diff --git a/.tools/nvim/__http__/auth/auth.graphql.yml b/.tools/nvim/__http__/auth/auth.graphql.yml
index 824d6dc62..d4f1a46e4 100644
--- a/.tools/nvim/__http__/auth/auth.graphql.yml
+++ b/.tools/nvim/__http__/auth/auth.graphql.yml
@@ -67,7 +67,7 @@ query: |
     }
   }
 variables:
-  code: "**************"
+  code: "************"
   provider: github
   state: "************"
 ---
diff --git a/.tools/nvim/__http__/infra/cloud-provider-secrets.graphql.yml b/.tools/nvim/__http__/infra/cloud-provider-secrets.graphql.yml
index beb72517f..6432e3b21 100644
--- a/.tools/nvim/__http__/infra/cloud-provider-secrets.graphql.yml
+++ b/.tools/nvim/__http__/infra/cloud-provider-secrets.graphql.yml
@@ -1,10 +1,6 @@
 ---
 global:
-  accountName: kloudlite-dev
-  clusterName: sample-cluster
-
-  providerNamespace: kl-account-kloudlite-dev
-  providerName: aws-creds2
+  providerName: aws-creds
 
 ---
 
@@ -22,7 +18,7 @@ variables:
       name: "{{.providerName}}"
     cloudProviderName: aws
     aws:
-      awsAccountId: "{{.awsAccountId}}"
+      authMechanism: "secret_keys"
 ---
 
 label: Update Cloud Provider Secret
@@ -39,7 +35,10 @@ variables:
       name: "{{.providerName}}"
     cloudProviderName: aws
     aws:
-      awsAccountId: "{{.awsAccountId}}"
+      authMechanism: "secret_keys"
+      authSecretKeys:
+        accessKey: "{{.accessKey}}"
+        secretKey: "{{.secretKey}}"
 
 ---
 
diff --git a/.tools/nvim/__http__/infra/clusters.graphql.yml b/.tools/nvim/__http__/infra/clusters.graphql.yml
index 096aaf316..e28ca66d2 100644
--- a/.tools/nvim/__http__/infra/clusters.graphql.yml
+++ b/.tools/nvim/__http__/infra/clusters.graphql.yml
@@ -20,14 +20,16 @@ variables:
     spec:
       cloudflareEnabled: true
       availabilityMode: dev
-      credentialsRef:
-        name: "{{.providerSecretName}}"
-        namespace: "{{.providerSecretNamespace}}"
       cloudProvider: aws
       aws:
-        region: eu-north-1
+        credentials:
+          authMechanism: "secret_keys"
+          secretRef:
+            name: "{{.providerSecretName}}"
+            namespace: "{{.providerSecretNamespace}}"
+        region: ap-south-1
         k3sMasters:
-          instanceType: c5a.large
+          instanceType: c6a.large
           nvidiaGpuEnabled: false
 
 ---
diff --git a/.tools/nvim/__http__/infra/nodepools.graphql.yml b/.tools/nvim/__http__/infra/nodepools.graphql.yml
index 569463a50..ff16d40c0 100644
--- a/.tools/nvim/__http__/infra/nodepools.graphql.yml
+++ b/.tools/nvim/__http__/infra/nodepools.graphql.yml
@@ -21,7 +21,7 @@ variables:
   clusterName: "{{.clusterName}}"
   pool:
     displayName: sample
-    stateful: false
+    # stateful: false
     metadata:
       name: first
     spec:
@@ -155,7 +155,7 @@ variables:
 ---
 
 label: List Nodepools
-query: |+
+query: |+ #graphql
   query Infra_listNodePools($clusterName: String!) {
     infra_listNodePools(clusterName: $clusterName) {
       totalCount
@@ -200,7 +200,7 @@ variables:
 
 ---
 label: Get Nodepool
-query: |+
+query: |+ #graphql
   query Infra_getNodePool($clusterName: String!, $poolName: String!) {
     infra_getNodePool(clusterName: $clusterName, poolName: $poolName) {
       accountName
diff --git a/apps/infra/Taskfile.yml b/apps/infra/Taskfile.yml
index 5406f8b4e..1bc7e7adc 100644
--- a/apps/infra/Taskfile.yml
+++ b/apps/infra/Taskfile.yml
@@ -45,9 +45,13 @@ tasks:
       - go run main.go --dev
       # - go build  -o bin/infra . && ./bin/infra --dev
 
-  build:
+  gen:constants:
     cmds:
       - go generate ./internal/entities/field-constants/gen.go
+
+  build:
+    cmds:
+      - task: gen:constants
       - task: go:build 
         vars: 
           Out: ./bin/{{.app}}
diff --git a/apps/infra/http/gql.http b/apps/infra/http/gql.http
deleted file mode 100644
index f23868b55..000000000
--- a/apps/infra/http/gql.http
+++ /dev/null
@@ -1,29 +0,0 @@
-### list BYOC clusters
-GRAPHQL http://localhost:3001/query
-Cookie: hotspot-session=ses-tkzy-moia9efhvty6ojcg58yzs1r; domain=.kloudlite.io; path=/; HttpOnly; secure; SameSite=None;kloudlite-account=kloudlite-dev;kloudlite-cluster=clus-kloudlite-dev;
-
-query {
-  infra_listBYOCClusters {
-    name
-    region
-  }
-}
-
-
-
-### create BYOC cluster
-GRAPHQL http://localhost:3001/query
-Cookie: hotspot-session=ses-tkzy-moia9efhvty6ojcg58yzs1r; domain=.kloudlite.io; path=/; HttpOnly; secure; SameSite=None;kloudlite-account=kloudlite-dev;kloudlite-cluster=clus-kloudlite-dev;
-
-mutation {
-  infra_createBYOCCluster(cluster: {
-    name: "test"
-    accountName: "kloudlite-dev"
-    region: "us-east-1"
-    provider: "aws"
-  }) {
-   region
-  }
-}
-
-
diff --git a/apps/infra/internal/app/graph/cloudprovidersecret.resolvers.go b/apps/infra/internal/app/graph/cloudprovidersecret.resolvers.go
index e342d4a2d..062da6042 100644
--- a/apps/infra/internal/app/graph/cloudprovidersecret.resolvers.go
+++ b/apps/infra/internal/app/graph/cloudprovidersecret.resolvers.go
@@ -12,7 +12,6 @@ import (
 	"github.com/kloudlite/api/apps/infra/internal/app/graph/generated"
 	"github.com/kloudlite/api/apps/infra/internal/app/graph/model"
 	"github.com/kloudlite/api/apps/infra/internal/entities"
-	"github.com/kloudlite/api/cmd/struct-to-graphql/pkg/parser"
 	fn "github.com/kloudlite/api/pkg/functions"
 	ct "github.com/kloudlite/operator/apis/common-types"
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -23,16 +22,8 @@ func (r *cloudProviderSecretResolver) Aws(ctx context.Context, obj *entities.Clo
 	if obj == nil || obj.CreationTime.IsZero() {
 		return nil, errors.Newf("CloudProviderSecret object is nil")
 	}
-	return &model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials{
-		AccessKey:                  obj.AWS.AccessKey,
-		AwsAccountID:               obj.AWS.AWSAccountId,
-		CfParamExternalID:          &obj.AWS.CfParamExternalID,
-		CfParamInstanceProfileName: &obj.AWS.CfParamInstanceProfileName,
-		CfParamRoleName:            &obj.AWS.CfParamRoleName,
-		CfParamStackName:           &obj.AWS.CfParamStackName,
-		CfParamTrustedArn:          &obj.AWS.CfParamTrustedARN,
-		SecretKey:                  obj.AWS.SecretKey,
-	}, nil
+
+	return fn.JsonConvertP[model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials](obj.AWS)
 }
 
 // CloudProviderName is the resolver for the cloudProviderName field.
@@ -76,7 +67,8 @@ func (r *cloudProviderSecretInResolver) CloudProviderName(ctx context.Context, o
 	if !data.IsValid() {
 		return errors.Newf("invalid cloud provider name")
 	}
-	obj.CloudProviderName = ct.CloudProvider(parser.RestoreSanitizedPackagePath(data.String()))
+	// obj.CloudProviderName = ct.CloudProvider(parser.RestoreSanitizedPackagePath(data.String()))
+	obj.CloudProviderName = ct.CloudProvider(data)
 	return nil
 }
 
diff --git a/apps/infra/internal/app/graph/generated/generated.go b/apps/infra/internal/app/graph/generated/generated.go
index 4b9c80279..f4e475c79 100644
--- a/apps/infra/internal/app/graph/generated/generated.go
+++ b/apps/infra/internal/app/graph/generated/generated.go
@@ -216,15 +216,26 @@ type ComplexityRoot struct {
 		Value    func(childComplexity int) int
 	}
 
+	Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams struct {
+		AwsAccountID      func(childComplexity int) int
+		CfParamTrustedArn func(childComplexity int) int
+		ExternalID        func(childComplexity int) int
+		RoleArn           func(childComplexity int) int
+	}
+
+	Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys struct {
+		AccessKey       func(childComplexity int) int
+		CfParamUserName func(childComplexity int) int
+		SecretKey       func(childComplexity int) int
+	}
+
 	Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials struct {
-		AccessKey                  func(childComplexity int) int
-		AwsAccountID               func(childComplexity int) int
-		CfParamExternalID          func(childComplexity int) int
+		AssumeRoleParams           func(childComplexity int) int
+		AuthMechanism              func(childComplexity int) int
+		AuthSecretKeys             func(childComplexity int) int
 		CfParamInstanceProfileName func(childComplexity int) int
 		CfParamRoleName            func(childComplexity int) int
 		CfParamStackName           func(childComplexity int) int
-		CfParamTrustedArn          func(childComplexity int) int
-		SecretKey                  func(childComplexity int) int
 	}
 
 	Github__com___kloudlite___api___apps___infra___internal___entities__InputField struct {
@@ -285,6 +296,7 @@ type ComplexityRoot struct {
 	}
 
 	Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig struct {
+		Credentials   func(childComplexity int) int
 		K3sMasters    func(childComplexity int) int
 		NodePools     func(childComplexity int) int
 		Region        func(childComplexity int) int
@@ -314,6 +326,11 @@ type ComplexityRoot struct {
 		VpcSubnetID            func(childComplexity int) int
 	}
 
+	Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials struct {
+		AuthMechanism func(childComplexity int) int
+		SecretRef     func(childComplexity int) int
+	}
+
 	Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig struct {
 		InstanceType func(childComplexity int) int
 		Nodes        func(childComplexity int) int
@@ -345,15 +362,6 @@ type ComplexityRoot struct {
 		PublicSubnets func(childComplexity int) int
 	}
 
-	Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys struct {
-		KeyAWSAccountID            func(childComplexity int) int
-		KeyAWSAssumeRoleExternalID func(childComplexity int) int
-		KeyAWSAssumeRoleRoleArn    func(childComplexity int) int
-		KeyAccessKey               func(childComplexity int) int
-		KeyIAMInstanceProfileRole  func(childComplexity int) int
-		KeySecretKey               func(childComplexity int) int
-	}
-
 	Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput struct {
 		JobName                func(childComplexity int) int
 		JobNamespace           func(childComplexity int) int
@@ -375,8 +383,6 @@ type ComplexityRoot struct {
 		CloudflareEnabled      func(childComplexity int) int
 		ClusterInternalDNSHost func(childComplexity int) int
 		ClusterTokenRef        func(childComplexity int) int
-		CredentialKeys         func(childComplexity int) int
-		CredentialsRef         func(childComplexity int) int
 		KloudliteRelease       func(childComplexity int) int
 		MessageQueueTopicName  func(childComplexity int) int
 		Output                 func(childComplexity int) int
@@ -384,6 +390,17 @@ type ComplexityRoot struct {
 		TaintMasterNodes       func(childComplexity int) int
 	}
 
+	Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig struct {
+		AvailabilityZone func(childComplexity int) int
+		BootVolumeSize   func(childComplexity int) int
+		BootVolumeType   func(childComplexity int) int
+		Credentials      func(childComplexity int) int
+		MachineType      func(childComplexity int) int
+		Nodes            func(childComplexity int) int
+		PoolType         func(childComplexity int) int
+		Region           func(childComplexity int) int
+	}
+
 	Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps struct {
 		AvailabilityZone func(childComplexity int) int
 		KloudliteRelease func(childComplexity int) int
@@ -394,6 +411,7 @@ type ComplexityRoot struct {
 	Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec struct {
 		Aws           func(childComplexity int) int
 		CloudProvider func(childComplexity int) int
+		Gcp           func(childComplexity int) int
 		MaxCount      func(childComplexity int) int
 		MinCount      func(childComplexity int) int
 		NodeLabels    func(childComplexity int) int
@@ -2064,26 +2082,75 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.EncodedValue.Value(childComplexity), true
 
-	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.accessKey":
-		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AccessKey == nil {
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.awsAccountId":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.AwsAccountID == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.AwsAccountID(childComplexity), true
+
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.cfParamTrustedARN":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.CfParamTrustedArn == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.CfParamTrustedArn(childComplexity), true
+
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.externalID":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.ExternalID == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.ExternalID(childComplexity), true
+
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.roleARN":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.RoleArn == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams.RoleArn(childComplexity), true
+
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.accessKey":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.AccessKey == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.AccessKey(childComplexity), true
+
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.cfParamUserName":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.CfParamUserName == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.CfParamUserName(childComplexity), true
+
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.secretKey":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.SecretKey == nil {
 			break
 		}
 
