdConnectIssuerUrl" : {
      "description" : "The issuer URL for the cluster's OIDC identity provider, such as https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E. If you need to remove https:// from this output value, you can include the following code in your template.",
      "type" : "string"
    },
    "Logging" : {
      "$ref" : "#/definitions/Logging"
    },
    "ComputeConfig" : {
      "$ref" : "#/definitions/ComputeConfig"
    },
    "StorageConfig" : {
      "$ref" : "#/definitions/StorageConfig"
    },
    "BootstrapSelfManagedAddons" : {
      "description" : "Set this value to false to avoid creating the default networking add-ons when the cluster is created.",
      "type" : "boolean"
    },
    "EncryptionConfigKeyArn" : {
      "description" : "Amazon Resource Name (ARN) or alias of the customer master key (CMK).",
      "type" : "string"
    },
    "DeletionProtection" : {
      "description" : "Set this value to true to enable deletion protection for the cluster.",
      "type" : "boolean"
    },
    "ZonalShiftConfig" : {
      "$ref" : "#/definitions/ZonalShiftConfig"
    },
    "RoleArn" : {
      "description" : "The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.",
      "type" : "string"
    },
    "UpgradePolicy" : {
      "$ref" : "#/definitions/UpgradePolicy"
    },
    "RemoteNetworkConfig" : {
      "$ref" : "#/definitions/RemoteNetworkConfig"
    },
    "Id" : {
      "description" : "The unique ID given to your cluster.",
      "type" : "string"
    },
    "Arn" : {
      "description" : "The ARN of the cluster, such as arn:aws:eks:us-west-2:666666666666:cluster/prod.",
      "type" : "string"
    },
    "ResourcesVpcConfig" : {
      "$ref" : "#/definitions/ResourcesVpcConfig"
    }
  }
}