import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Manages a Managed Kubernetes Cluster (also known as AKS / Azure Kubernetes Service)
 *
 * > **Note:** Due to the fast-moving nature of AKS, we recommend using the latest version of the Azure Provider when using AKS.
 *
 * ## Example Usage
 *
 * This example provisions a basic Managed Kubernetes Cluster.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as azure from "@pulumi/azure";
 *
 * const example = new azure.core.ResourceGroup("example", {
 *     name: "example-resources",
 *     location: "West Europe",
 * });
 * const exampleKubernetesCluster = new azure.containerservice.KubernetesCluster("example", {
 *     name: "example-aks1",
 *     location: example.location,
 *     resourceGroupName: example.name,
 *     dnsPrefix: "exampleaks1",
 *     defaultNodePool: {
 *         name: "default",
 *         nodeCount: 1,
 *         vmSize: "Standard_D2_v2",
 *     },
 *     identity: {
 *         type: "SystemAssigned",
 *     },
 *     tags: {
 *         Environment: "Production",
 *     },
 * });
 * export const clientCertificate = exampleKubernetesCluster.kubeConfigs.apply(kubeConfigs => kubeConfigs[0].clientCertificate);
 * export const kubeConfig = exampleKubernetesCluster.kubeConfigRaw;
 * ```
 *
 * ## API Providers
 *
 * <!-- This section is generated, changes will be overwritten -->
 * This resource uses the following Azure API Providers:
 *
 * * `Microsoft.ContainerService` - 2025-10-01
 *
 * ## Import
 *
 * Managed Kubernetes Clusters can be imported using the `resource id`, e.g.
 *
 * ```sh
 * $ pulumi import azure:containerservice/kubernetesCluster:KubernetesCluster cluster1 /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.ContainerService/managedClusters/cluster1
 * ```
 */
export declare class KubernetesCluster extends pulumi.CustomResource {
    /**
     * Get an existing KubernetesCluster resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: KubernetesClusterState, opts?: pulumi.CustomResourceOptions): KubernetesCluster;
    /**
     * Returns true if the given object is an instance of KubernetesCluster.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is KubernetesCluster;
    /**
     * A `aciConnectorLinux` block as defined below. For more details, please visit [Create and configure an AKS cluster to use virtual nodes](https://docs.microsoft.com/azure/aks/virtual-nodes-portal).
     */
    readonly aciConnectorLinux: pulumi.Output<outputs.containerservice.KubernetesClusterAciConnectorLinux | undefined>;
    /**
     * Specifies whether the AI Toolchain Operator should be enabled for the Cluster. Defaults to `false`.
     */
    readonly aiToolchainOperatorEnabled: pulumi.Output<boolean | undefined>;
    /**
     * An `apiServerAccessProfile` block as defined below.
     */
    readonly apiServerAccessProfile: pulumi.Output<outputs.containerservice.KubernetesClusterApiServerAccessProfile | undefined>;
    /**
     * A `autoScalerProfile` block as defined below.
     */
    readonly autoScalerProfile: pulumi.Output<outputs.containerservice.KubernetesClusterAutoScalerProfile>;
    /**
     * The upgrade channel for this Kubernetes Cluster. Possible values are `patch`, `rapid`, `node-image` and `stable`. Omitting this field sets this value to `none`.
     *
     * !> **Note:** Cluster Auto-Upgrade will update the Kubernetes Cluster (and its Node Pools) to the latest GA version of Kubernetes automatically - please [see the Azure documentation for more information](https://docs.microsoft.com/azure/aks/upgrade-cluster#set-auto-upgrade-channel).
     *
     * > **Note:** Cluster Auto-Upgrade only updates to GA versions of Kubernetes and will not update to Preview versions.
     */
    readonly automaticUpgradeChannel: pulumi.Output<string | undefined>;
    /**
     * A `azureActiveDirectoryRoleBasedAccessControl` block as defined below.
     */
    readonly azureActiveDirectoryRoleBasedAccessControl: pulumi.Output<outputs.containerservice.KubernetesClusterAzureActiveDirectoryRoleBasedAccessControl | undefined>;
    /**
     * Should the Azure Policy Add-On be enabled? For more details please visit [Understand Azure Policy for Azure Kubernetes Service](https://docs.microsoft.com/en-ie/azure/governance/policy/concepts/rego-for-aks)
     */
    readonly azurePolicyEnabled: pulumi.Output<boolean | undefined>;
    /**
     * A `bootstrapProfile` block as defined below.
     */
    readonly bootstrapProfile: pulumi.Output<outputs.containerservice.KubernetesClusterBootstrapProfile>;
    /**
     * A `confidentialComputing` block as defined below. For more details please [the documentation](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-overview)
     */
    readonly confidentialComputing: pulumi.Output<outputs.containerservice.KubernetesClusterConfidentialComputing | undefined>;
    /**
     * Should cost analysis be enabled for this Kubernetes Cluster? Defaults to `false`. The `skuTier` must be set to `Standard` or `Premium` to enable this feature. Enabling this will add Kubernetes Namespace and Deployment details to the Cost Analysis views in the Azure portal.
     */
    readonly costAnalysisEnabled: pulumi.Output<boolean | undefined>;
    /**
     * The current version running on the Azure Kubernetes Managed Cluster.
     */
    readonly currentKubernetesVersion: pulumi.Output<string>;
    /**
     * A list of up to 10 base64 encoded CA certificates that will be added to the trust store on nodes.
     */
    readonly customCaTrustCertificatesBase64s: pulumi.Output<string[] | undefined>;
    /**
     * Specifies configuration for "System" mode node pool. A `defaultNodePool` block as defined below.
     */
    readonly defaultNodePool: pulumi.Output<outputs.containerservice.KubernetesClusterDefaultNodePool>;
    /**
     * The ID of the Disk Encryption Set which should be used for the Nodes and Volumes. More information [can be found in the documentation](https://docs.microsoft.com/azure/aks/azure-disk-customer-managed-keys). Changing this forces a new resource to be created.
     */
    readonly diskEncryptionSetId: pulumi.Output<string | undefined>;
    /**
     * DNS prefix specified when creating the managed cluster. Possible values must begin and end with a letter or number, contain only letters, numbers, and hyphens and be between 1 and 54 characters in length. Changing this forces a new resource to be created.
     */
    readonly dnsPrefix: pulumi.Output<string | undefined>;
    /**
     * Specifies the DNS prefix to use with private clusters. Changing this forces a new resource to be created.
     *
     * > **Note:** You must define either a `dnsPrefix` or a `dnsPrefixPrivateCluster` field.
     *
     * In addition, one of either `identity` or `servicePrincipal` blocks must be specified.
     */
    readonly dnsPrefixPrivateCluster: pulumi.Output<string | undefined>;
    /**
     * Specifies the Extended Zone (formerly called Edge Zone) within the Azure Region where this Managed Kubernetes Cluster should exist. Changing this forces a new resource to be created.
     */
    readonly edgeZone: pulumi.Output<string | undefined>;
    /**
     * The FQDN of the Azure Kubernetes Managed Cluster.
     */
    readonly fqdn: pulumi.Output<string>;
    /**
     * Should HTTP Application Routing be enabled?
     *
     * > **Note:** At this time HTTP Application Routing is not supported in Azure China or Azure US Government.
     */
    readonly httpApplicationRoutingEnabled: pulumi.Output<boolean | undefined>;
    /**
     * The Zone Name of the HTTP Application Routing.