-		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AccessKey(childComplexity), true
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys.SecretKey(childComplexity), true
 
-	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.awsAccountId":
-		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AwsAccountID == nil {
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.assumeRoleParams":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AssumeRoleParams == nil {
 			break
 		}
 
-		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AwsAccountID(childComplexity), true
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AssumeRoleParams(childComplexity), true
 
-	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.cfParamExternalID":
-		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.CfParamExternalID == nil {
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.authMechanism":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AuthMechanism == nil {
 			break
 		}
 
-		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.CfParamExternalID(childComplexity), true
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AuthMechanism(childComplexity), true
+
+	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.authSecretKeys":
+		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AuthSecretKeys == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.AuthSecretKeys(childComplexity), true
 
 	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.cfParamInstanceProfileName":
 		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.CfParamInstanceProfileName == nil {
@@ -2106,20 +2173,6 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.CfParamStackName(childComplexity), true
 
-	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.cfParamTrustedARN":
-		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.CfParamTrustedArn == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.CfParamTrustedArn(childComplexity), true
-
-	case "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.secretKey":
-		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.SecretKey == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials.SecretKey(childComplexity), true
-
 	case "Github__com___kloudlite___api___apps___infra___internal___entities__InputField.defaultValue":
 		if e.complexity.Github__com___kloudlite___api___apps___infra___internal___entities__InputField.DefaultValue == nil {
 			break
@@ -2393,6 +2446,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Github__com___kloudlite___api___pkg___types__SyncStatus.SyncScheduledAt(childComplexity), true
 
+	case "Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig.credentials":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig.Credentials == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig.Credentials(childComplexity), true
+
 	case "Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig.k3sMasters":
 		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig.K3sMasters == nil {
 			break
@@ -2540,6 +2600,20 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfig.VpcSubnetID(childComplexity), true
 
+	case "Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials.authMechanism":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials.AuthMechanism == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials.AuthMechanism(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials.secretRef":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials.SecretRef == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials.SecretRef(childComplexity), true
+
 	case "Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig.instanceType":
 		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig.InstanceType == nil {
 			break
@@ -2631,48 +2705,6 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__AwsVPCParams.PublicSubnets(childComplexity), true
 
-	case "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.keyAWSAccountId":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAWSAccountID == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAWSAccountID(childComplexity), true
-
-	case "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.keyAWSAssumeRoleExternalID":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAWSAssumeRoleExternalID == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAWSAssumeRoleExternalID(childComplexity), true
-
-	case "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.keyAWSAssumeRoleRoleARN":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAWSAssumeRoleRoleArn == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAWSAssumeRoleRoleArn(childComplexity), true
-
-	case "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.keyAccessKey":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAccessKey == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyAccessKey(childComplexity), true
-
-	case "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.keyIAMInstanceProfileRole":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyIAMInstanceProfileRole == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeyIAMInstanceProfileRole(childComplexity), true
-
-	case "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.keySecretKey":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeySecretKey == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys.KeySecretKey(childComplexity), true
-
 	case "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput.jobName":
 		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput.JobName == nil {
 			break
@@ -2792,20 +2824,6 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.ClusterTokenRef(childComplexity), true
 
-	case "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.credentialKeys":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.CredentialKeys == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.CredentialKeys(childComplexity), true
-
-	case "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.credentialsRef":
-		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.CredentialsRef == nil {
-			break
-		}
-
-		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.CredentialsRef(childComplexity), true
-
 	case "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.kloudliteRelease":
 		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.KloudliteRelease == nil {
 			break
@@ -2841,6 +2859,62 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec.TaintMasterNodes(childComplexity), true
 
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.availabilityZone":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.AvailabilityZone == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.AvailabilityZone(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.bootVolumeSize":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.BootVolumeSize == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.BootVolumeSize(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.bootVolumeType":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.BootVolumeType == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.BootVolumeType(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.credentials":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.Credentials == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.Credentials(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.machineType":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.MachineType == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.MachineType(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.nodes":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.Nodes == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.Nodes(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.poolType":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.PoolType == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.PoolType(childComplexity), true
+
+	case "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.region":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.Region == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig.Region(childComplexity), true
+
 	case "Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps.availabilityZone":
 		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps.AvailabilityZone == nil {
 			break
@@ -2883,6 +2957,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec.CloudProvider(childComplexity), true
 
+	case "Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec.gcp":
+		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec.Gcp == nil {
+			break
+		}
+
+		return e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec.Gcp(childComplexity), true
+
 	case "Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec.maxCount":
 		if e.complexity.Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec.MaxCount == nil {
 			break
@@ -6730,15 +6811,19 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputClusterManagedServiceIn,
 		ec.unmarshalInputCursorPaginationIn,
 		ec.unmarshalInputDomainEntryIn,
+		ec.unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn,
+		ec.unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn,
 		ec.unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentialsIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfigIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AWSK3sMastersConfigIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfigIn,
+		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfigIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsSpotCpuNodeIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsSpotGpuNodeIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsSpotPoolConfigIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__ClusterSpecIn,
+		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__NodePoolSpecIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__NodePropsIn,
 		ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__NodeSpecIn,
@@ -6971,6 +7056,8 @@ type Query {
     infra_listDomainEntries(search: SearchDomainEntry, pagination: CursorPaginationIn): DomainEntryPaginatedRecords @isLoggedInAndVerified @hasAccount
     infra_getDomainEntry(domainName: String!): DomainEntry @isLoggedInAndVerified @hasAccount
 
+    # infra_getAwsCloudformationStackURL: String
+
     infra_checkAwsAccess(cloudproviderName: String!): CheckAwsAccessOutput! @isLoggedInAndVerified @hasAccount
 
     infra_listClusterManagedServices(clusterName: String!, search: SearchClusterManagedService, pagination: CursorPaginationIn): ClusterManagedServicePaginatedRecords @isLoggedInAndVerified @hasAccount
@@ -7148,15 +7235,26 @@ input ClusterManagedServiceIn {
 }
 
 `, BuiltIn: false},
-	{Name: "../struct-to-graphql/common-types.graphqls", Input: `type Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials @shareable {
-  accessKey: String
-  awsAccountId: String
-  cfParamExternalID: String
+	{Name: "../struct-to-graphql/common-types.graphqls", Input: `type Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams @shareable {
+  awsAccountId: String!
+  cfParamTrustedARN: String!
+  externalID: String!
+  roleARN: String!
+}
+
+type Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys @shareable {
+  accessKey: String!
+  cfParamUserName: String!
+  secretKey: String!
+}
+
+type Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials @shareable {
+  assumeRoleParams: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  authSecretKeys: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys
   cfParamInstanceProfileName: String
   cfParamRoleName: String
   cfParamStackName: String
-  cfParamTrustedARN: String
-  secretKey: String
 }
 
 type Github__com___kloudlite___api___apps___infra___internal___entities__InputField @shareable {
@@ -7217,6 +7315,7 @@ type Github__com___kloudlite___api___pkg___types__SyncStatus @shareable {
 }
 
 type Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig @shareable {
+  credentials: Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials!
   k3sMasters: Github__com___kloudlite___operator___apis___clusters___v1__AWSK3sMastersConfig
   nodePools: Map
   region: String!
@@ -7246,6 +7345,11 @@ type Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfi
   vpcSubnetId: String!
 }
 
+type Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials @shareable {
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  secretRef: Github__com___kloudlite___operator___apis___common____types__SecretRef!
+}
+
 type Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig @shareable {
   instanceType: String!
   nodes: Map
@@ -7277,15 +7381,6 @@ type Github__com___kloudlite___operator___apis___clusters___v1__AwsVPCParams @sh
   publicSubnets: [Github__com___kloudlite___operator___apis___clusters___v1__AwsSubnetWithID!]!
 }
 
-type Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys @shareable {
-  keyAccessKey: String!
-  keyAWSAccountId: String!
-  keyAWSAssumeRoleExternalID: String!
-  keyAWSAssumeRoleRoleARN: String!
-  keyIAMInstanceProfileRole: String!
-  keySecretKey: String!
-}
-
 type Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput @shareable {
   jobName: String!
   jobNamespace: String!
@@ -7307,8 +7402,6 @@ type Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec @sha
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
   clusterInternalDnsHost: String
   clusterTokenRef: Github__com___kloudlite___operator___apis___common____types__SecretKeyRef
-  credentialKeys: Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys
-  credentialsRef: Github__com___kloudlite___operator___apis___common____types__SecretRef!
   kloudliteRelease: String!
   messageQueueTopicName: String!
   output: Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput
@@ -7316,6 +7409,17 @@ type Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec @sha
   taintMasterNodes: Boolean!
 }
 
+type Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig @shareable {
+  availabilityZone: String!
+  bootVolumeSize: Int!
+  bootVolumeType: String!
+  credentials: Github__com___kloudlite___operator___apis___common____types__SecretRef!
+  machineType: String!
+  nodes: Map
+  poolType: Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType!
+  region: String!
+}
+
 type Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps @shareable {
   availabilityZone: String!
   kloudliteRelease: String!
@@ -7326,6 +7430,7 @@ type Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps
 type Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec @shareable {
   aws: Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfig
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
+  gcp: Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig
   maxCount: Int!
   minCount: Int!
   nodeLabels: Map
@@ -7870,13 +7975,23 @@ type PageInfo @shareable {
   startCursor: String
 }
 
+input Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn {
+  awsAccountId: String!
+}
+
+input Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn {
+  accessKey: String!
+  secretKey: String!
+}
+
 input Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentialsIn {
-  accessKey: String
-  awsAccountId: String
-  secretKey: String
+  assumeRoleParams: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  authSecretKeys: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn
 }
 
 input Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfigIn {
+  credentials: Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn!
   k3sMasters: Github__com___kloudlite___operator___apis___clusters___v1__AWSK3sMastersConfigIn
   region: String!
 }
@@ -7894,6 +8009,11 @@ input Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConf
   spotPool: Github__com___kloudlite___operator___apis___clusters___v1__AwsSpotPoolConfigIn
 }
 
+input Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn {
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  secretRef: Github__com___kloudlite___operator___apis___common____types__SecretRefIn!
+}
+
 input Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfigIn {
   instanceType: String!
   nodes: Map
@@ -7919,12 +8039,23 @@ input Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpecIn {
   aws: Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfigIn
   cloudflareEnabled: Boolean
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
-  credentialsRef: Github__com___kloudlite___operator___apis___common____types__SecretRefIn!
+}
+
+input Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn {
+  availabilityZone: String!
+  bootVolumeSize: Int!
+  bootVolumeType: String!
+  credentials: Github__com___kloudlite___operator___apis___common____types__SecretRefIn!
+  machineType: String!
+  nodes: Map
+  poolType: Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType!
+  region: String!
 }
 
 input Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpecIn {
   aws: Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfigIn
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
+  gcp: Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn
   maxCount: Int!
   minCount: Int!
   nodeLabels: Map
@@ -8422,11 +8553,21 @@ enum Github__com___kloudlite___operator___apis___clusters___v1__AWSPoolType {
   spot
 }
 
+enum Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism {
+  assume_role
+  secret_keys
+}
+
 enum Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpecAvailabilityMode {
   dev
   HA
 }
 
+enum Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType {
+  SPOT
+  STANDARD
+}
+
 enum Github__com___kloudlite___operator___apis___common____types__CloudProvider {
   aws
   azure
@@ -10191,22 +10332,18 @@ func (ec *executionContext) fieldContext_CloudProviderSecret_aws(ctx context.Con
 		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
-			case "accessKey":
-				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_accessKey(ctx, field)
-			case "awsAccountId":
-				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_awsAccountId(ctx, field)
-			case "cfParamExternalID":
-				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamExternalID(ctx, field)
+			case "assumeRoleParams":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_assumeRoleParams(ctx, field)
+			case "authMechanism":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authMechanism(ctx, field)
+			case "authSecretKeys":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authSecretKeys(ctx, field)
 			case "cfParamInstanceProfileName":
 				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamInstanceProfileName(ctx, field)
 			case "cfParamRoleName":
 				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamRoleName(ctx, field)
 			case "cfParamStackName":
 				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx, field)
-			case "cfParamTrustedARN":
-				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamTrustedARN(ctx, field)
-			case "secretKey":
-				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_secretKey(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials", field.Name)
 		},
@@ -11509,10 +11646,6 @@ func (ec *executionContext) fieldContext_Cluster_spec(ctx context.Context, field
 				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterInternalDnsHost(ctx, field)
 			case "clusterTokenRef":
 				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx, field)
-			case "credentialKeys":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialKeys(ctx, field)
-			case "credentialsRef":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialsRef(ctx, field)
 			case "kloudliteRelease":
 				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx, field)
 			case "messageQueueTopicName":
@@ -14121,49 +14254,8 @@ func (ec *executionContext) fieldContext_EncodedValue_encoding(ctx context.Conte
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_accessKey(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_accessKey(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.AccessKey, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		return graphql.Null
-	}
-	res := resTmp.(*string)
-	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_accessKey(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_awsAccountId(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_awsAccountId(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_awsAccountId(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_awsAccountId(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -14183,16 +14275,19 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_awsAccountId(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_awsAccountId(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -14203,8 +14298,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamExternalID(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamExternalID(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_cfParamTrustedARN(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_cfParamTrustedARN(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -14217,23 +14312,26 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CfParamExternalID, nil
+		return obj.CfParamTrustedArn, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamExternalID(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_cfParamTrustedARN(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -14244,8 +14342,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamInstanceProfileName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamInstanceProfileName(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_externalID(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_externalID(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -14258,23 +14356,26 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CfParamInstanceProfileName, nil
+		return obj.ExternalID, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamInstanceProfileName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_externalID(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -14285,8 +14386,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamRoleName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamRoleName(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_roleARN(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_roleARN(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -14299,23 +14400,26 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CfParamRoleName, nil
+		return obj.RoleArn, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamRoleName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_roleARN(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -14326,8 +14430,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_accessKey(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_accessKey(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -14340,23 +14444,26 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CfParamStackName, nil
+		return obj.AccessKey, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_accessKey(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -14367,8 +14474,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamTrustedARN(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamTrustedARN(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_cfParamUserName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_cfParamUserName(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -14381,23 +14488,26 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CfParamTrustedArn, nil
+		return obj.CfParamUserName, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamTrustedARN(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_cfParamUserName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -14408,8 +14518,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_secretKey(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_secretKey(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_secretKey(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_secretKey(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -14428,6 +14538,235 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_secretKey(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_assumeRoleParams(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_assumeRoleParams(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.AssumeRoleParams, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams)
+	fc.Result = res
+	return ec.marshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_assumeRoleParams(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "awsAccountId":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_awsAccountId(ctx, field)
+			case "cfParamTrustedARN":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_cfParamTrustedARN(ctx, field)
+			case "externalID":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_externalID(ctx, field)
+			case "roleARN":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_roleARN(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authMechanism(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authMechanism(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.AuthMechanism, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(model.GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism)
+	fc.Result = res
+	return ec.marshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsAuthMechanism(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authMechanism(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authSecretKeys(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authSecretKeys(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.AuthSecretKeys, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys)
+	fc.Result = res
+	return ec.marshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authSecretKeys(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "accessKey":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_accessKey(ctx, field)
+			case "cfParamUserName":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_cfParamUserName(ctx, field)
+			case "secretKey":
+				return ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_secretKey(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamInstanceProfileName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamInstanceProfileName(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.CfParamInstanceProfileName, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamInstanceProfileName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamRoleName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamRoleName(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.CfParamRoleName, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
 	if resTmp == nil {
 		return graphql.Null
 	}
@@ -14436,7 +14775,48 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_secretKey(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamRoleName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.CfParamStackName, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials",
 		Field:      field,
@@ -16199,6 +16579,56 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___api___pkg___t
 	return fc, nil
 }
 
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_credentials(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1AWSClusterConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_credentials(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Credentials, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*model.GithubComKloudliteOperatorApisClustersV1AwsCredentials)
+	fc.Result = res
+	return ec.marshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsCredentials2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsCredentials(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_credentials(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "authMechanism":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_authMechanism(ctx, field)
+			case "secretRef":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_secretRef(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_k3sMasters(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1AWSClusterConfig) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_k3sMasters(ctx, field)
 	if err != nil {
@@ -17132,6 +17562,100 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_authMechanism(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1AwsCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_authMechanism(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.AuthMechanism, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(model.GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism)
+	fc.Result = res
+	return ec.marshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsAuthMechanism(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_authMechanism(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_secretRef(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1AwsCredentials) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_secretRef(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.SecretRef, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*model.GithubComKloudliteOperatorApisCommonTypesSecretRef)
+	fc.Result = res
+	return ec.marshalNGithub__com___kloudlite___operator___apis___common____types__SecretRef2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretRef(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_secretRef(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "name":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretRef_name(ctx, field)
+			case "namespace":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretRef_namespace(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___common____types__SecretRef", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig_instanceType(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1AwsEC2PoolConfig) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig_instanceType(ctx, field)
 	if err != nil {
@@ -17717,8 +18241,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAccessKey(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAccessKey(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -17731,7 +18255,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyAccessKey, nil
+		return obj.JobName, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -17748,9 +18272,9 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAccessKey(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -17761,8 +18285,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAccountId(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAccountId(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -17775,7 +18299,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyAWSAccountID, nil
+		return obj.JobNamespace, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -17792,9 +18316,9 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAccountId(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -17805,8 +18329,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleExternalID(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleExternalID(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -17819,26 +18343,23 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyAWSAssumeRoleExternalID, nil
+		return obj.KeyAWSVPCId, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*string)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleExternalID(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -17849,8 +18370,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleRoleARN(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleRoleARN(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -17863,26 +18384,23 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyAWSAssumeRoleRoleArn, nil
+		return obj.KeyAWSVPCPublicSubnets, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*string)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleRoleARN(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -17893,8 +18411,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyIAMInstanceProfileRole(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyIAMInstanceProfileRole(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -17907,7 +18425,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyIAMInstanceProfileRole, nil
+		return obj.KeyK3sAgentJoinToken, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -17924,9 +18442,9 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyIAMInstanceProfileRole(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -17937,8 +18455,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keySecretKey(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keySecretKey(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -17951,7 +18469,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeySecretKey, nil
+		return obj.KeyK3sServerJoinToken, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -17968,9 +18486,9 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keySecretKey(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -17981,8 +18499,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -17995,7 +18513,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.JobName, nil
+		return obj.KeyKubeconfig, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18012,7 +18530,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
@@ -18025,8 +18543,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18039,7 +18557,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.JobNamespace, nil
+		return obj.SecretName, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18056,7 +18574,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
 		Field:      field,
@@ -18069,8 +18587,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountId(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountId(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18083,23 +18601,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyAWSVPCId, nil
+		return obj.AccountID, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountId(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -18110,8 +18631,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountName(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18124,23 +18645,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyAWSVPCPublicSubnets, nil
+		return obj.AccountName, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -18151,8 +18675,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_availabilityMode(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_availabilityMode(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18165,7 +18689,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyK3sAgentJoinToken, nil
+		return obj.AvailabilityMode, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18177,26 +18701,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(model.GithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNGithub__com___kloudlite___operator___apis___clusters___v1__ClusterSpecAvailabilityMode2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_availabilityMode(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpecAvailabilityMode does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_aws(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_aws(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18209,38 +18733,49 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyK3sServerJoinToken, nil
+		return obj.Aws, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*model.GithubComKloudliteOperatorApisClustersV1AWSClusterConfig)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOGithub__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AWSClusterConfig(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_aws(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "credentials":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_credentials(ctx, field)
+			case "k3sMasters":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_k3sMasters(ctx, field)
+			case "nodePools":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_nodePools(ctx, field)
+			case "region":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_region(ctx, field)
+			case "spotNodePools":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_spotNodePools(ctx, field)
+			case "vpc":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_vpc(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_backupToS3Enabled(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_backupToS3Enabled(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18253,7 +18788,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KeyKubeconfig, nil
+		return obj.BackupToS3Enabled, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18265,26 +18800,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(bool)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_backupToS3Enabled(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Boolean does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudflareEnabled(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudflareEnabled(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18297,38 +18832,35 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.SecretName, nil
+		return obj.CloudflareEnabled, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*bool)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOBoolean2ᚖbool(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudflareEnabled(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Boolean does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountId(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountId(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudProvider(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudProvider(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18341,7 +18873,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.AccountID, nil
+		return obj.CloudProvider, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18353,26 +18885,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(model.GithubComKloudliteOperatorApisCommonTypesCloudProvider)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNGithub__com___kloudlite___operator___apis___common____types__CloudProvider2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesCloudProvider(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountId(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudProvider(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Github__com___kloudlite___operator___apis___common____types__CloudProvider does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountName(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterInternalDnsHost(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterInternalDnsHost(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18385,24 +18917,21 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.AccountName, nil
+		return obj.ClusterInternalDNSHost, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*string)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_accountName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterInternalDnsHost(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
@@ -18415,8 +18944,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_availabilityMode(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_availabilityMode(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18429,38 +18958,43 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.AvailabilityMode, nil
+		return obj.ClusterTokenRef, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(model.GithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode)
+	res := resTmp.(*model.GithubComKloudliteOperatorApisCommonTypesSecretKeyRef)
 	fc.Result = res
-	return ec.marshalNGithub__com___kloudlite___operator___apis___clusters___v1__ClusterSpecAvailabilityMode2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode(ctx, field.Selections, res)
+	return ec.marshalOGithub__com___kloudlite___operator___apis___common____types__SecretKeyRef2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretKeyRef(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_availabilityMode(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpecAvailabilityMode does not have child fields")
+			switch field.Name {
+			case "key":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretKeyRef_key(ctx, field)
+			case "name":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretKeyRef_name(ctx, field)
+			case "namespace":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretKeyRef_namespace(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___common____types__SecretKeyRef", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_aws(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_aws(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18473,47 +19007,38 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Aws, nil
+		return obj.KloudliteRelease, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*model.GithubComKloudliteOperatorApisClustersV1AWSClusterConfig)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOGithub__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AWSClusterConfig(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_aws(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "k3sMasters":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_k3sMasters(ctx, field)
-			case "nodePools":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_nodePools(ctx, field)
-			case "region":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_region(ctx, field)
-			case "spotNodePools":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_spotNodePools(ctx, field)
-			case "vpc":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_vpc(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_backupToS3Enabled(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_backupToS3Enabled(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_messageQueueTopicName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_messageQueueTopicName(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18526,7 +19051,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.BackupToS3Enabled, nil
+		return obj.MessageQueueTopicName, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18538,26 +19063,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(bool)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_backupToS3Enabled(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_messageQueueTopicName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudflareEnabled(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudflareEnabled(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_output(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_output(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18570,7 +19095,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CloudflareEnabled, nil
+		return obj.Output, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18579,26 +19104,44 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*bool)
+	res := resTmp.(*model.GithubComKloudliteOperatorApisClustersV1ClusterOutput)
 	fc.Result = res
-	return ec.marshalOBoolean2ᚖbool(ctx, field.Selections, res)
+	return ec.marshalOGithub__com___kloudlite___operator___apis___clusters___v1__ClusterOutput2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1ClusterOutput(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudflareEnabled(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_output(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
+			switch field.Name {
+			case "jobName":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx, field)
+			case "jobNamespace":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx, field)
+			case "keyAWSVPCId":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx, field)
+			case "keyAWSVPCPublicSubnets":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx, field)
+			case "keyK3sAgentJoinToken":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx, field)
+			case "keyK3sServerJoinToken":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx, field)
+			case "keyKubeconfig":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx, field)
+			case "secretName":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudProvider(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudProvider(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_publicDNSHost(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_publicDNSHost(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18611,7 +19154,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CloudProvider, nil
+		return obj.PublicDNSHost, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18623,26 +19166,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(model.GithubComKloudliteOperatorApisCommonTypesCloudProvider)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNGithub__com___kloudlite___operator___apis___common____types__CloudProvider2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesCloudProvider(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_cloudProvider(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_publicDNSHost(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Github__com___kloudlite___operator___apis___common____types__CloudProvider does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterInternalDnsHost(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterInternalDnsHost(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_taintMasterNodes(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_taintMasterNodes(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18655,35 +19198,38 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ClusterInternalDNSHost, nil
+		return obj.TaintMasterNodes, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(bool)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterInternalDnsHost(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_taintMasterNodes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Boolean does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_availabilityZone(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_availabilityZone(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18696,43 +19242,38 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ClusterTokenRef, nil
+		return obj.AvailabilityZone, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*model.GithubComKloudliteOperatorApisCommonTypesSecretKeyRef)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOGithub__com___kloudlite___operator___apis___common____types__SecretKeyRef2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretKeyRef(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_availabilityZone(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "key":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretKeyRef_key(ctx, field)
-			case "name":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretKeyRef_name(ctx, field)
-			case "namespace":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretKeyRef_namespace(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___common____types__SecretKeyRef", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialKeys(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialKeys(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeSize(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeSize(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18745,49 +19286,38 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CredentialKeys, nil
+		return obj.BootVolumeSize, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys)
+	res := resTmp.(int)
 	fc.Result = res
-	return ec.marshalOGithub__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys(ctx, field.Selections, res)
+	return ec.marshalNInt2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialKeys(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeSize(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "keyAccessKey":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAccessKey(ctx, field)
-			case "keyAWSAccountId":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAccountId(ctx, field)
-			case "keyAWSAssumeRoleExternalID":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleExternalID(ctx, field)
-			case "keyAWSAssumeRoleRoleARN":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleRoleARN(ctx, field)
-			case "keyIAMInstanceProfileRole":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyIAMInstanceProfileRole(ctx, field)
-			case "keySecretKey":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keySecretKey(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys", field.Name)
+			return nil, errors.New("field of type Int does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialsRef(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialsRef(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeType(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeType(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18800,7 +19330,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CredentialsRef, nil
+		return obj.BootVolumeType, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18812,32 +19342,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(*model.GithubComKloudliteOperatorApisCommonTypesSecretRef)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNGithub__com___kloudlite___operator___apis___common____types__SecretRef2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretRef(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialsRef(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeType(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "name":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretRef_name(ctx, field)
-			case "namespace":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretRef_namespace(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___common____types__SecretRef", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_credentials(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_credentials(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18850,7 +19374,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.KloudliteRelease, nil
+		return obj.Credentials, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18862,26 +19386,32 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*model.GithubComKloudliteOperatorApisCommonTypesSecretRef)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNGithub__com___kloudlite___operator___apis___common____types__SecretRef2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretRef(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_credentials(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "name":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretRef_name(ctx, field)
+			case "namespace":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___common____types__SecretRef_namespace(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___common____types__SecretRef", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_messageQueueTopicName(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_messageQueueTopicName(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_machineType(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_machineType(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18894,7 +19424,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.MessageQueueTopicName, nil
+		return obj.MachineType, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18911,9 +19441,9 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_messageQueueTopicName(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_machineType(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -18924,8 +19454,8 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_output(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_output(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_nodes(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_nodes(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18938,7 +19468,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Output, nil
+		return obj.Nodes, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -18947,44 +19477,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*model.GithubComKloudliteOperatorApisClustersV1ClusterOutput)
+	res := resTmp.(map[string]interface{})
 	fc.Result = res
-	return ec.marshalOGithub__com___kloudlite___operator___apis___clusters___v1__ClusterOutput2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1ClusterOutput(ctx, field.Selections, res)
+	return ec.marshalOMap2map(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_output(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_nodes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "jobName":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobName(ctx, field)
-			case "jobNamespace":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_jobNamespace(ctx, field)
-			case "keyAWSVPCId":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCId(ctx, field)
-			case "keyAWSVPCPublicSubnets":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyAWSVPCPublicSubnets(ctx, field)
-			case "keyK3sAgentJoinToken":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sAgentJoinToken(ctx, field)
-			case "keyK3sServerJoinToken":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyK3sServerJoinToken(ctx, field)
-			case "keyKubeconfig":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_keyKubeconfig(ctx, field)
-			case "secretName":
-				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput_secretName(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput", field.Name)
+			return nil, errors.New("field of type Map does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_publicDNSHost(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_publicDNSHost(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_poolType(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_poolType(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -18997,7 +19509,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.PublicDNSHost, nil
+		return obj.PoolType, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -19009,26 +19521,26 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(model.GithubComKloudliteOperatorApisClustersV1GCPPoolType)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNGithub__com___kloudlite___operator___apis___clusters___v1__GCPPoolType2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPPoolType(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_publicDNSHost(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_poolType(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_taintMasterNodes(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterSpec) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_taintMasterNodes(ctx, field)
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_region(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_region(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -19041,7 +19553,7 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.TaintMasterNodes, nil
+		return obj.Region, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -19053,19 +19565,19 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		}
 		return graphql.Null
 	}
-	res := resTmp.(bool)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_taintMasterNodes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_region(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec",
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
@@ -19351,6 +19863,65 @@ func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___ap
 	return fc, nil
 }
 