     */
    readonly httpApplicationRoutingZoneName: pulumi.Output<string>;
    /**
     * A `httpProxyConfig` block as defined below.
     */
    readonly httpProxyConfig: pulumi.Output<outputs.containerservice.KubernetesClusterHttpProxyConfig | undefined>;
    /**
     * An `identity` block as defined below. One of either `identity` or `servicePrincipal` must be specified.
     *
     * !> **Note:** A migration scenario from `servicePrincipal` to `identity` is supported. When upgrading `servicePrincipal` to `identity`, your cluster's control plane and addon pods will switch to use managed identity, but the kubelets will keep using your configured `servicePrincipal` until you upgrade your Node Pool.
     */
    readonly identity: pulumi.Output<outputs.containerservice.KubernetesClusterIdentity | undefined>;
    /**
     * Specifies whether Image Cleaner is enabled.
     */
    readonly imageCleanerEnabled: pulumi.Output<boolean | undefined>;
    /**
     * Specifies the interval in hours when images should be cleaned up.
     */
    readonly imageCleanerIntervalHours: pulumi.Output<number | undefined>;
    /**
     * A `ingressApplicationGateway` block as defined below.
     *
     * > **Note:** Since the Application Gateway is deployed inside a Virtual Network, users (and Service Principals) that are operating the Application Gateway must have the `Microsoft.Network/virtualNetworks/subnets/join/action` permission on the Virtual Network or Subnet. For more details, please visit [Virtual Network Permission](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#virtual-network-permission).
     */
    readonly ingressApplicationGateway: pulumi.Output<outputs.containerservice.KubernetesClusterIngressApplicationGateway | undefined>;
    /**
     * A `keyManagementService` block as defined below. For more details, please visit [Key Management Service (KMS) etcd encryption to an AKS cluster](https://learn.microsoft.com/en-us/azure/aks/use-kms-etcd-encryption).
     */
    readonly keyManagementService: pulumi.Output<outputs.containerservice.KubernetesClusterKeyManagementService | undefined>;
    /**
     * A `keyVaultSecretsProvider` block as defined below. For more details, please visit [Azure Keyvault Secrets Provider for AKS](https://docs.microsoft.com/azure/aks/csi-secrets-store-driver).
     */
    readonly keyVaultSecretsProvider: pulumi.Output<outputs.containerservice.KubernetesClusterKeyVaultSecretsProvider | undefined>;
    /**
     * Raw Kubernetes config for the admin account to be used by [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/) and other compatible tools. This is only available when Role Based Access Control with Azure Active Directory is enabled and local accounts enabled.
     */
    readonly kubeAdminConfigRaw: pulumi.Output<string>;
    /**
     * A `kubeAdminConfig` block as defined below. This is only available when Role Based Access Control with Azure Active Directory is enabled and local accounts enabled.
     */
    readonly kubeAdminConfigs: pulumi.Output<outputs.containerservice.KubernetesClusterKubeAdminConfig[]>;
    /**
     * Raw Kubernetes config to be used by [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/) and other compatible tools.
     */
    readonly kubeConfigRaw: pulumi.Output<string>;
    /**
     * A `kubeConfig` block as defined below.
     */
    readonly kubeConfigs: pulumi.Output<outputs.containerservice.KubernetesClusterKubeConfig[]>;
    /**
     * A `kubeletIdentity` block as defined below.
     */
    readonly kubeletIdentity: pulumi.Output<outputs.containerservice.KubernetesClusterKubeletIdentity>;
    /**
     * Version of Kubernetes specified when creating the AKS managed cluster. If not specified, the latest recommended version will be used at provisioning time (but won't auto-upgrade). AKS does not require an exact patch version to be specified, minor version aliases such as `1.22` are also supported. - The minor version's latest GA patch is automatically chosen in that case. More details can be found in [the documentation](https://docs.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#alias-minor-version).
     *
     * > **Note:** Upgrading your cluster may take up to 10 minutes per node.
     */
    readonly kubernetesVersion: pulumi.Output<string>;
    /**
     * A `linuxProfile` block as defined below.
     */
    readonly linuxProfile: pulumi.Output<outputs.containerservice.KubernetesClusterLinuxProfile | undefined>;
    /**
     * If `true` local accounts will be disabled. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#disable-local-accounts) for more information.
     *
     * > **Note:** If `localAccountDisabled` is set to `true`, it is required to enable Kubernetes RBAC and AKS-managed Azure AD integration. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#azure-ad-authentication-overview) for more information.
     */
    readonly localAccountDisabled: pulumi.Output<boolean | undefined>;
    /**
     * The location where the Managed Kubernetes Cluster should be created. Changing this forces a new resource to be created.
     */
    readonly location: pulumi.Output<string>;
    /**
     * A `maintenanceWindow` block as defined below.
     */
    readonly maintenanceWindow: pulumi.Output<outputs.containerservice.KubernetesClusterMaintenanceWindow | undefined>;
    /**
     * A `maintenanceWindowAutoUpgrade` block as defined below.
     */
    readonly maintenanceWindowAutoUpgrade: pulumi.Output<outputs.containerservice.KubernetesClusterMaintenanceWindowAutoUpgrade | undefined>;
    /**
     * A `maintenanceWindowNodeOs` block as defined below.
     */
    readonly maintenanceWindowNodeOs: pulumi.Output<outputs.containerservice.KubernetesClusterMaintenanceWindowNodeOs | undefined>;
    /**
     * A `microsoftDefender` block as defined below.
     */
    readonly microsoftDefender: pulumi.Output<outputs.containerservice.KubernetesClusterMicrosoftDefender | undefined>;
    /**
     * Specifies a Prometheus add-on profile for the Kubernetes Cluster. A `monitorMetrics` block as defined below.
     *
     * > **Note:** If deploying Managed Prometheus, the `monitorMetrics` properties are required to configure the cluster for metrics collection. If no value is needed, set properties to `null`.
     */
    readonly monitorMetrics: pulumi.Output<outputs.containerservice.KubernetesClusterMonitorMetrics | undefined>;
    /**
     * The name of the Managed Kubernetes Cluster to create. Changing this forces a new resource to be created.
     */
    readonly name: pulumi.Output<string>;
    /**
     * A `networkProfile` block as defined below. Changing this forces a new resource to be created.
     *
     * > **Note:** If `networkProfile` is not defined, `kubenet` profile will be used by default.
     */
    readonly networkProfile: pulumi.Output<outputs.containerservice.KubernetesClusterNetworkProfile>;
    /**
     * The upgrade channel for this Kubernetes Cluster Nodes' OS Image. Possible values are `Unmanaged`, `SecurityPatch`, `NodeImage` and `None`. Defaults to `NodeImage`.
     *
     * > **Note:** `nodeOsUpgradeChannel` must be set to `NodeImage` if `automaticUpgradeChannel` has been set to `node-image`
     */
    readonly nodeOsUpgradeChannel: pulumi.Output<string | undefined>;
    /**
     * A `nodeProvisioningProfile` block as defined below.
     */
    readonly nodeProvisioningProfile: pulumi.Output<outputs.containerservice.KubernetesClusterNodeProvisioningProfile>;
    /**
     * The name of the Resource Group where the Kubernetes Nodes should exist. Changing this forces a new resource to be created.
     *
     * > **Note:** Azure requires that a new, non-existent Resource Group is used, as otherwise, the provisioning of the Kubernetes Service will fail.
     */
    readonly nodeResourceGroup: pulumi.Output<string>;
    /**
     * The ID of the Resource Group containing the resources for this Managed Kubernetes Cluster.