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_gcp(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1NodePoolSpec) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_gcp(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Gcp, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig)
+	fc.Result = res
+	return ec.marshalOGithub__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_gcp(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "availabilityZone":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_availabilityZone(ctx, field)
+			case "bootVolumeSize":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeSize(ctx, field)
+			case "bootVolumeType":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeType(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_credentials(ctx, field)
+			case "machineType":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_machineType(ctx, field)
+			case "nodes":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_nodes(ctx, field)
+			case "poolType":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_poolType(ctx, field)
+			case "region":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_region(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_maxCount(ctx context.Context, field graphql.CollectedField, obj *model.GithubComKloudliteOperatorApisClustersV1NodePoolSpec) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_maxCount(ctx, field)
 	if err != nil {
@@ -39105,6 +39676,8 @@ func (ec *executionContext) fieldContext_NodePool_spec(ctx context.Context, fiel
 				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_aws(ctx, field)
 			case "cloudProvider":
 				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_cloudProvider(ctx, field)
+			case "gcp":
+				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_gcp(ctx, field)
 			case "maxCount":
 				return ec.fieldContext_Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_maxCount(ctx, field)
 			case "minCount":
@@ -47406,33 +47979,53 @@ func (ec *executionContext) unmarshalInputDomainEntryIn(ctx context.Context, obj
 	return it, nil
 }
 
-func (ec *executionContext) unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentialsIn(ctx context.Context, obj interface{}) (model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentialsIn, error) {
-	var it model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentialsIn
+func (ec *executionContext) unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn(ctx context.Context, obj interface{}) (model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParamsIn, error) {
+	var it model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParamsIn
 	asMap := map[string]interface{}{}
 	for k, v := range obj.(map[string]interface{}) {
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"accessKey", "awsAccountId", "secretKey"}
+	fieldsInOrder := [...]string{"awsAccountId"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
 			continue
 		}
 		switch k {
-		case "accessKey":
+		case "awsAccountId":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("accessKey"))
-			it.AccessKey, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("awsAccountId"))
+			it.AwsAccountID, err = ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
-		case "awsAccountId":
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn(ctx context.Context, obj interface{}) (model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeysIn, error) {
+	var it model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeysIn
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"accessKey", "secretKey"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "accessKey":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("awsAccountId"))
-			it.AwsAccountID, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("accessKey"))
+			it.AccessKey, err = ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -47440,7 +48033,51 @@ func (ec *executionContext) unmarshalInputGithub__com___kloudlite___api___apps__
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretKey"))
-			it.SecretKey, err = ec.unmarshalOString2ᚖstring(ctx, v)
+			it.SecretKey, err = ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentialsIn(ctx context.Context, obj interface{}) (model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentialsIn, error) {
+	var it model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentialsIn
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"assumeRoleParams", "authMechanism", "authSecretKeys"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "assumeRoleParams":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("assumeRoleParams"))
+			it.AssumeRoleParams, err = ec.unmarshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParamsIn(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "authMechanism":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("authMechanism"))
+			it.AuthMechanism, err = ec.unmarshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsAuthMechanism(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "authSecretKeys":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("authSecretKeys"))
+			it.AuthSecretKeys, err = ec.unmarshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeysIn(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -47457,13 +48094,21 @@ func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___a
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"k3sMasters", "region"}
+	fieldsInOrder := [...]string{"credentials", "k3sMasters", "region"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
 			continue
 		}
 		switch k {
+		case "credentials":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("credentials"))
+			it.Credentials, err = ec.unmarshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsCredentialsIn(ctx, v)
+			if err != nil {
+				return it, err
+			}
 		case "k3sMasters":
 			var err error
 
@@ -47582,6 +48227,42 @@ func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___a
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn(ctx context.Context, obj interface{}) (model.GithubComKloudliteOperatorApisClustersV1AwsCredentialsIn, error) {
+	var it model.GithubComKloudliteOperatorApisClustersV1AwsCredentialsIn
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"authMechanism", "secretRef"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "authMechanism":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("authMechanism"))
+			it.AuthMechanism, err = ec.unmarshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsAuthMechanism(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "secretRef":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretRef"))
+			it.SecretRef, err = ec.unmarshalNGithub__com___kloudlite___operator___apis___common____types__SecretRefIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretRefIn(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfigIn(ctx context.Context, obj interface{}) (model.GithubComKloudliteOperatorApisClustersV1AwsEC2PoolConfigIn, error) {
 	var it model.GithubComKloudliteOperatorApisClustersV1AwsEC2PoolConfigIn
 	asMap := map[string]interface{}{}
@@ -47733,7 +48414,7 @@ func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___a
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"availabilityMode", "aws", "cloudflareEnabled", "cloudProvider", "credentialsRef"}
+	fieldsInOrder := [...]string{"availabilityMode", "aws", "cloudflareEnabled", "cloudProvider"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -47772,11 +48453,87 @@ func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___a
 			if err != nil {
 				return it, err
 			}
-		case "credentialsRef":
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn(ctx context.Context, obj interface{}) (model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfigIn, error) {
+	var it model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfigIn
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"availabilityZone", "bootVolumeSize", "bootVolumeType", "credentials", "machineType", "nodes", "poolType", "region"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "availabilityZone":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("availabilityZone"))
+			it.AvailabilityZone, err = ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "bootVolumeSize":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("bootVolumeSize"))
+			it.BootVolumeSize, err = ec.unmarshalNInt2int(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "bootVolumeType":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("bootVolumeType"))
+			it.BootVolumeType, err = ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "credentials":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("credentials"))
+			it.Credentials, err = ec.unmarshalNGithub__com___kloudlite___operator___apis___common____types__SecretRefIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretRefIn(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "machineType":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("machineType"))
+			it.MachineType, err = ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "nodes":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nodes"))
+			it.Nodes, err = ec.unmarshalOMap2map(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "poolType":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("poolType"))
+			it.PoolType, err = ec.unmarshalNGithub__com___kloudlite___operator___apis___clusters___v1__GCPPoolType2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPPoolType(ctx, v)
+			if err != nil {
+				return it, err
+			}
+		case "region":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("credentialsRef"))
-			it.CredentialsRef, err = ec.unmarshalNGithub__com___kloudlite___operator___apis___common____types__SecretRefIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesSecretRefIn(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("region"))
+			it.Region, err = ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -47793,7 +48550,7 @@ func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___a
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"aws", "cloudProvider", "maxCount", "minCount", "nodeLabels", "nodeTaints"}
+	fieldsInOrder := [...]string{"aws", "cloudProvider", "gcp", "maxCount", "minCount", "nodeLabels", "nodeTaints"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -47816,6 +48573,14 @@ func (ec *executionContext) unmarshalInputGithub__com___kloudlite___operator___a
 			if err != nil {
 				return it, err
 			}
+		case "gcp":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("gcp"))
+			it.Gcp, err = ec.unmarshalOGithub__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPNodePoolConfigIn(ctx, v)
+			if err != nil {
+				return it, err
+			}
 		case "maxCount":
 			var err error
 
@@ -53254,6 +54019,97 @@ func (ec *executionContext) _EncodedValue(ctx context.Context, sel ast.Selection
 	return out
 }
 
+var github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsImplementors = []string{"Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams"}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsImplementors)
+	out := graphql.NewFieldSet(fields)
+	var invalids uint32
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams")
+		case "awsAccountId":
+
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_awsAccountId(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "cfParamTrustedARN":
+
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_cfParamTrustedARN(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "externalID":
+
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_externalID(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "roleARN":
+
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams_roleARN(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch()
+	if invalids > 0 {
+		return graphql.Null
+	}
+	return out
+}
+
+var github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysImplementors = []string{"Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys"}
+
+func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysImplementors)
+	out := graphql.NewFieldSet(fields)
+	var invalids uint32
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys")
+		case "accessKey":
+
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_accessKey(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "cfParamUserName":
+
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_cfParamUserName(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "secretKey":
+
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys_secretKey(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch()
+	if invalids > 0 {
+		return graphql.Null
+	}
+	return out
+}
+
 var github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentialsImplementors = []string{"Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials"}
 
 func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) graphql.Marshaler {
@@ -53264,17 +54120,20 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials")
-		case "accessKey":
+		case "assumeRoleParams":
 
-			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_accessKey(ctx, field, obj)
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_assumeRoleParams(ctx, field, obj)
 
-		case "awsAccountId":
+		case "authMechanism":
 
-			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_awsAccountId(ctx, field, obj)
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authMechanism(ctx, field, obj)
 
-		case "cfParamExternalID":
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "authSecretKeys":
 
-			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamExternalID(ctx, field, obj)
+			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_authSecretKeys(ctx, field, obj)
 
 		case "cfParamInstanceProfileName":
 
@@ -53288,14 +54147,6 @@ func (ec *executionContext) _Github__com___kloudlite___api___apps___infra___inte
 
 			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamStackName(ctx, field, obj)
 
-		case "cfParamTrustedARN":
-
-			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_cfParamTrustedARN(ctx, field, obj)
-
-		case "secretKey":
-
-			out.Values[i] = ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials_secretKey(ctx, field, obj)
-
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -53752,6 +54603,13 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig")
+		case "credentials":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_credentials(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
 		case "k3sMasters":
 
 			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig_k3sMasters(ctx, field, obj)
@@ -53925,6 +54783,41 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return out
 }
 
+var github__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsImplementors = []string{"Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials"}
+
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteOperatorApisClustersV1AwsCredentials) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, github__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsImplementors)
+	out := graphql.NewFieldSet(fields)
+	var invalids uint32
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials")
+		case "authMechanism":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_authMechanism(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "secretRef":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials_secretRef(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch()
+	if invalids > 0 {
+		return graphql.Null
+	}
+	return out
+}
+
 var github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfigImplementors = []string{"Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig"}
 
 func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteOperatorApisClustersV1AwsEC2PoolConfig) graphql.Marshaler {
@@ -54127,69 +55020,6 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return out
 }
 
-var github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeysImplementors = []string{"Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys"}
-
-func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeysImplementors)
-	out := graphql.NewFieldSet(fields)
-	var invalids uint32
-	for i, field := range fields {
-		switch field.Name {
-		case "__typename":
-			out.Values[i] = graphql.MarshalString("Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys")
-		case "keyAccessKey":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAccessKey(ctx, field, obj)
-
-			if out.Values[i] == graphql.Null {
-				invalids++
-			}
-		case "keyAWSAccountId":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAccountId(ctx, field, obj)
-
-			if out.Values[i] == graphql.Null {
-				invalids++
-			}
-		case "keyAWSAssumeRoleExternalID":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleExternalID(ctx, field, obj)
-
-			if out.Values[i] == graphql.Null {
-				invalids++
-			}
-		case "keyAWSAssumeRoleRoleARN":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyAWSAssumeRoleRoleARN(ctx, field, obj)
-
-			if out.Values[i] == graphql.Null {
-				invalids++
-			}
-		case "keyIAMInstanceProfileRole":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keyIAMInstanceProfileRole(ctx, field, obj)
-
-			if out.Values[i] == graphql.Null {
-				invalids++
-			}
-		case "keySecretKey":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys_keySecretKey(ctx, field, obj)
-
-			if out.Values[i] == graphql.Null {
-				invalids++
-			}
-		default:
-			panic("unknown field " + strconv.Quote(field.Name))
-		}
-	}
-	out.Dispatch()
-	if invalids > 0 {
-		return graphql.Null
-	}
-	return out
-}
-
 var github__com___kloudlite___operator___apis___clusters___v1__ClusterOutputImplementors = []string{"Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput"}
 
 func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) graphql.Marshaler {
@@ -54322,17 +55152,6 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 
 			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_clusterTokenRef(ctx, field, obj)
 
-		case "credentialKeys":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialKeys(ctx, field, obj)
-
-		case "credentialsRef":
-
-			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_credentialsRef(ctx, field, obj)
-
-			if out.Values[i] == graphql.Null {
-				invalids++
-			}
 		case "kloudliteRelease":
 
 			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec_kloudliteRelease(ctx, field, obj)
@@ -54376,6 +55195,80 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 	return out
 }
 
+var github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigImplementors = []string{"Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig"}
+
+func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigImplementors)
+	out := graphql.NewFieldSet(fields)
+	var invalids uint32
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig")
+		case "availabilityZone":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_availabilityZone(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "bootVolumeSize":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeSize(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "bootVolumeType":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_bootVolumeType(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "credentials":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_credentials(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "machineType":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_machineType(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "nodes":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_nodes(ctx, field, obj)
+
+		case "poolType":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_poolType(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		case "region":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig_region(ctx, field, obj)
+
+			if out.Values[i] == graphql.Null {
+				invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch()
+	if invalids > 0 {
+		return graphql.Null
+	}
+	return out
+}
+
 var github__com___kloudlite___operator___apis___clusters___v1__MasterNodePropsImplementors = []string{"Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps"}
 
 func (ec *executionContext) _Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps(ctx context.Context, sel ast.SelectionSet, obj *model.GithubComKloudliteOperatorApisClustersV1MasterNodeProps) graphql.Marshaler {
@@ -54443,6 +55336,10 @@ func (ec *executionContext) _Github__com___kloudlite___operator___apis___cluster
 			if out.Values[i] == graphql.Null {
 				invalids++
 			}
+		case "gcp":
+
+			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_gcp(ctx, field, obj)
+
 		case "maxCount":
 
 			out.Values[i] = ec._Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec_maxCount(ctx, field, obj)
@@ -61205,6 +62102,31 @@ func (ec *executionContext) marshalNGithub__com___kloudlite___operator___apis___
 	return v
 }
 
+func (ec *executionContext) unmarshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsAuthMechanism(ctx context.Context, v interface{}) (model.GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism, error) {
+	var res model.GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism
+	err := res.UnmarshalGQL(v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsAuthMechanism(ctx context.Context, sel ast.SelectionSet, v model.GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism) graphql.Marshaler {
+	return v
+}
+
+func (ec *executionContext) marshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsCredentials2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsCredentials(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteOperatorApisClustersV1AwsCredentials) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsCredentialsIn(ctx context.Context, v interface{}) (*model.GithubComKloudliteOperatorApisClustersV1AwsCredentialsIn, error) {
+	res, err := ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
 func (ec *executionContext) marshalNGithub__com___kloudlite___operator___apis___clusters___v1__AwsSubnetWithID2ᚕᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1AwsSubnetWithIDᚄ(ctx context.Context, sel ast.SelectionSet, v []*model.GithubComKloudliteOperatorApisClustersV1AwsSubnetWithID) graphql.Marshaler {
 	ret := make(graphql.Array, len(v))
 	var wg sync.WaitGroup
@@ -61293,6 +62215,16 @@ func (ec *executionContext) unmarshalNGithub__com___kloudlite___operator___apis_
 	return &res, graphql.ErrorOnPath(ctx, err)
 }
 
+func (ec *executionContext) unmarshalNGithub__com___kloudlite___operator___apis___clusters___v1__GCPPoolType2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPPoolType(ctx context.Context, v interface{}) (model.GithubComKloudliteOperatorApisClustersV1GCPPoolType, error) {
+	var res model.GithubComKloudliteOperatorApisClustersV1GCPPoolType
+	err := res.UnmarshalGQL(v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNGithub__com___kloudlite___operator___apis___clusters___v1__GCPPoolType2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPPoolType(ctx context.Context, sel ast.SelectionSet, v model.GithubComKloudliteOperatorApisClustersV1GCPPoolType) graphql.Marshaler {
+	return v
+}
+
 func (ec *executionContext) marshalNGithub__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec2githubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1NodePoolSpec(ctx context.Context, sel ast.SelectionSet, v model.GithubComKloudliteOperatorApisClustersV1NodePoolSpec) graphql.Marshaler {
 	return ec._Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec(ctx, sel, &v)
 }
@@ -62853,6 +63785,36 @@ func (ec *executionContext) marshalOFloat2ᚖfloat64(ctx context.Context, sel as
 	return graphql.WrapContextMarshaler(ctx, res)
 }
 
+func (ec *executionContext) marshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	return ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParamsIn(ctx context.Context, v interface{}) (*model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParamsIn, error) {
+	if v == nil {
+		return nil, nil
+	}
+	res, err := ec.unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	return ec._Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeysIn(ctx context.Context, v interface{}) (*model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeysIn, error) {
+	if v == nil {
+		return nil, nil
+	}
+	res, err := ec.unmarshalInputGithub__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
 func (ec *executionContext) marshalOGithub__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials) graphql.Marshaler {
 	if v == nil {
 		return graphql.Null
@@ -62987,18 +63949,26 @@ func (ec *executionContext) marshalOGithub__com___kloudlite___operator___apis___
 	return ec._Github__com___kloudlite___operator___apis___clusters___v1__AwsVPCParams(ctx, sel, v)
 }
 
-func (ec *executionContext) marshalOGithub__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys) graphql.Marshaler {
+func (ec *executionContext) marshalOGithub__com___kloudlite___operator___apis___clusters___v1__ClusterOutput2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1ClusterOutput(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) graphql.Marshaler {
 	if v == nil {
 		return graphql.Null
 	}
-	return ec._Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys(ctx, sel, v)
+	return ec._Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput(ctx, sel, v)
 }
 
-func (ec *executionContext) marshalOGithub__com___kloudlite___operator___apis___clusters___v1__ClusterOutput2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1ClusterOutput(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteOperatorApisClustersV1ClusterOutput) graphql.Marshaler {
+func (ec *executionContext) marshalOGithub__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig) graphql.Marshaler {
 	if v == nil {
 		return graphql.Null
 	}
-	return ec._Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput(ctx, sel, v)
+	return ec._Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalOGithub__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisClustersV1GCPNodePoolConfigIn(ctx context.Context, v interface{}) (*model.GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfigIn, error) {
+	if v == nil {
+		return nil, nil
+	}
+	res, err := ec.unmarshalInputGithub__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
 }
 
 func (ec *executionContext) marshalOGithub__com___kloudlite___operator___apis___common____types__MinMaxFloat2ᚖgithubᚗcomᚋkloudliteᚋapiᚋappsᚋinfraᚋinternalᚋappᚋgraphᚋmodelᚐGithubComKloudliteOperatorApisCommonTypesMinMaxFloat(ctx context.Context, sel ast.SelectionSet, v *model.GithubComKloudliteOperatorApisCommonTypesMinMaxFloat) graphql.Marshaler {
diff --git a/apps/infra/internal/app/graph/model/models_gen.go b/apps/infra/internal/app/graph/model/models_gen.go
index a911f2684..d3ff58b58 100644
--- a/apps/infra/internal/app/graph/model/models_gen.go
+++ b/apps/infra/internal/app/graph/model/models_gen.go
@@ -67,21 +67,41 @@ type EncodedValue struct {
 	Encoding string `json:"encoding"`
 }
 
+type GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams struct {
+	AwsAccountID      string `json:"awsAccountId"`
+	CfParamTrustedArn string `json:"cfParamTrustedARN"`
+	ExternalID        string `json:"externalID"`
+	RoleArn           string `json:"roleARN"`
+}
+
+type GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParamsIn struct {
+	AwsAccountID string `json:"awsAccountId"`
+}
+
+type GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys struct {
+	AccessKey       string `json:"accessKey"`
+	CfParamUserName string `json:"cfParamUserName"`
+	SecretKey       string `json:"secretKey"`
+}
+
+type GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeysIn struct {
+	AccessKey string `json:"accessKey"`
+	SecretKey string `json:"secretKey"`
+}
+
 type GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentials struct {
-	AccessKey                  *string `json:"accessKey,omitempty"`
-	AwsAccountID               *string `json:"awsAccountId,omitempty"`
-	CfParamExternalID          *string `json:"cfParamExternalID,omitempty"`
-	CfParamInstanceProfileName *string `json:"cfParamInstanceProfileName,omitempty"`
-	CfParamRoleName            *string `json:"cfParamRoleName,omitempty"`
-	CfParamStackName           *string `json:"cfParamStackName,omitempty"`
-	CfParamTrustedArn          *string `json:"cfParamTrustedARN,omitempty"`
-	SecretKey                  *string `json:"secretKey,omitempty"`
+	AssumeRoleParams           *GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParams `json:"assumeRoleParams,omitempty"`
+	AuthMechanism              GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism           `json:"authMechanism"`
+	AuthSecretKeys             *GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeys   `json:"authSecretKeys,omitempty"`
+	CfParamInstanceProfileName *string                                                            `json:"cfParamInstanceProfileName,omitempty"`
+	CfParamRoleName            *string                                                            `json:"cfParamRoleName,omitempty"`
+	CfParamStackName           *string                                                            `json:"cfParamStackName,omitempty"`
 }
 
 type GithubComKloudliteAPIAppsInfraInternalEntitiesAWSSecretCredentialsIn struct {
-	AccessKey    *string `json:"accessKey,omitempty"`
-	AwsAccountID *string `json:"awsAccountId,omitempty"`
-	SecretKey    *string `json:"secretKey,omitempty"`
+	AssumeRoleParams *GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAssumeRoleParamsIn `json:"assumeRoleParams,omitempty"`
+	AuthMechanism    GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism             `json:"authMechanism"`
+	AuthSecretKeys   *GithubComKloudliteAPIAppsInfraInternalEntitiesAWSAuthSecretKeysIn   `json:"authSecretKeys,omitempty"`
 }
 
 type GithubComKloudliteAPIAppsInfraInternalEntitiesInputField struct {
@@ -114,6 +134,7 @@ type GithubComKloudliteAPIAppsInfraInternalEntitiesOutputField struct {
 }
 
 type GithubComKloudliteOperatorApisClustersV1AWSClusterConfig struct {
+	Credentials   *GithubComKloudliteOperatorApisClustersV1AwsCredentials      `json:"credentials"`
 	K3sMasters    *GithubComKloudliteOperatorApisClustersV1AWSK3sMastersConfig `json:"k3sMasters,omitempty"`
 	NodePools     map[string]interface{}                                       `json:"nodePools,omitempty"`
 	Region        string                                                       `json:"region"`
@@ -122,8 +143,9 @@ type GithubComKloudliteOperatorApisClustersV1AWSClusterConfig struct {
 }
 
 type GithubComKloudliteOperatorApisClustersV1AWSClusterConfigIn struct {
-	K3sMasters *GithubComKloudliteOperatorApisClustersV1AWSK3sMastersConfigIn `json:"k3sMasters,omitempty"`
-	Region     string                                                         `json:"region"`
+	Credentials *GithubComKloudliteOperatorApisClustersV1AwsCredentialsIn      `json:"credentials"`
+	K3sMasters  *GithubComKloudliteOperatorApisClustersV1AWSK3sMastersConfigIn `json:"k3sMasters,omitempty"`
+	Region      string                                                         `json:"region"`
 }
 
 type GithubComKloudliteOperatorApisClustersV1AWSK3sMastersConfig struct {
@@ -161,6 +183,16 @@ type GithubComKloudliteOperatorApisClustersV1AWSNodePoolConfigIn struct {
 	SpotPool         *GithubComKloudliteOperatorApisClustersV1AwsSpotPoolConfigIn `json:"spotPool,omitempty"`
 }
 
+type GithubComKloudliteOperatorApisClustersV1AwsCredentials struct {
+	AuthMechanism GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism `json:"authMechanism"`
+	SecretRef     *GithubComKloudliteOperatorApisCommonTypesSecretRef      `json:"secretRef"`
+}
+
+type GithubComKloudliteOperatorApisClustersV1AwsCredentialsIn struct {
+	AuthMechanism GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism `json:"authMechanism"`
+	SecretRef     *GithubComKloudliteOperatorApisCommonTypesSecretRefIn    `json:"secretRef"`
+}
+
 type GithubComKloudliteOperatorApisClustersV1AwsEC2PoolConfig struct {
 	InstanceType string                 `json:"instanceType"`
 	Nodes        map[string]interface{} `json:"nodes,omitempty"`
@@ -212,15 +244,6 @@ type GithubComKloudliteOperatorApisClustersV1AwsVPCParams struct {
 	PublicSubnets []*GithubComKloudliteOperatorApisClustersV1AwsSubnetWithID `json:"publicSubnets"`
 }
 