     */
    readonly nodeResourceGroupId: pulumi.Output<string>;
    /**
     * Whether to enable the [OIDC issuer feature](https://learn.microsoft.com/en-gb/azure/aks/use-oidc-issuer).
     *
     * !> **Note:** Once enabled, this feature cannot be disabled, doing so forces a new resource to be created.
     */
    readonly oidcIssuerEnabled: pulumi.Output<boolean>;
    /**
     * The OIDC issuer URL that is associated with the cluster.
     */
    readonly oidcIssuerUrl: pulumi.Output<string>;
    /**
     * A `omsAgent` block as defined below.
     */
    readonly omsAgent: pulumi.Output<outputs.containerservice.KubernetesClusterOmsAgent | undefined>;
    /**
     * Is Open Service Mesh enabled? For more details, please visit [Open Service Mesh for AKS](https://docs.microsoft.com/azure/aks/open-service-mesh-about).
     */
    readonly openServiceMeshEnabled: pulumi.Output<boolean | undefined>;
    /**
     * The FQDN for the Azure Portal resources when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster.
     */
    readonly portalFqdn: pulumi.Output<string>;
    /**
     * Should this Kubernetes Cluster have its API server only exposed on internal IP addresses? This provides a Private IP Address for the Kubernetes API on the Virtual Network where the Kubernetes Cluster is located. Defaults to `false`. Changing this forces a new resource to be created.
     */
    readonly privateClusterEnabled: pulumi.Output<boolean | undefined>;
    /**
     * Specifies whether a Public FQDN for this Private Cluster should be added. Defaults to `false`.
     *
     * > **Note:** If you use BYO DNS Zone, the AKS cluster should either use a User Assigned Identity or a service principal (which is deprecated) with the `Private DNS Zone Contributor` role and access to this Private DNS Zone. If `UserAssigned` identity is used - to prevent improper resource order destruction - the cluster should depend on the role assignment, like in this example:
     *
     * ```typescript
     * import * as pulumi from "@pulumi/pulumi";
     * import * as azure from "@pulumi/azure";
     *
     * const example = new azure.core.ResourceGroup("example", {
     *     name: "example",
     *     location: "West Europe",
     * });
     * const exampleZone = new azure.privatedns.Zone("example", {
     *     name: "privatelink.eastus2.azmk8s.io",
     *     resourceGroupName: example.name,
     * });
     * const exampleUserAssignedIdentity = new azure.authorization.UserAssignedIdentity("example", {
     *     name: "aks-example-identity",
     *     resourceGroupName: example.name,
     *     location: example.location,
     * });
     * const exampleAssignment = new azure.authorization.Assignment("example", {
     *     scope: exampleZone.id,
     *     roleDefinitionName: "Private DNS Zone Contributor",
     *     principalId: exampleUserAssignedIdentity.principalId,
     * });
     * const exampleKubernetesCluster = new azure.containerservice.KubernetesCluster("example", {
     *     name: "aksexamplewithprivatednszone1",
     *     location: example.location,
     *     resourceGroupName: example.name,
     *     dnsPrefix: "aksexamplednsprefix1",
     *     privateClusterEnabled: true,
     *     privateDnsZoneId: exampleZone.id,
     * }, {
     *     dependsOn: [exampleAssignment],
     * });
     * ```
     */
    readonly privateClusterPublicFqdnEnabled: pulumi.Output<boolean | undefined>;
    /**
     * Either the ID of Private DNS Zone which should be delegated to this Cluster, `System` to have AKS manage this or `None`. In case of `None` you will need to bring your own DNS server and set up resolving, otherwise, the cluster will have issues after provisioning. Changing this forces a new resource to be created.
     */
    readonly privateDnsZoneId: pulumi.Output<string>;
    /**
     * The FQDN for the Kubernetes Cluster when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster.
     */
    readonly privateFqdn: pulumi.Output<string>;
    /**
     * Specifies the Resource Group where the Managed Kubernetes Cluster should exist. Changing this forces a new resource to be created.
     */
    readonly resourceGroupName: pulumi.Output<string>;
    /**
     * Whether Role Based Access Control for the Kubernetes Cluster should be enabled. Defaults to `true`. Changing this forces a new resource to be created.
     */
    readonly roleBasedAccessControlEnabled: pulumi.Output<boolean | undefined>;
    /**
     * Whether to enable run command for the cluster or not. Defaults to `true`.
     */
    readonly runCommandEnabled: pulumi.Output<boolean | undefined>;
    /**
     * A `serviceMeshProfile` block as defined below.
     */
    readonly serviceMeshProfile: pulumi.Output<outputs.containerservice.KubernetesClusterServiceMeshProfile | undefined>;
    /**
     * A `servicePrincipal` block as documented below. One of either `identity` or `servicePrincipal` must be specified.
     *
     * !> **Note:** A migration scenario from `servicePrincipal` to `identity` is supported. When upgrading `servicePrincipal` to `identity`, your cluster's control plane and addon pods will switch to use managed identity, but the kubelets will keep using your configured `servicePrincipal` until you upgrade your Node Pool.
     */
    readonly servicePrincipal: pulumi.Output<outputs.containerservice.KubernetesClusterServicePrincipal | undefined>;
    /**
     * The SKU Tier that should be used for this Kubernetes Cluster. Possible values are `Free`, `Standard` (which includes the Uptime SLA) and `Premium`. Defaults to `Free`.
     *
     * > **Note:** Whilst the AKS API previously supported the `Paid` SKU - the AKS API introduced a breaking change in API Version `2023-02-01` (used in v3.51.0 and later) where the value `Paid` must now be set to `Standard`.
     */
    readonly skuTier: pulumi.Output<string | undefined>;
    /**
     * A `storageProfile` block as defined below.
     */
    readonly storageProfile: pulumi.Output<outputs.containerservice.KubernetesClusterStorageProfile | undefined>;
    /**
     * Specifies the support plan which should be used for this Kubernetes Cluster. Possible values are `KubernetesOfficial` and `AKSLongTermSupport`. Defaults to `KubernetesOfficial`.
     */
    readonly supportPlan: pulumi.Output<string | undefined>;
    /**
     * A mapping of tags to assign to the resource.
     */
    readonly tags: pulumi.Output<{
        [key: string]: string;
    } | undefined>;
    /**
     * A `upgradeOverride` block as defined below.
     */
    readonly upgradeOverride: pulumi.Output<outputs.containerservice.KubernetesClusterUpgradeOverride | undefined>;
    /**
     * A `webAppRouting` block as defined below.
     */
    readonly webAppRouting: pulumi.Output<outputs.containerservice.KubernetesClusterWebAppRouting | undefined>;
    /**
     * A `windowsProfile` block as defined below.
     */
    readonly windowsProfile: pulumi.Output<outputs.containerservice.KubernetesClusterWindowsProfile>;
    /**
     * A `workloadAutoscalerProfile` block defined below.
     */
    readonly workloadAutoscalerProfile: pulumi.Output<outputs.containerservice.KubernetesClusterWorkloadAutoscalerProfile | undefined>;
    /**
     * Specifies whether Azure AD Workload Identity should be enabled for the Cluster. Defaults to `false`.
     *
     * > **Note:** To enable Azure AD Workload Identity `oidcIssuerEnabled` must be set to `true`.
     *
     * > **Note:** Enabling this option will allocate Workload Identity resources to the `kube-system` namespace in Kubernetes. If you wish to customize the deployment of Workload Identity, you can refer to [the documentation on Azure AD Workload Identity.](https://azure.github.io/azure-workload-identity/docs/installation/mutating-admission-webhook.html) The documentation provides guidance on how to install the mutating admission webhook, which allows for the customization of Workload Identity deployment.
     */
    readonly workloadIdentityEnabled: pulumi.Output<boolean | undefined>;
    /**
     * Create a KubernetesCluster resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: KubernetesClusterArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering KubernetesCluster resources.
 */
export interface KubernetesClusterState {
    /**
     * A `aciConnectorLinux` block as defined below. For more details, please visit [Create and configure an AKS cluster to use virtual nodes](https://docs.microsoft.com/azure/aks/virtual-nodes-portal).
     */
    aciConnectorLinux?: pulumi.Input<inputs.containerservice.KubernetesClusterAciConnectorLinux>;
    /**
     * Specifies whether the AI Toolchain Operator should be enabled for the Cluster. Defaults to `false`.
     */
    aiToolchainOperatorEnabled?: pulumi.Input<boolean>;
    /**
     * An `apiServerAccessProfile` block as defined below.
     */
    apiServerAccessProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterApiServerAccessProfile>;
    /**
     * A `autoScalerProfile` block as defined below.
     */
    autoScalerProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterAutoScalerProfile>;
    /**
     * The upgrade channel for this Kubernetes Cluster. Possible values are `patch`, `rapid`, `node-image` and `stable`. Omitting this field sets this value to `none`.
     *
     * !> **Note:** Cluster Auto-Upgrade will update the Kubernetes Cluster (and its Node Pools) to the latest GA version of Kubernetes automatically - please [see the Azure documentation for more information](https://docs.microsoft.com/azure/aks/upgrade-cluster#set-auto-upgrade-channel).
     *
     * > **Note:** Cluster Auto-Upgrade only updates to GA versions of Kubernetes and will not update to Preview versions.
     */
    automaticUpgradeChannel?: pulumi.Input<string>;
    /**
     * A `azureActiveDirectoryRoleBasedAccessControl` block as defined below.
     */
    azureActiveDirectoryRoleBasedAccessControl?: pulumi.Input<inputs.containerservice.KubernetesClusterAzureActiveDirectoryRoleBasedAccessControl>;
    /**
     * Should the Azure Policy Add-On be enabled? For more details please visit [Understand Azure Policy for Azure Kubernetes Service](https://docs.microsoft.com/en-ie/azure/governance/policy/concepts/rego-for-aks)
     */
    azurePolicyEnabled?: pulumi.Input<boolean>;
    /**
     * A `bootstrapProfile` block as defined below.
     */
    bootstrapProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterBootstrapProfile>;
    /**
     * A `confidentialComputing` block as defined below. For more details please [the documentation](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-overview)
     */
    confidentialComputing?: pulumi.Input<inputs.containerservice.KubernetesClusterConfidentialComputing>;
    /**
     * Should cost analysis be enabled for this Kubernetes Cluster? Defaults to `false`. The `skuTier` must be set to `Standard` or `Premium` to enable this feature. Enabling this will add Kubernetes Namespace and Deployment details to the Cost Analysis views in the Azure portal.
     */
    costAnalysisEnabled?: pulumi.Input<boolean>;
    /**
     * The current version running on the Azure Kubernetes Managed Cluster.
     */
    currentKubernetesVersion?: pulumi.Input<string>;
    /**
     * A list of up to 10 base64 encoded CA certificates that will be added to the trust store on nodes.
     */
    customCaTrustCertificatesBase64s?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies configuration for "System" mode node pool. A `defaultNodePool` block as defined below.
     */
    defaultNodePool?: pulumi.Input<inputs.containerservice.KubernetesClusterDefaultNodePool>;
    /**
     * The ID of the Disk Encryption Set which should be used for the Nodes and Volumes. More information [can be found in the documentation](https://docs.microsoft.com/azure/aks/azure-disk-customer-managed-keys). Changing this forces a new resource to be created.
     */
    diskEncryptionSetId?: pulumi.Input<string>;
    /**
     * DNS prefix specified when creating the managed cluster. Possible values must begin and end with a letter or number, contain only letters, numbers, and hyphens and be between 1 and 54 characters in length. Changing this forces a new resource to be created.
     */
    dnsPrefix?: pulumi.Input<string>;
    /**
     * Specifies the DNS prefix to use with private clusters. Changing this forces a new resource to be created.
     *
     * > **Note:** You must define either a `dnsPrefix` or a `dnsPrefixPrivateCluster` field.
     *
     * In addition, one of either `identity` or `servicePrincipal` blocks must be specified.
     */
    dnsPrefixPrivateCluster?: pulumi.Input<string>;
    /**
     * Specifies the Extended Zone (formerly called Edge Zone) within the Azure Region where this Managed Kubernetes Cluster should exist. Changing this forces a new resource to be created.
     */
    edgeZone?: pulumi.Input<string>;
    /**
     * The FQDN of the Azure Kubernetes Managed Cluster.
     */
    fqdn?: pulumi.Input<string>;
    /**
     * Should HTTP Application Routing be enabled?
     *
     * > **Note:** At this time HTTP Application Routing is not supported in Azure China or Azure US Government.
     */
    httpApplicationRoutingEnabled?: pulumi.Input<boolean>;
    /**
     * The Zone Name of the HTTP Application Routing.
     */
    httpApplicationRoutingZoneName?: pulumi.Input<string>;
    /**
     * A `httpProxyConfig` block as defined below.
     */
    httpProxyConfig?: pulumi.Input<inputs.containerservice.KubernetesClusterHttpProxyConfig>;
    /**
     * An `identity` block as defined below. One of either `identity` or `servicePrincipal` must be specified.
     *
     * !> **Note:** A migration scenario from `servicePrincipal` to `identity` is supported. When upgrading `servicePrincipal` to `identity`, your cluster's control plane and addon pods will switch to use managed identity, but the kubelets will keep using your configured `servicePrincipal` until you upgrade your Node Pool.
     */
    identity?: pulumi.Input<inputs.containerservice.KubernetesClusterIdentity>;
    /**
     * Specifies whether Image Cleaner is enabled.
     */
    imageCleanerEnabled?: pulumi.Input<boolean>;
    /**
     * Specifies the interval in hours when images should be cleaned up.
     */
    imageCleanerIntervalHours?: pulumi.Input<number>;
    /**
     * A `ingressApplicationGateway` block as defined below.
     *
     * > **Note:** Since the Application Gateway is deployed inside a Virtual Network, users (and Service Principals) that are operating the Application Gateway must have the `Microsoft.Network/virtualNetworks/subnets/join/action` permission on the Virtual Network or Subnet. For more details, please visit [Virtual Network Permission](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#virtual-network-permission).
     */
    ingressApplicationGateway?: pulumi.Input<inputs.containerservice.KubernetesClusterIngressApplicationGateway>;
    /**
     * A `keyManagementService` block as defined below. For more details, please visit [Key Management Service (KMS) etcd encryption to an AKS cluster](https://learn.microsoft.com/en-us/azure/aks/use-kms-etcd-encryption).
     */
    keyManagementService?: pulumi.Input<inputs.containerservice.KubernetesClusterKeyManagementService>;
    /**
     * A `keyVaultSecretsProvider` block as defined below. For more details, please visit [Azure Keyvault Secrets Provider for AKS](https://docs.microsoft.com/azure/aks/csi-secrets-store-driver).