-type GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys struct {
-	KeyAccessKey               string `json:"keyAccessKey"`
-	KeyAWSAccountID            string `json:"keyAWSAccountId"`
-	KeyAWSAssumeRoleExternalID string `json:"keyAWSAssumeRoleExternalID"`
-	KeyAWSAssumeRoleRoleArn    string `json:"keyAWSAssumeRoleRoleARN"`
-	KeyIAMInstanceProfileRole  string `json:"keyIAMInstanceProfileRole"`
-	KeySecretKey               string `json:"keySecretKey"`
-}
-
 type GithubComKloudliteOperatorApisClustersV1ClusterOutput struct {
 	JobName                string  `json:"jobName"`
 	JobNamespace           string  `json:"jobNamespace"`
@@ -233,22 +256,20 @@ type GithubComKloudliteOperatorApisClustersV1ClusterOutput struct {
 }
 
 type GithubComKloudliteOperatorApisClustersV1ClusterSpec struct {
-	AccountID              string                                                               `json:"accountId"`
-	AccountName            string                                                               `json:"accountName"`
-	AvailabilityMode       GithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode  `json:"availabilityMode"`
-	Aws                    *GithubComKloudliteOperatorApisClustersV1AWSClusterConfig            `json:"aws,omitempty"`
-	BackupToS3Enabled      bool                                                                 `json:"backupToS3Enabled"`
-	CloudflareEnabled      *bool                                                                `json:"cloudflareEnabled,omitempty"`
-	CloudProvider          GithubComKloudliteOperatorApisCommonTypesCloudProvider               `json:"cloudProvider"`
-	ClusterInternalDNSHost *string                                                              `json:"clusterInternalDnsHost,omitempty"`
-	ClusterTokenRef        *GithubComKloudliteOperatorApisCommonTypesSecretKeyRef               `json:"clusterTokenRef,omitempty"`
-	CredentialKeys         *GithubComKloudliteOperatorApisClustersV1CloudProviderCredentialKeys `json:"credentialKeys,omitempty"`
-	CredentialsRef         *GithubComKloudliteOperatorApisCommonTypesSecretRef                  `json:"credentialsRef"`
-	KloudliteRelease       string                                                               `json:"kloudliteRelease"`
-	MessageQueueTopicName  string                                                               `json:"messageQueueTopicName"`
-	Output                 *GithubComKloudliteOperatorApisClustersV1ClusterOutput               `json:"output,omitempty"`
-	PublicDNSHost          string                                                               `json:"publicDNSHost"`
-	TaintMasterNodes       bool                                                                 `json:"taintMasterNodes"`
+	AccountID              string                                                              `json:"accountId"`
+	AccountName            string                                                              `json:"accountName"`
+	AvailabilityMode       GithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode `json:"availabilityMode"`
+	Aws                    *GithubComKloudliteOperatorApisClustersV1AWSClusterConfig           `json:"aws,omitempty"`
+	BackupToS3Enabled      bool                                                                `json:"backupToS3Enabled"`
+	CloudflareEnabled      *bool                                                               `json:"cloudflareEnabled,omitempty"`
+	CloudProvider          GithubComKloudliteOperatorApisCommonTypesCloudProvider              `json:"cloudProvider"`
+	ClusterInternalDNSHost *string                                                             `json:"clusterInternalDnsHost,omitempty"`
+	ClusterTokenRef        *GithubComKloudliteOperatorApisCommonTypesSecretKeyRef              `json:"clusterTokenRef,omitempty"`
+	KloudliteRelease       string                                                              `json:"kloudliteRelease"`
+	MessageQueueTopicName  string                                                              `json:"messageQueueTopicName"`
+	Output                 *GithubComKloudliteOperatorApisClustersV1ClusterOutput              `json:"output,omitempty"`
+	PublicDNSHost          string                                                              `json:"publicDNSHost"`
+	TaintMasterNodes       bool                                                                `json:"taintMasterNodes"`
 }
 
 type GithubComKloudliteOperatorApisClustersV1ClusterSpecIn struct {
@@ -256,7 +277,28 @@ type GithubComKloudliteOperatorApisClustersV1ClusterSpecIn struct {
 	Aws               *GithubComKloudliteOperatorApisClustersV1AWSClusterConfigIn         `json:"aws,omitempty"`
 	CloudflareEnabled *bool                                                               `json:"cloudflareEnabled,omitempty"`
 	CloudProvider     GithubComKloudliteOperatorApisCommonTypesCloudProvider              `json:"cloudProvider"`
-	CredentialsRef    *GithubComKloudliteOperatorApisCommonTypesSecretRefIn               `json:"credentialsRef"`
+}
+
+type GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig struct {
+	AvailabilityZone string                                              `json:"availabilityZone"`
+	BootVolumeSize   int                                                 `json:"bootVolumeSize"`
+	BootVolumeType   string                                              `json:"bootVolumeType"`
+	Credentials      *GithubComKloudliteOperatorApisCommonTypesSecretRef `json:"credentials"`
+	MachineType      string                                              `json:"machineType"`
+	Nodes            map[string]interface{}                              `json:"nodes,omitempty"`
+	PoolType         GithubComKloudliteOperatorApisClustersV1GCPPoolType `json:"poolType"`
+	Region           string                                              `json:"region"`
+}
+
+type GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfigIn struct {
+	AvailabilityZone string                                                `json:"availabilityZone"`
+	BootVolumeSize   int                                                   `json:"bootVolumeSize"`
+	BootVolumeType   string                                                `json:"bootVolumeType"`
+	Credentials      *GithubComKloudliteOperatorApisCommonTypesSecretRefIn `json:"credentials"`
+	MachineType      string                                                `json:"machineType"`
+	Nodes            map[string]interface{}                                `json:"nodes,omitempty"`
+	PoolType         GithubComKloudliteOperatorApisClustersV1GCPPoolType   `json:"poolType"`
+	Region           string                                                `json:"region"`
 }
 
 type GithubComKloudliteOperatorApisClustersV1MasterNodeProps struct {
@@ -269,6 +311,7 @@ type GithubComKloudliteOperatorApisClustersV1MasterNodeProps struct {
 type GithubComKloudliteOperatorApisClustersV1NodePoolSpec struct {
 	Aws           *GithubComKloudliteOperatorApisClustersV1AWSNodePoolConfig `json:"aws,omitempty"`
 	CloudProvider GithubComKloudliteOperatorApisCommonTypesCloudProvider     `json:"cloudProvider"`
+	Gcp           *GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfig `json:"gcp,omitempty"`
 	MaxCount      int                                                        `json:"maxCount"`
 	MinCount      int                                                        `json:"minCount"`
 	NodeLabels    map[string]interface{}                                     `json:"nodeLabels,omitempty"`
@@ -278,6 +321,7 @@ type GithubComKloudliteOperatorApisClustersV1NodePoolSpec struct {
 type GithubComKloudliteOperatorApisClustersV1NodePoolSpecIn struct {
 	Aws           *GithubComKloudliteOperatorApisClustersV1AWSNodePoolConfigIn `json:"aws,omitempty"`
 	CloudProvider GithubComKloudliteOperatorApisCommonTypesCloudProvider       `json:"cloudProvider"`
+	Gcp           *GithubComKloudliteOperatorApisClustersV1GCPNodePoolConfigIn `json:"gcp,omitempty"`
 	MaxCount      int                                                          `json:"maxCount"`
 	MinCount      int                                                          `json:"minCount"`
 	NodeLabels    map[string]interface{}                                       `json:"nodeLabels,omitempty"`
@@ -1420,6 +1464,47 @@ func (e GithubComKloudliteOperatorApisClustersV1AWSPoolType) MarshalGQL(w io.Wri
 	fmt.Fprint(w, strconv.Quote(e.String()))
 }
 
+type GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism string
+
+const (
+	GithubComKloudliteOperatorApisClustersV1AwsAuthMechanismAssumeRole GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism = "assume_role"
+	GithubComKloudliteOperatorApisClustersV1AwsAuthMechanismSecretKeys GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism = "secret_keys"
+)
+
+var AllGithubComKloudliteOperatorApisClustersV1AwsAuthMechanism = []GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism{
+	GithubComKloudliteOperatorApisClustersV1AwsAuthMechanismAssumeRole,
+	GithubComKloudliteOperatorApisClustersV1AwsAuthMechanismSecretKeys,
+}
+
+func (e GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism) IsValid() bool {
+	switch e {
+	case GithubComKloudliteOperatorApisClustersV1AwsAuthMechanismAssumeRole, GithubComKloudliteOperatorApisClustersV1AwsAuthMechanismSecretKeys:
+		return true
+	}
+	return false
+}
+
+func (e GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism) String() string {
+	return string(e)
+}
+
+func (e *GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism) UnmarshalGQL(v interface{}) error {
+	str, ok := v.(string)
+	if !ok {
+		return fmt.Errorf("enums must be strings")
+	}
+
+	*e = GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism(str)
+	if !e.IsValid() {
+		return fmt.Errorf("%s is not a valid Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism", str)
+	}
+	return nil
+}
+
+func (e GithubComKloudliteOperatorApisClustersV1AwsAuthMechanism) MarshalGQL(w io.Writer) {
+	fmt.Fprint(w, strconv.Quote(e.String()))
+}
+
 type GithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode string
 
 const (
@@ -1461,6 +1546,47 @@ func (e GithubComKloudliteOperatorApisClustersV1ClusterSpecAvailabilityMode) Mar
 	fmt.Fprint(w, strconv.Quote(e.String()))
 }
 
+type GithubComKloudliteOperatorApisClustersV1GCPPoolType string
+
+const (
+	GithubComKloudliteOperatorApisClustersV1GCPPoolTypeSpot     GithubComKloudliteOperatorApisClustersV1GCPPoolType = "SPOT"
+	GithubComKloudliteOperatorApisClustersV1GCPPoolTypeStandard GithubComKloudliteOperatorApisClustersV1GCPPoolType = "STANDARD"
+)
+
+var AllGithubComKloudliteOperatorApisClustersV1GCPPoolType = []GithubComKloudliteOperatorApisClustersV1GCPPoolType{
+	GithubComKloudliteOperatorApisClustersV1GCPPoolTypeSpot,
+	GithubComKloudliteOperatorApisClustersV1GCPPoolTypeStandard,
+}
+
+func (e GithubComKloudliteOperatorApisClustersV1GCPPoolType) IsValid() bool {
+	switch e {
+	case GithubComKloudliteOperatorApisClustersV1GCPPoolTypeSpot, GithubComKloudliteOperatorApisClustersV1GCPPoolTypeStandard:
+		return true
+	}
+	return false
+}
+
+func (e GithubComKloudliteOperatorApisClustersV1GCPPoolType) String() string {
+	return string(e)
+}
+
+func (e *GithubComKloudliteOperatorApisClustersV1GCPPoolType) UnmarshalGQL(v interface{}) error {
+	str, ok := v.(string)
+	if !ok {
+		return fmt.Errorf("enums must be strings")
+	}
+
+	*e = GithubComKloudliteOperatorApisClustersV1GCPPoolType(str)
+	if !e.IsValid() {
+		return fmt.Errorf("%s is not a valid Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType", str)
+	}
+	return nil
+}
+
+func (e GithubComKloudliteOperatorApisClustersV1GCPPoolType) MarshalGQL(w io.Writer) {
+	fmt.Fprint(w, strconv.Quote(e.String()))
+}
+
 type GithubComKloudliteOperatorApisCommonTypesCloudProvider string
 
 const (
diff --git a/apps/infra/internal/app/graph/schema.graphqls b/apps/infra/internal/app/graph/schema.graphqls
index cf325fd7d..00a0f6dac 100644
--- a/apps/infra/internal/app/graph/schema.graphqls
+++ b/apps/infra/internal/app/graph/schema.graphqls
@@ -86,6 +86,8 @@ type Query {
     infra_listDomainEntries(search: SearchDomainEntry, pagination: CursorPaginationIn): DomainEntryPaginatedRecords @isLoggedInAndVerified @hasAccount
     infra_getDomainEntry(domainName: String!): DomainEntry @isLoggedInAndVerified @hasAccount
 
+    # infra_getAwsCloudformationStackURL: String
+
     infra_checkAwsAccess(cloudproviderName: String!): CheckAwsAccessOutput! @isLoggedInAndVerified @hasAccount
 
     infra_listClusterManagedServices(clusterName: String!, search: SearchClusterManagedService, pagination: CursorPaginationIn): ClusterManagedServicePaginatedRecords @isLoggedInAndVerified @hasAccount
diff --git a/apps/infra/internal/app/graph/struct-to-graphql/common-types.graphqls b/apps/infra/internal/app/graph/struct-to-graphql/common-types.graphqls
index b8a1951e7..86ba9ab71 100644
--- a/apps/infra/internal/app/graph/struct-to-graphql/common-types.graphqls
+++ b/apps/infra/internal/app/graph/struct-to-graphql/common-types.graphqls
@@ -1,12 +1,23 @@
+type Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams @shareable {
+  awsAccountId: String!
+  cfParamTrustedARN: String!
+  externalID: String!
+  roleARN: String!
+}
+
+type Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys @shareable {
+  accessKey: String!
+  cfParamUserName: String!
+  secretKey: String!
+}
+
 type Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentials @shareable {
-  accessKey: String
-  awsAccountId: String
-  cfParamExternalID: String
+  assumeRoleParams: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParams
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  authSecretKeys: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeys
   cfParamInstanceProfileName: String
   cfParamRoleName: String
   cfParamStackName: String
-  cfParamTrustedARN: String
-  secretKey: String
 }
 
 type Github__com___kloudlite___api___apps___infra___internal___entities__InputField @shareable {
@@ -67,6 +78,7 @@ type Github__com___kloudlite___api___pkg___types__SyncStatus @shareable {
 }
 
 type Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfig @shareable {
+  credentials: Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials!
   k3sMasters: Github__com___kloudlite___operator___apis___clusters___v1__AWSK3sMastersConfig
   nodePools: Map
   region: String!
@@ -96,6 +108,11 @@ type Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfi
   vpcSubnetId: String!
 }
 