     */
    keyVaultSecretsProvider?: pulumi.Input<inputs.containerservice.KubernetesClusterKeyVaultSecretsProvider>;
    /**
     * Raw Kubernetes config for the admin account to be used by [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/) and other compatible tools. This is only available when Role Based Access Control with Azure Active Directory is enabled and local accounts enabled.
     */
    kubeAdminConfigRaw?: pulumi.Input<string>;
    /**
     * A `kubeAdminConfig` block as defined below. This is only available when Role Based Access Control with Azure Active Directory is enabled and local accounts enabled.
     */
    kubeAdminConfigs?: pulumi.Input<pulumi.Input<inputs.containerservice.KubernetesClusterKubeAdminConfig>[]>;
    /**
     * Raw Kubernetes config to be used by [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/) and other compatible tools.
     */
    kubeConfigRaw?: pulumi.Input<string>;
    /**
     * A `kubeConfig` block as defined below.
     */
    kubeConfigs?: pulumi.Input<pulumi.Input<inputs.containerservice.KubernetesClusterKubeConfig>[]>;
    /**
     * A `kubeletIdentity` block as defined below.
     */
    kubeletIdentity?: pulumi.Input<inputs.containerservice.KubernetesClusterKubeletIdentity>;
    /**
     * Version of Kubernetes specified when creating the AKS managed cluster. If not specified, the latest recommended version will be used at provisioning time (but won't auto-upgrade). AKS does not require an exact patch version to be specified, minor version aliases such as `1.22` are also supported. - The minor version's latest GA patch is automatically chosen in that case. More details can be found in [the documentation](https://docs.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#alias-minor-version).
     *
     * > **Note:** Upgrading your cluster may take up to 10 minutes per node.
     */
    kubernetesVersion?: pulumi.Input<string>;
    /**
     * A `linuxProfile` block as defined below.
     */
    linuxProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterLinuxProfile>;
    /**
     * If `true` local accounts will be disabled. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#disable-local-accounts) for more information.
     *
     * > **Note:** If `localAccountDisabled` is set to `true`, it is required to enable Kubernetes RBAC and AKS-managed Azure AD integration. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#azure-ad-authentication-overview) for more information.
     */
    localAccountDisabled?: pulumi.Input<boolean>;
    /**
     * The location where the Managed Kubernetes Cluster should be created. Changing this forces a new resource to be created.
     */
    location?: pulumi.Input<string>;
    /**
     * A `maintenanceWindow` block as defined below.
     */
    maintenanceWindow?: pulumi.Input<inputs.containerservice.KubernetesClusterMaintenanceWindow>;
    /**
     * A `maintenanceWindowAutoUpgrade` block as defined below.
     */
    maintenanceWindowAutoUpgrade?: pulumi.Input<inputs.containerservice.KubernetesClusterMaintenanceWindowAutoUpgrade>;
    /**
     * A `maintenanceWindowNodeOs` block as defined below.
     */
    maintenanceWindowNodeOs?: pulumi.Input<inputs.containerservice.KubernetesClusterMaintenanceWindowNodeOs>;
    /**
     * A `microsoftDefender` block as defined below.
     */
    microsoftDefender?: pulumi.Input<inputs.containerservice.KubernetesClusterMicrosoftDefender>;
    /**
     * Specifies a Prometheus add-on profile for the Kubernetes Cluster. A `monitorMetrics` block as defined below.
     *
     * > **Note:** If deploying Managed Prometheus, the `monitorMetrics` properties are required to configure the cluster for metrics collection. If no value is needed, set properties to `null`.
     */
    monitorMetrics?: pulumi.Input<inputs.containerservice.KubernetesClusterMonitorMetrics>;
    /**
     * The name of the Managed Kubernetes Cluster to create. Changing this forces a new resource to be created.
     */
    name?: pulumi.Input<string>;
    /**
     * A `networkProfile` block as defined below. Changing this forces a new resource to be created.
     *
     * > **Note:** If `networkProfile` is not defined, `kubenet` profile will be used by default.
     */
    networkProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterNetworkProfile>;
    /**
     * The upgrade channel for this Kubernetes Cluster Nodes' OS Image. Possible values are `Unmanaged`, `SecurityPatch`, `NodeImage` and `None`. Defaults to `NodeImage`.
     *
     * > **Note:** `nodeOsUpgradeChannel` must be set to `NodeImage` if `automaticUpgradeChannel` has been set to `node-image`
     */
    nodeOsUpgradeChannel?: pulumi.Input<string>;
    /**
     * A `nodeProvisioningProfile` block as defined below.
     */
    nodeProvisioningProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterNodeProvisioningProfile>;
    /**
     * The name of the Resource Group where the Kubernetes Nodes should exist. Changing this forces a new resource to be created.
     *
     * > **Note:** Azure requires that a new, non-existent Resource Group is used, as otherwise, the provisioning of the Kubernetes Service will fail.
     */
    nodeResourceGroup?: pulumi.Input<string>;
    /**
     * The ID of the Resource Group containing the resources for this Managed Kubernetes Cluster.
     */
    nodeResourceGroupId?: pulumi.Input<string>;
    /**
     * Whether to enable the [OIDC issuer feature](https://learn.microsoft.com/en-gb/azure/aks/use-oidc-issuer).
     *
     * !> **Note:** Once enabled, this feature cannot be disabled, doing so forces a new resource to be created.
     */
    oidcIssuerEnabled?: pulumi.Input<boolean>;
    /**
     * The OIDC issuer URL that is associated with the cluster.
     */
    oidcIssuerUrl?: pulumi.Input<string>;
    /**
     * A `omsAgent` block as defined below.
     */
    omsAgent?: pulumi.Input<inputs.containerservice.KubernetesClusterOmsAgent>;
    /**
     * Is Open Service Mesh enabled? For more details, please visit [Open Service Mesh for AKS](https://docs.microsoft.com/azure/aks/open-service-mesh-about).
     */
    openServiceMeshEnabled?: pulumi.Input<boolean>;
    /**
     * The FQDN for the Azure Portal resources when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster.
     */
    portalFqdn?: pulumi.Input<string>;
    /**
     * Should this Kubernetes Cluster have its API server only exposed on internal IP addresses? This provides a Private IP Address for the Kubernetes API on the Virtual Network where the Kubernetes Cluster is located. Defaults to `false`. Changing this forces a new resource to be created.
     */
    privateClusterEnabled?: pulumi.Input<boolean>;
    /**
     * Specifies whether a Public FQDN for this Private Cluster should be added. Defaults to `false`.
     *
     * > **Note:** If you use BYO DNS Zone, the AKS cluster should either use a User Assigned Identity or a service principal (which is deprecated) with the `Private DNS Zone Contributor` role and access to this Private DNS Zone. If `UserAssigned` identity is used - to prevent improper resource order destruction - the cluster should depend on the role assignment, like in this example:
     *
     * ```typescript
     * import * as pulumi from "@pulumi/pulumi";
     * import * as azure from "@pulumi/azure";
     *
     * const example = new azure.core.ResourceGroup("example", {
     *     name: "example",
     *     location: "West Europe",
     * });
     * const exampleZone = new azure.privatedns.Zone("example", {
     *     name: "privatelink.eastus2.azmk8s.io",
     *     resourceGroupName: example.name,
     * });
     * const exampleUserAssignedIdentity = new azure.authorization.UserAssignedIdentity("example", {
     *     name: "aks-example-identity",
     *     resourceGroupName: example.name,
     *     location: example.location,
     * });
     * const exampleAssignment = new azure.authorization.Assignment("example", {
     *     scope: exampleZone.id,
     *     roleDefinitionName: "Private DNS Zone Contributor",
     *     principalId: exampleUserAssignedIdentity.principalId,
     * });
     * const exampleKubernetesCluster = new azure.containerservice.KubernetesCluster("example", {
     *     name: "aksexamplewithprivatednszone1",
     *     location: example.location,
     *     resourceGroupName: example.name,
     *     dnsPrefix: "aksexamplednsprefix1",
     *     privateClusterEnabled: true,
     *     privateDnsZoneId: exampleZone.id,
     * }, {
     *     dependsOn: [exampleAssignment],
     * });
     * ```
     */
    privateClusterPublicFqdnEnabled?: pulumi.Input<boolean>;
    /**
     * Either the ID of Private DNS Zone which should be delegated to this Cluster, `System` to have AKS manage this or `None`. In case of `None` you will need to bring your own DNS server and set up resolving, otherwise, the cluster will have issues after provisioning. Changing this forces a new resource to be created.
     */
    privateDnsZoneId?: pulumi.Input<string>;
    /**
     * The FQDN for the Kubernetes Cluster when private link has been enabled, which is only resolvable inside the Virtual Network used by the Kubernetes Cluster.
     */
    privateFqdn?: pulumi.Input<string>;
    /**
     * Specifies the Resource Group where the Managed Kubernetes Cluster should exist. Changing this forces a new resource to be created.
     */
    resourceGroupName?: pulumi.Input<string>;
    /**
     * Whether Role Based Access Control for the Kubernetes Cluster should be enabled. Defaults to `true`. Changing this forces a new resource to be created.
     */
    roleBasedAccessControlEnabled?: pulumi.Input<boolean>;
    /**
     * Whether to enable run command for the cluster or not. Defaults to `true`.
     */
    runCommandEnabled?: pulumi.Input<boolean>;
    /**
     * A `serviceMeshProfile` block as defined below.
     */
    serviceMeshProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterServiceMeshProfile>;
    /**
     * A `servicePrincipal` block as documented below. One of either `identity` or `servicePrincipal` must be specified.
     *
     * !> **Note:** A migration scenario from `servicePrincipal` to `identity` is supported. When upgrading `servicePrincipal` to `identity`, your cluster's control plane and addon pods will switch to use managed identity, but the kubelets will keep using your configured `servicePrincipal` until you upgrade your Node Pool.
     */
    servicePrincipal?: pulumi.Input<inputs.containerservice.KubernetesClusterServicePrincipal>;
    /**
     * The SKU Tier that should be used for this Kubernetes Cluster. Possible values are `Free`, `Standard` (which includes the Uptime SLA) and `Premium`. Defaults to `Free`.
     *
     * > **Note:** Whilst the AKS API previously supported the `Paid` SKU - the AKS API introduced a breaking change in API Version `2023-02-01` (used in v3.51.0 and later) where the value `Paid` must now be set to `Standard`.
     */
    skuTier?: pulumi.Input<string>;
    /**
     * A `storageProfile` block as defined below.
     */
    storageProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterStorageProfile>;
    /**
     * Specifies the support plan which should be used for this Kubernetes Cluster. Possible values are `KubernetesOfficial` and `AKSLongTermSupport`. Defaults to `KubernetesOfficial`.
     */
    supportPlan?: pulumi.Input<string>;
    /**
     * A mapping of tags to assign to the resource.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * A `upgradeOverride` block as defined below.
     */
    upgradeOverride?: pulumi.Input<inputs.containerservice.KubernetesClusterUpgradeOverride>;
    /**
     * A `webAppRouting` block as defined below.
     */
    webAppRouting?: pulumi.Input<inputs.containerservice.KubernetesClusterWebAppRouting>;
    /**
     * A `windowsProfile` block as defined below.
     */
    windowsProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterWindowsProfile>;
    /**
     * A `workloadAutoscalerProfile` block defined below.
     */
    workloadAutoscalerProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterWorkloadAutoscalerProfile>;
    /**
     * Specifies whether Azure AD Workload Identity should be enabled for the Cluster. Defaults to `false`.
     *
     * > **Note:** To enable Azure AD Workload Identity `oidcIssuerEnabled` must be set to `true`.
     *
     * > **Note:** Enabling this option will allocate Workload Identity resources to the `kube-system` namespace in Kubernetes. If you wish to customize the deployment of Workload Identity, you can refer to [the documentation on Azure AD Workload Identity.](https://azure.github.io/azure-workload-identity/docs/installation/mutating-admission-webhook.html) The documentation provides guidance on how to install the mutating admission webhook, which allows for the customization of Workload Identity deployment.
     */
    workloadIdentityEnabled?: pulumi.Input<boolean>;
}
/**
 * The set of arguments for constructing a KubernetesCluster resource.
 */
export interface KubernetesClusterArgs {
    /**
     * A `aciConnectorLinux` block as defined below. For more details, please visit [Create and configure an AKS cluster to use virtual nodes](https://docs.microsoft.com/azure/aks/virtual-nodes-portal).
     */
    aciConnectorLinux?: pulumi.Input<inputs.containerservice.KubernetesClusterAciConnectorLinux>;
    /**
     * Specifies whether the AI Toolchain Operator should be enabled for the Cluster. Defaults to `false`.
     */
    aiToolchainOperatorEnabled?: pulumi.Input<boolean>;
    /**
     * An `apiServerAccessProfile` block as defined below.
     */
    apiServerAccessProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterApiServerAccessProfile>;
    /**
     * A `autoScalerProfile` block as defined below.
     */
    autoScalerProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterAutoScalerProfile>;
    /**
     * The upgrade channel for this Kubernetes Cluster. Possible values are `patch`, `rapid`, `node-image` and `stable`. Omitting this field sets this value to `none`.
     *
     * !> **Note:** Cluster Auto-Upgrade will update the Kubernetes Cluster (and its Node Pools) to the latest GA version of Kubernetes automatically - please [see the Azure documentation for more information](https://docs.microsoft.com/azure/aks/upgrade-cluster#set-auto-upgrade-channel).
     *
     * > **Note:** Cluster Auto-Upgrade only updates to GA versions of Kubernetes and will not update to Preview versions.
     */
    automaticUpgradeChannel?: pulumi.Input<string>;
    /**
     * A `azureActiveDirectoryRoleBasedAccessControl` block as defined below.
     */
    azureActiveDirectoryRoleBasedAccessControl?: pulumi.Input<inputs.containerservice.KubernetesClusterAzureActiveDirectoryRoleBasedAccessControl>;
    /**
     * Should the Azure Policy Add-On be enabled? For more details please visit [Understand Azure Policy for Azure Kubernetes Service](https://docs.microsoft.com/en-ie/azure/governance/policy/concepts/rego-for-aks)
     */
    azurePolicyEnabled?: pulumi.Input<boolean>;
    /**
     * A `bootstrapProfile` block as defined below.
     */
    bootstrapProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterBootstrapProfile>;
    /**
     * A `confidentialComputing` block as defined below. For more details please [the documentation](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-overview)
     */
    confidentialComputing?: pulumi.Input<inputs.containerservice.KubernetesClusterConfidentialComputing>;
    /**
     * Should cost analysis be enabled for this Kubernetes Cluster? Defaults to `false`. The `skuTier` must be set to `Standard` or `Premium` to enable this feature. Enabling this will add Kubernetes Namespace and Deployment details to the Cost Analysis views in the Azure portal.