+type Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentials @shareable {
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  secretRef: Github__com___kloudlite___operator___apis___common____types__SecretRef!
+}
+
 type Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfig @shareable {
   instanceType: String!
   nodes: Map
@@ -127,15 +144,6 @@ type Github__com___kloudlite___operator___apis___clusters___v1__AwsVPCParams @sh
   publicSubnets: [Github__com___kloudlite___operator___apis___clusters___v1__AwsSubnetWithID!]!
 }
 
-type Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys @shareable {
-  keyAccessKey: String!
-  keyAWSAccountId: String!
-  keyAWSAssumeRoleExternalID: String!
-  keyAWSAssumeRoleRoleARN: String!
-  keyIAMInstanceProfileRole: String!
-  keySecretKey: String!
-}
-
 type Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput @shareable {
   jobName: String!
   jobNamespace: String!
@@ -157,8 +165,6 @@ type Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec @sha
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
   clusterInternalDnsHost: String
   clusterTokenRef: Github__com___kloudlite___operator___apis___common____types__SecretKeyRef
-  credentialKeys: Github__com___kloudlite___operator___apis___clusters___v1__CloudProviderCredentialKeys
-  credentialsRef: Github__com___kloudlite___operator___apis___common____types__SecretRef!
   kloudliteRelease: String!
   messageQueueTopicName: String!
   output: Github__com___kloudlite___operator___apis___clusters___v1__ClusterOutput
@@ -166,6 +172,17 @@ type Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpec @sha
   taintMasterNodes: Boolean!
 }
 
+type Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig @shareable {
+  availabilityZone: String!
+  bootVolumeSize: Int!
+  bootVolumeType: String!
+  credentials: Github__com___kloudlite___operator___apis___common____types__SecretRef!
+  machineType: String!
+  nodes: Map
+  poolType: Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType!
+  region: String!
+}
+
 type Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps @shareable {
   availabilityZone: String!
   kloudliteRelease: String!
@@ -176,6 +193,7 @@ type Github__com___kloudlite___operator___apis___clusters___v1__MasterNodeProps
 type Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpec @shareable {
   aws: Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfig
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
+  gcp: Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfig
   maxCount: Int!
   minCount: Int!
   nodeLabels: Map
@@ -720,13 +738,23 @@ type PageInfo @shareable {
   startCursor: String
 }
 
+input Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn {
+  awsAccountId: String!
+}
+
+input Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn {
+  accessKey: String!
+  secretKey: String!
+}
+
 input Github__com___kloudlite___api___apps___infra___internal___entities__AWSSecretCredentialsIn {
-  accessKey: String
-  awsAccountId: String
-  secretKey: String
+  assumeRoleParams: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAssumeRoleParamsIn
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  authSecretKeys: Github__com___kloudlite___api___apps___infra___internal___entities__AWSAuthSecretKeysIn
 }
 
 input Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfigIn {
+  credentials: Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn!
   k3sMasters: Github__com___kloudlite___operator___apis___clusters___v1__AWSK3sMastersConfigIn
   region: String!
 }
@@ -744,6 +772,11 @@ input Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConf
   spotPool: Github__com___kloudlite___operator___apis___clusters___v1__AwsSpotPoolConfigIn
 }
 
+input Github__com___kloudlite___operator___apis___clusters___v1__AwsCredentialsIn {
+  authMechanism: Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism!
+  secretRef: Github__com___kloudlite___operator___apis___common____types__SecretRefIn!
+}
+
 input Github__com___kloudlite___operator___apis___clusters___v1__AwsEC2PoolConfigIn {
   instanceType: String!
   nodes: Map
@@ -769,12 +802,23 @@ input Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpecIn {
   aws: Github__com___kloudlite___operator___apis___clusters___v1__AWSClusterConfigIn
   cloudflareEnabled: Boolean
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
-  credentialsRef: Github__com___kloudlite___operator___apis___common____types__SecretRefIn!
+}
+
+input Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn {
+  availabilityZone: String!
+  bootVolumeSize: Int!
+  bootVolumeType: String!
+  credentials: Github__com___kloudlite___operator___apis___common____types__SecretRefIn!
+  machineType: String!
+  nodes: Map
+  poolType: Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType!
+  region: String!
 }
 
 input Github__com___kloudlite___operator___apis___clusters___v1__NodePoolSpecIn {
   aws: Github__com___kloudlite___operator___apis___clusters___v1__AWSNodePoolConfigIn
   cloudProvider: Github__com___kloudlite___operator___apis___common____types__CloudProvider!
+  gcp: Github__com___kloudlite___operator___apis___clusters___v1__GCPNodePoolConfigIn
   maxCount: Int!
   minCount: Int!
   nodeLabels: Map
@@ -1272,11 +1316,21 @@ enum Github__com___kloudlite___operator___apis___clusters___v1__AWSPoolType {
   spot
 }
 
+enum Github__com___kloudlite___operator___apis___clusters___v1__AwsAuthMechanism {
+  assume_role
+  secret_keys
+}
+
 enum Github__com___kloudlite___operator___apis___clusters___v1__ClusterSpecAvailabilityMode {
   dev
   HA
 }
 
+enum Github__com___kloudlite___operator___apis___clusters___v1__GCPPoolType {
+  SPOT
+  STANDARD
+}
+
 enum Github__com___kloudlite___operator___apis___common____types__CloudProvider {
   aws
   azure
diff --git a/apps/infra/internal/domain/clusters.go b/apps/infra/internal/domain/clusters.go
index 56f74a028..a34993156 100644
--- a/apps/infra/internal/domain/clusters.go
+++ b/apps/infra/internal/domain/clusters.go
@@ -41,7 +41,7 @@ func (e ErrClusterAlreadyExists) Error() string {
 	return fmt.Sprintf("cluster with name %q already exists for account: %s", e.ClusterName, e.AccountName)
 }
 
-func (d *domain) createTokenSecret(ctx InfraContext, ps *entities.CloudProviderSecret, clusterName string, clusterNamespace string) (*corev1.Secret, error) {
+func (d *domain) createTokenSecret(ctx InfraContext, clusterName string, clusterNamespace string) (*corev1.Secret, error) {
 	secret := &corev1.Secret{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: "v1",
@@ -113,15 +113,6 @@ func (d *domain) CreateCluster(ctx InfraContext, cluster entities.Cluster) (*ent
 	cluster.EnsureGVK()
 	cluster.Namespace = accNs
 
-	cps, err := d.findProviderSecret(ctx, cluster.Spec.CredentialsRef.Name)
-	if err != nil {
-		return nil, errors.NewE(err)
-	}
-
-	if cps.IsMarkedForDeletion() {
-		return nil, errors.Newf("cloud provider secret %q is marked for deletion, aborting cluster creation", cps.Name)
-	}
-
 	existing, err := d.clusterRepo.FindOne(ctx, repos.Filter{
 		fields.MetadataName:      cluster.Name,
 		fields.MetadataNamespace: cluster.Namespace,
@@ -143,11 +134,7 @@ func (d *domain) CreateCluster(ctx InfraContext, cluster entities.Cluster) (*ent
 
 	cluster.Spec.AccountId = out.AccountId
 
-	if cluster.Spec.CredentialsRef.Namespace == "" {
-		cluster.Spec.CredentialsRef.Namespace = cps.Namespace
-	}
-
-	tokenScrt, err := d.createTokenSecret(ctx, cps, cluster.Name, cluster.Namespace)
+	tokenScrt, err := d.createTokenSecret(ctx, cluster.Name, cluster.Namespace)
 	if err != nil {
 		return nil, errors.NewE(err)
 	}
@@ -168,15 +155,6 @@ func (d *domain) CreateCluster(ctx InfraContext, cluster entities.Cluster) (*ent
 			Namespace: tokenScrt.Namespace,
 			Key:       keyClusterToken,
 		},
-		CredentialsRef: cluster.Spec.CredentialsRef,
-		CredentialKeys: &clustersv1.CloudProviderCredentialKeys{
-			KeyAWSAccountId:              entities.AWSAccountId,
-			KeyAWSAssumeRoleExternalID:   entities.AWSAssumeRoleExternalId,
-			KeyAWSAssumeRoleRoleARN:      entities.AWAssumeRoleRoleARN,
-			KeyAWSIAMInstanceProfileRole: entities.AWSInstanceProfileName,
-			KeyAccessKey:                 entities.AccessKey,
-			KeySecretKey:                 entities.SecretKey,
-		},
 		AvailabilityMode: cluster.Spec.AvailabilityMode,
 
 		// PublicDNSHost is <cluster-name>.<account-name>.tenants.<public-dns-host-suffix>
@@ -191,7 +169,21 @@ func (d *domain) CreateCluster(ctx InfraContext, cluster entities.Cluster) (*ent
 			if cluster.Spec.CloudProvider != ct.CloudProviderAWS {
 				return nil
 			}
+
+			cps, err := d.findProviderSecret(ctx, cluster.Spec.AWS.Credentials.SecretRef.Name)
+			if err != nil {
+				return nil
+			}
+
 			return &clustersv1.AWSClusterConfig{
+				Credentials: clustersv1.AwsCredentials{
+					AuthMechanism: cps.AWS.AuthMechanism,
+					SecretRef: ct.SecretRef{
+						Name:      cps.Name,
+						Namespace: cps.Namespace,
+					},
+				},
+
 				Region: cluster.Spec.AWS.Region,
 				K3sMasters: clustersv1.AWSK3sMastersConfig{
 					InstanceType:     cluster.Spec.AWS.K3sMasters.InstanceType,
diff --git a/apps/infra/internal/domain/nodepool.go b/apps/infra/internal/domain/nodepool.go
index e71296976..dd2314a7b 100644
--- a/apps/infra/internal/domain/nodepool.go
+++ b/apps/infra/internal/domain/nodepool.go
@@ -38,15 +38,15 @@ func (d *domain) CreateNodePool(ctx InfraContext, clusterName string, nodepool e
 		return nil, errors.NewE(err)
 	}
 
-	ps, err := d.findProviderSecret(ctx, cluster.Spec.CredentialsRef.Name)
-	if err != nil {
-		return nil, errors.NewE(err)
-	}
-
 	switch nodepool.Spec.CloudProvider {
 	case ct.CloudProviderAWS:
 		{
 