     */
    costAnalysisEnabled?: pulumi.Input<boolean>;
    /**
     * A list of up to 10 base64 encoded CA certificates that will be added to the trust store on nodes.
     */
    customCaTrustCertificatesBase64s?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies configuration for "System" mode node pool. A `defaultNodePool` block as defined below.
     */
    defaultNodePool: pulumi.Input<inputs.containerservice.KubernetesClusterDefaultNodePool>;
    /**
     * The ID of the Disk Encryption Set which should be used for the Nodes and Volumes. More information [can be found in the documentation](https://docs.microsoft.com/azure/aks/azure-disk-customer-managed-keys). Changing this forces a new resource to be created.
     */
    diskEncryptionSetId?: pulumi.Input<string>;
    /**
     * DNS prefix specified when creating the managed cluster. Possible values must begin and end with a letter or number, contain only letters, numbers, and hyphens and be between 1 and 54 characters in length. Changing this forces a new resource to be created.
     */
    dnsPrefix?: pulumi.Input<string>;
    /**
     * Specifies the DNS prefix to use with private clusters. Changing this forces a new resource to be created.
     *
     * > **Note:** You must define either a `dnsPrefix` or a `dnsPrefixPrivateCluster` field.
     *
     * In addition, one of either `identity` or `servicePrincipal` blocks must be specified.
     */
    dnsPrefixPrivateCluster?: pulumi.Input<string>;
    /**
     * Specifies the Extended Zone (formerly called Edge Zone) within the Azure Region where this Managed Kubernetes Cluster should exist. Changing this forces a new resource to be created.
     */
    edgeZone?: pulumi.Input<string>;
    /**
     * Should HTTP Application Routing be enabled?
     *
     * > **Note:** At this time HTTP Application Routing is not supported in Azure China or Azure US Government.
     */
    httpApplicationRoutingEnabled?: pulumi.Input<boolean>;
    /**
     * A `httpProxyConfig` block as defined below.
     */
    httpProxyConfig?: pulumi.Input<inputs.containerservice.KubernetesClusterHttpProxyConfig>;
    /**
     * An `identity` block as defined below. One of either `identity` or `servicePrincipal` must be specified.
     *
     * !> **Note:** A migration scenario from `servicePrincipal` to `identity` is supported. When upgrading `servicePrincipal` to `identity`, your cluster's control plane and addon pods will switch to use managed identity, but the kubelets will keep using your configured `servicePrincipal` until you upgrade your Node Pool.
     */
    identity?: pulumi.Input<inputs.containerservice.KubernetesClusterIdentity>;
    /**
     * Specifies whether Image Cleaner is enabled.
     */
    imageCleanerEnabled?: pulumi.Input<boolean>;
    /**
     * Specifies the interval in hours when images should be cleaned up.
     */
    imageCleanerIntervalHours?: pulumi.Input<number>;
    /**
     * A `ingressApplicationGateway` block as defined below.
     *
     * > **Note:** Since the Application Gateway is deployed inside a Virtual Network, users (and Service Principals) that are operating the Application Gateway must have the `Microsoft.Network/virtualNetworks/subnets/join/action` permission on the Virtual Network or Subnet. For more details, please visit [Virtual Network Permission](https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#virtual-network-permission).
     */
    ingressApplicationGateway?: pulumi.Input<inputs.containerservice.KubernetesClusterIngressApplicationGateway>;
    /**
     * A `keyManagementService` block as defined below. For more details, please visit [Key Management Service (KMS) etcd encryption to an AKS cluster](https://learn.microsoft.com/en-us/azure/aks/use-kms-etcd-encryption).
     */
    keyManagementService?: pulumi.Input<inputs.containerservice.KubernetesClusterKeyManagementService>;
    /**
     * A `keyVaultSecretsProvider` block as defined below. For more details, please visit [Azure Keyvault Secrets Provider for AKS](https://docs.microsoft.com/azure/aks/csi-secrets-store-driver).
     */
    keyVaultSecretsProvider?: pulumi.Input<inputs.containerservice.KubernetesClusterKeyVaultSecretsProvider>;
    /**
     * A `kubeletIdentity` block as defined below.
     */
    kubeletIdentity?: pulumi.Input<inputs.containerservice.KubernetesClusterKubeletIdentity>;
    /**
     * Version of Kubernetes specified when creating the AKS managed cluster. If not specified, the latest recommended version will be used at provisioning time (but won't auto-upgrade). AKS does not require an exact patch version to be specified, minor version aliases such as `1.22` are also supported. - The minor version's latest GA patch is automatically chosen in that case. More details can be found in [the documentation](https://docs.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#alias-minor-version).
     *
     * > **Note:** Upgrading your cluster may take up to 10 minutes per node.
     */
    kubernetesVersion?: pulumi.Input<string>;
    /**
     * A `linuxProfile` block as defined below.
     */
    linuxProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterLinuxProfile>;
    /**
     * If `true` local accounts will be disabled. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#disable-local-accounts) for more information.
     *
     * > **Note:** If `localAccountDisabled` is set to `true`, it is required to enable Kubernetes RBAC and AKS-managed Azure AD integration. See [the documentation](https://docs.microsoft.com/azure/aks/managed-aad#azure-ad-authentication-overview) for more information.
     */
    localAccountDisabled?: pulumi.Input<boolean>;
    /**
     * The location where the Managed Kubernetes Cluster should be created. Changing this forces a new resource to be created.
     */
    location?: pulumi.Input<string>;
    /**
     * A `maintenanceWindow` block as defined below.
     */
    maintenanceWindow?: pulumi.Input<inputs.containerservice.KubernetesClusterMaintenanceWindow>;
    /**
     * A `maintenanceWindowAutoUpgrade` block as defined below.
     */
    maintenanceWindowAutoUpgrade?: pulumi.Input<inputs.containerservice.KubernetesClusterMaintenanceWindowAutoUpgrade>;
    /**
     * A `maintenanceWindowNodeOs` block as defined below.
     */
    maintenanceWindowNodeOs?: pulumi.Input<inputs.containerservice.KubernetesClusterMaintenanceWindowNodeOs>;
    /**
     * A `microsoftDefender` block as defined below.
     */
    microsoftDefender?: pulumi.Input<inputs.containerservice.KubernetesClusterMicrosoftDefender>;
    /**
     * Specifies a Prometheus add-on profile for the Kubernetes Cluster. A `monitorMetrics` block as defined below.
     *
     * > **Note:** If deploying Managed Prometheus, the `monitorMetrics` properties are required to configure the cluster for metrics collection. If no value is needed, set properties to `null`.
     */
    monitorMetrics?: pulumi.Input<inputs.containerservice.KubernetesClusterMonitorMetrics>;
    /**
     * The name of the Managed Kubernetes Cluster to create. Changing this forces a new resource to be created.
     */
    name?: pulumi.Input<string>;
    /**
     * A `networkProfile` block as defined below. Changing this forces a new resource to be created.
     *
     * > **Note:** If `networkProfile` is not defined, `kubenet` profile will be used by default.
     */
    networkProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterNetworkProfile>;
    /**
     * The upgrade channel for this Kubernetes Cluster Nodes' OS Image. Possible values are `Unmanaged`, `SecurityPatch`, `NodeImage` and `None`. Defaults to `NodeImage`.
     *
     * > **Note:** `nodeOsUpgradeChannel` must be set to `NodeImage` if `automaticUpgradeChannel` has been set to `node-image`
     */
    nodeOsUpgradeChannel?: pulumi.Input<string>;
    /**
     * A `nodeProvisioningProfile` block as defined below.
     */
    nodeProvisioningProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterNodeProvisioningProfile>;
    /**
     * The name of the Resource Group where the Kubernetes Nodes should exist. Changing this forces a new resource to be created.
     *
     * > **Note:** Azure requires that a new, non-existent Resource Group is used, as otherwise, the provisioning of the Kubernetes Service will fail.
     */
    nodeResourceGroup?: pulumi.Input<string>;
    /**
     * Whether to enable the [OIDC issuer feature](https://learn.microsoft.com/en-gb/azure/aks/use-oidc-issuer).
     *
     * !> **Note:** Once enabled, this feature cannot be disabled, doing so forces a new resource to be created.
     */
    oidcIssuerEnabled?: pulumi.Input<boolean>;
    /**
     * A `omsAgent` block as defined below.
     */
    omsAgent?: pulumi.Input<inputs.containerservice.KubernetesClusterOmsAgent>;
    /**
     * Is Open Service Mesh enabled? For more details, please visit [Open Service Mesh for AKS](https://docs.microsoft.com/azure/aks/open-service-mesh-about).
     */
    openServiceMeshEnabled?: pulumi.Input<boolean>;
    /**
     * Should this Kubernetes Cluster have its API server only exposed on internal IP addresses? This provides a Private IP Address for the Kubernetes API on the Virtual Network where the Kubernetes Cluster is located. Defaults to `false`. Changing this forces a new resource to be created.
     */
    privateClusterEnabled?: pulumi.Input<boolean>;
    /**
     * Specifies whether a Public FQDN for this Private Cluster should be added. Defaults to `false`.
     *
     * > **Note:** If you use BYO DNS Zone, the AKS cluster should either use a User Assigned Identity or a service principal (which is deprecated) with the `Private DNS Zone Contributor` role and access to this Private DNS Zone. If `UserAssigned` identity is used - to prevent improper resource order destruction - the cluster should depend on the role assignment, like in this example:
     *
     * ```typescript
     * import * as pulumi from "@pulumi/pulumi";
     * import * as azure from "@pulumi/azure";
     *
     * const example = new azure.core.ResourceGroup("example", {
     *     name: "example",
     *     location: "West Europe",
     * });
     * const exampleZone = new azure.privatedns.Zone("example", {
     *     name: "privatelink.eastus2.azmk8s.io",
     *     resourceGroupName: example.name,
     * });
     * const exampleUserAssignedIdentity = new azure.authorization.UserAssignedIdentity("example", {
     *     name: "aks-example-identity",
     *     resourceGroupName: example.name,
     *     location: example.location,
     * });
     * const exampleAssignment = new azure.authorization.Assignment("example", {
     *     scope: exampleZone.id,
     *     roleDefinitionName: "Private DNS Zone Contributor",
     *     principalId: exampleUserAssignedIdentity.principalId,
     * });
     * const exampleKubernetesCluster = new azure.containerservice.KubernetesCluster("example", {
     *     name: "aksexamplewithprivatednszone1",
     *     location: example.location,
     *     resourceGroupName: example.name,
     *     dnsPrefix: "aksexamplednsprefix1",
     *     privateClusterEnabled: true,
     *     privateDnsZoneId: exampleZone.id,
     * }, {
     *     dependsOn: [exampleAssignment],
     * });
     * ```
     */
    privateClusterPublicFqdnEnabled?: pulumi.Input<boolean>;
    /**
     * Either the ID of Private DNS Zone which should be delegated to this Cluster, `System` to have AKS manage this or `None`. In case of `None` you will need to bring your own DNS server and set up resolving, otherwise, the cluster will have issues after provisioning. Changing this forces a new resource to be created.
     */
    privateDnsZoneId?: pulumi.Input<string>;
    /**
     * Specifies the Resource Group where the Managed Kubernetes Cluster should exist. Changing this forces a new resource to be created.
     */
    resourceGroupName: pulumi.Input<string>;
    /**
     * Whether Role Based Access Control for the Kubernetes Cluster should be enabled. Defaults to `true`. Changing this forces a new resource to be created.
     */
    roleBasedAccessControlEnabled?: pulumi.Input<boolean>;
    /**
     * Whether to enable run command for the cluster or not. Defaults to `true`.
     */
    runCommandEnabled?: pulumi.Input<boolean>;
    /**
     * A `serviceMeshProfile` block as defined below.
     */
    serviceMeshProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterServiceMeshProfile>;
    /**
     * A `servicePrincipal` block as documented below. One of either `identity` or `servicePrincipal` must be specified.
     *
     * !> **Note:** A migration scenario from `servicePrincipal` to `identity` is supported. When upgrading `servicePrincipal` to `identity`, your cluster's control plane and addon pods will switch to use managed identity, but the kubelets will keep using your configured `servicePrincipal` until you upgrade your Node Pool.
     */
    servicePrincipal?: pulumi.Input<inputs.containerservice.KubernetesClusterServicePrincipal>;
    /**
     * The SKU Tier that should be used for this Kubernetes Cluster. Possible values are `Free`, `Standard` (which includes the Uptime SLA) and `Premium`. Defaults to `Free`.
     *
     * > **Note:** Whilst the AKS API previously supported the `Paid` SKU - the AKS API introduced a breaking change in API Version `2023-02-01` (used in v3.51.0 and later) where the value `Paid` must now be set to `Standard`.
     */
    skuTier?: pulumi.Input<string>;
    /**
     * A `storageProfile` block as defined below.
     */
    storageProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterStorageProfile>;
    /**
     * Specifies the support plan which should be used for this Kubernetes Cluster. Possible values are `KubernetesOfficial` and `AKSLongTermSupport`. Defaults to `KubernetesOfficial`.
     */
    supportPlan?: pulumi.Input<string>;
    /**
     * A mapping of tags to assign to the resource.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * A `upgradeOverride` block as defined below.
     */
    upgradeOverride?: pulumi.Input<inputs.containerservice.KubernetesClusterUpgradeOverride>;
    /**
     * A `webAppRouting` block as defined below.
     */
    webAppRouting?: pulumi.Input<inputs.containerservice.KubernetesClusterWebAppRouting>;
    /**
     * A `windowsProfile` block as defined below.
     */
    windowsProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterWindowsProfile>;
    /**
     * A `workloadAutoscalerProfile` block defined below.
     */
    workloadAutoscalerProfile?: pulumi.Input<inputs.containerservice.KubernetesClusterWorkloadAutoscalerProfile>;
    /**
     * Specifies whether Azure AD Workload Identity should be enabled for the Cluster. Defaults to `false`.
     *
     * > **Note:** To enable Azure AD Workload Identity `oidcIssuerEnabled` must be set to `true`.
     *
     * > **Note:** Enabling this option will allocate Workload Identity resources to the `kube-system` namespace in Kubernetes. If you wish to customize the deployment of Workload Identity, you can refer to [the documentation on Azure AD Workload Identity.](https://azure.github.io/azure-workload-identity/docs/installation/mutating-admission-webhook.html) The documentation provides guidance on how to install the mutating admission webhook, which allows for the customization of Workload Identity deployment.
     */
    workloadIdentityEnabled?: pulumi.Input<boolean>;
}