+			ps, err := d.findProviderSecret(ctx, cluster.Spec.AWS.Credentials.SecretRef.Name)
+			if err != nil {
+				return nil, errors.NewE(err)
+			}
+
 			awsSubnetID := cluster.Spec.AWS.VPC.GetSubnetId(nodepool.Spec.AWS.AvailabilityZone)
 			if awsSubnetID == "" {
 				return nil, errors.Newf("kloudlite VPC has no subnet configured for this availability zone (%s), please select another availability zone in your cluster's region (%s)", nodepool.Spec.AWS.AvailabilityZone, cluster.Spec.AWS.Region)
diff --git a/apps/infra/internal/domain/provider-secret-aws.go b/apps/infra/internal/domain/provider-secret-aws.go
new file mode 100644
index 000000000..6f0711e26
--- /dev/null
+++ b/apps/infra/internal/domain/provider-secret-aws.go
@@ -0,0 +1,172 @@
+package domain
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/cloudformation"
+	"github.com/aws/aws-sdk-go/service/sts"
+	iamT "github.com/kloudlite/api/apps/iam/types"
+	"github.com/kloudlite/api/apps/infra/internal/entities"
+	"github.com/kloudlite/api/apps/infra/internal/env"
+	"github.com/kloudlite/api/pkg/errors"
+	clustersv1 "github.com/kloudlite/operator/apis/clusters/v1"
+)
+
+func createAwsSession(awscreds *entities.AWSSecretCredentials) (*session.Session, error) {
+	sess, err := session.NewSession()
+	sess.Config.Region = aws.String("ap-south-1")
+	if err != nil {
+		return nil, errors.NewE(err)
+	}
+
+	svc := sts.New(sess)
+
+	switch awscreds.AuthMechanism {
+	case clustersv1.AwsAuthMechanismSecretKeys:
+		{
+			if awscreds.AuthSecretKeys == nil {
+				return nil, fmt.Errorf("auth secret keys not set, can't proceed with cloudformation checks")
+			}
+			return session.NewSession(&aws.Config{
+				Region:      aws.String("ap-south-1"),
+				Credentials: credentials.NewStaticCredentials(awscreds.AuthSecretKeys.AccessKey, awscreds.AuthSecretKeys.SecretKey, ""),
+			})
+		}
+	case clustersv1.AwsAuthMechanismAssumeRole:
+		{
+			resp, err := svc.AssumeRole(&sts.AssumeRoleInput{
+				RoleArn:         aws.String(awscreds.AssumeRoleParams.RoleARN),
+				ExternalId:      aws.String(awscreds.AssumeRoleParams.ExternalID),
+				RoleSessionName: aws.String("TestSession"),
+			})
+			if err != nil {
+				return nil, errors.NewEf(err, "while asumming role identity")
+			}
+
+			if resp.AssumedRoleUser == nil || resp.AssumedRoleUser.Arn == nil {
+				return nil, fmt.Errorf("AWS assume role (%s) not found", awscreds.AssumeRoleParams.RoleARN)
+			}
+
+			return session.NewSession(&aws.Config{
+				Region:      aws.String("ap-south-1"),
+				Credentials: credentials.NewStaticCredentials(*resp.Credentials.AccessKeyId, *resp.Credentials.SecretAccessKey, *resp.Credentials.SessionToken),
+			})
+		}
+	default:
+		{
+			return nil, fmt.Errorf("unknown aws auth mechanism: %s", awscreds.AuthMechanism)
+		}
+	}
+}
+
+func checkAwsCloudformationCompletion(awscreds *entities.AWSSecretCredentials) error {
+	sess, err := createAwsSession(awscreds)
+	if err != nil {
+		return errors.NewE(err)
+	}
+
+	cf := cloudformation.New(sess)
+	dso, err := cf.DescribeStacks(&cloudformation.DescribeStacksInput{
+		StackName: &awscreds.CfParamStackName,
+	})
+	if err != nil {
+		return errors.NewE(err)
+	}
+
+	stackFound := false
+
+	for i := range dso.Stacks {
+		if dso.Stacks[i] != nil && *dso.Stacks[i].StackName == awscreds.CfParamStackName {
+			stackFound = true
+			if *dso.Stacks[i].StackStatus != cloudformation.StackStatusCreateComplete {
+				return errors.Newf("cloudformation stack (%s) is not completed, yet", awscreds.CfParamStackName)
+			}
+		}
+	}
+
+	if !stackFound {
+		return errors.Newf("waiting for cloudformation stack to be created")
+	}
+
+	return nil
+}
+
+func generateAWSCloudformationTemplateUrl(creds entities.AWSSecretCredentials, ev *env.Env) (string, error) {
+	var qp []string
+
+	switch creds.AuthMechanism {
+	case clustersv1.AwsAuthMechanismSecretKeys:
+		{
+			qp = []string{
+				"templateURL=" + ev.AWSCfStackS3URL,
+				"stackName=" + creds.CfParamStackName,
+				"param_RoleName=" + creds.CfParamRoleName,
+				"param_InstanceProfileName=" + creds.CfParamInstanceProfileName,
+				"param_UserName=" + creds.AuthSecretKeys.CfParamUserName,
+			}
+		}
+	case clustersv1.AwsAuthMechanismAssumeRole:
+		{
+			if creds.AssumeRoleParams == nil {
+				return "", errors.Newf("assume role params not defined")
+			}
+			qp = []string{
+				"templateURL=" + ev.AWSCfStackS3URL,
+				"stackName=" + creds.CfParamStackName,
+				"param_ExternalId=" + creds.AssumeRoleParams.ExternalID,
+				"param_TrustedArn=" + creds.AssumeRoleParams.CfParamTrustedARN,
+				"param_RoleName=" + creds.CfParamRoleName,
+				"param_InstanceProfileName=" + creds.CfParamInstanceProfileName,
+			}
+		}
+	}
+
+	result := bytes.NewBuffer(nil)
+	_, err := fmt.Fprintf(result, "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?")
+	if err != nil {
+		return "", errors.NewE(err)
+	}
+	_, err = fmt.Fprint(result, strings.Join(qp, "&"))
+	if err != nil {
+		return "", errors.NewE(err)
+	}
+	return result.String(), nil
+}
+
+type AWSAccessValidationOutput struct {
+	Result          bool
+	InstallationURL *string
+}
+
+func (d *domain) ValidateProviderSecretAWSAccess(ctx InfraContext, name string) (*AWSAccessValidationOutput, error) {
+	if err := d.canPerformActionInAccount(ctx, iamT.CreateCloudProviderSecret); err != nil {
+		return nil, errors.NewE(err)
+	}
+
+	psecret, err := d.findProviderSecret(ctx, name)
+	if err != nil {
+		return nil, errors.NewE(err)
+	}
+
+	if err := psecret.Validate(); err != nil {
+		return nil, errors.NewE(err)
+	}
+
+	if err := checkAwsCloudformationCompletion(psecret.AWS); err != nil {
+		installationURL, err := generateAWSCloudformationTemplateUrl(*psecret.AWS, d.env)
+		if err != nil {
+			return nil, errors.NewE(err)
+		}
+		return &AWSAccessValidationOutput{
+			Result:          false,
+			InstallationURL: &installationURL,
+		}, nil
+	}
+
+	return &AWSAccessValidationOutput{Result: true}, nil
+}
diff --git a/apps/infra/internal/domain/provider-secrets.go b/apps/infra/internal/domain/provider-secrets.go
index d7b732e9f..ca110d841 100644
--- a/apps/infra/internal/domain/provider-secrets.go
+++ b/apps/infra/internal/domain/provider-secrets.go
@@ -1,12 +1,12 @@
 package domain
 
 import (
-	"bytes"
-	"context"
 	"fmt"
 	"strings"
 	"time"
 
+	fn "github.com/kloudlite/api/pkg/functions"
+
 	fc "github.com/kloudlite/api/apps/infra/internal/entities/field-constants"
 	"github.com/kloudlite/api/common/fields"
 	"github.com/kloudlite/api/pkg/errors"
@@ -15,174 +15,59 @@ import (
 
 	iamT "github.com/kloudlite/api/apps/iam/types"
 	"github.com/kloudlite/api/common"
-	fn "github.com/kloudlite/api/pkg/functions"
 	ct "github.com/kloudlite/operator/apis/common-types"
 
 	"github.com/kloudlite/api/apps/infra/internal/entities"
-	"github.com/kloudlite/api/apps/infra/internal/env"
 	"github.com/kloudlite/api/pkg/repos"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/cloudformation"
-	"github.com/aws/aws-sdk-go/service/sts"
+	clustersv1 "github.com/kloudlite/operator/apis/clusters/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-func generateAWSCloudformationTemplateUrl(args entities.AWSSecretCredentials, ev *env.Env) (string, error) {
-	qp := []string{
-		"templateURL=" + ev.AWSCfStackS3URL,
-		"stackName=" + args.CfParamStackName,
-		"param_ExternalId=" + args.CfParamExternalID,
-		"param_TrustedArn=" + args.CfParamTrustedARN,
-		"param_RoleName=" + args.CfParamRoleName,
-		"param_InstanceProfileName=" + args.CfParamInstanceProfileName,
-	}
-
-	result := bytes.NewBuffer(nil)
-	_, err := fmt.Fprintf(result, "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?")
-	if err != nil {
-		return "", errors.NewE(err)
-	}
-	_, err = fmt.Fprint(result, strings.Join(qp, "&"))
-	if err != nil {
-		return "", errors.NewE(err)
-	}
-	return result.String(), nil
-}
-
-func (d *domain) validateAWSAssumeRole(_ context.Context, paramExternalId string, roleARN string, instanceProfileName string, cfStackName string) error {
-	sess, err := session.NewSession()
-	sess.Config.Region = aws.String("ap-south-1")
-	if err != nil {
-		d.logger.Errorf(err, "while creating new session")
-		return errors.NewE(err)
-	}
-
-	// 1. validating IAM Assume Role
-	svc := sts.New(sess)
-
-	resp, err := svc.AssumeRole(&sts.AssumeRoleInput{
-		RoleArn:         aws.String(roleARN),
-		ExternalId:      aws.String(paramExternalId),
-		RoleSessionName: aws.String("TestSession"),
-	})
-	if err != nil {
-		d.logger.Errorf(err, "while assuming role, and getting caller identity")
-		return errors.NewE(err)
-	}
-
-	if resp.AssumedRoleUser == nil || resp.AssumedRoleUser.Arn == nil {
-		return errors.Newf("AWS assume role (%s) not found", roleARN)
-	}
-
-	nsess, err := session.NewSession(&aws.Config{
-		Region:      aws.String("ap-south-1"),
-		Credentials: credentials.NewStaticCredentials(*resp.Credentials.AccessKeyId, *resp.Credentials.SecretAccessKey, *resp.Credentials.SessionToken),
-	})
-	if err != nil {
-		return errors.NewE(err)
-	}
-
-	cf := cloudformation.New(nsess)
-	dso, err := cf.DescribeStacks(&cloudformation.DescribeStacksInput{
-		StackName: &cfStackName,
-	})
-	if err != nil {
-		return errors.NewE(err)
-	}
-
-	stackFound := false
+func corev1SecretFromProviderSecret(ps *entities.CloudProviderSecret) (*corev1.Secret, error) {
+	stringData := map[string]string{}
 
-	for i := range dso.Stacks {
-		if dso.Stacks[i] != nil && *dso.Stacks[i].StackName == cfStackName {
-			stackFound = true
-			if *dso.Stacks[i].StackStatus != cloudformation.StackStatusCreateComplete {
-				return errors.Newf("cloudformation stack (%s) is not completed, yet", cfStackName)
+	switch ps.CloudProviderName {
+	case ct.CloudProviderAWS:
+		{
+			switch ps.AWS.AuthMechanism {
+			case clustersv1.AwsAuthMechanismSecretKeys:
+				{
+					if err := fn.JsonConversion(ps.AWS.AuthSecretKeys, &stringData); err != nil {
+						return nil, err
+					}
+				}
+			case clustersv1.AwsAuthMechanismAssumeRole:
+				{
+					if err := fn.JsonConversion(ps.AWS.AssumeRoleParams.AwsAssumeRoleParams, &stringData); err != nil {
+						return nil, err
+					}
+				}
+			default:
+				{
+					return nil, fmt.Errorf("unknown aws auth mechanism (%s)", ps.AWS.AuthMechanism)
+				}
 			}
 		}
-	}
-
-	if !stackFound {
-		return errors.Newf("waiting for cloudformation stack to be created")
-	}
-
-	return nil
-}
-
-type AWSAccessValidationOutput struct {
-	Result          bool
-	InstallationURL *string
-}
-
-func (d *domain) ValidateProviderSecretAWSAccess(ctx InfraContext, name string) (*AWSAccessValidationOutput, error) {
-	if err := d.canPerformActionInAccount(ctx, iamT.CreateCloudProviderSecret); err != nil {
-		return nil, errors.NewE(err)
-	}
-
-	psecret, err := d.findProviderSecret(ctx, name)
-	if err != nil {
-		return nil, errors.NewE(err)
-	}
-
-	if err := psecret.Validate(); err != nil {
-		return nil, errors.NewE(err)
-	}
-
-	if err := d.validateAWSAssumeRole(ctx, psecret.AWS.CfParamExternalID, psecret.AWS.GetAssumeRoleRoleARN(), psecret.AWS.CfParamInstanceProfileName, psecret.AWS.CfParamStackName); err != nil {
-		installationURL, err := generateAWSCloudformationTemplateUrl(*psecret.AWS, d.env)
-		if err != nil {
-			return nil, errors.NewE(err)
+	default:
+		{
+			return nil, fmt.Errorf("unknown cloudprovider (%s)", ps.CloudProviderName)
 		}
-		return &AWSAccessValidationOutput{
-			Result:          false,
-			InstallationURL: &installationURL,
-		}, nil
-	}
-
-	return &AWSAccessValidationOutput{
-		Result:          true,
-		InstallationURL: nil,
-	}, errors.NewE(err)
-}
-
-func corev1SecretFromProviderSecret(ps *entities.CloudProviderSecret) *corev1.Secret {
-	stringData := map[string]string{}
-	if ps.AWS.AccessKey != nil {
-		stringData[entities.AccessKey] = *ps.AWS.AccessKey
-	}
-	if ps.AWS.SecretKey != nil {
-		stringData[entities.SecretKey] = *ps.AWS.SecretKey
 	}
 
-	if ps.AWS.IsAssumeRoleConfiguration() && ps.AWS.AWSAccountId != nil {
-		stringData[entities.AWSAccountId] = *ps.AWS.AWSAccountId
-	}
-	if ps.AWS.IsAssumeRoleConfiguration() && ps.AWS.CfParamExternalID != "" {
-		stringData[entities.AWSAssumeRoleExternalId] = ps.AWS.CfParamExternalID
-	}
-	if ps.AWS.IsAssumeRoleConfiguration() && ps.AWS.CfParamRoleName != "" {
-		stringData[entities.AWAssumeRoleRoleARN] = ps.AWS.GetAssumeRoleRoleARN()
-	}
-	if ps.AWS.IsAssumeRoleConfiguration() && ps.AWS.CfParamInstanceProfileName != "" {
-		stringData[entities.AWSInstanceProfileName] = ps.AWS.CfParamInstanceProfileName
-	}
+	stringData["cloudprovider"] = string(ps.CloudProviderName)
 
 	return &corev1.Secret{
 		TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Secret"},
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      ps.Name,
-			Namespace: ps.Namespace,
-			CreationTimestamp: metav1.Time{
-				Time: time.Now(),
-			},
+			Name:              ps.Name,
+			Namespace:         ps.Namespace,
+			CreationTimestamp: metav1.Time{Time: time.Now()},
 			Annotations: map[string]string{
 				constants.DescriptionKey: fmt.Sprintf("created by cloudprovider secret %s", ps.Name),
 			},
 		},
 		StringData: stringData,
-	}
+	}, nil
 }
 
 func (d *domain) CreateProviderSecret(ctx InfraContext, psecretIn entities.CloudProviderSecret) (*entities.CloudProviderSecret, error) {
@@ -198,6 +83,50 @@ func (d *domain) CreateProviderSecret(ctx InfraContext, psecretIn entities.Cloud
 	psecretIn.AccountName = ctx.AccountName
 	psecretIn.Namespace = accNs
 
+	psecretIn.Id = d.secretRepo.NewId()
+
+	switch psecretIn.CloudProviderName {
+	case ct.CloudProviderAWS:
+		{
+			if psecretIn.AWS == nil {
+				return nil, fmt.Errorf("aws vars must be set")
+			}
+
+			switch psecretIn.AWS.AuthMechanism {
+			case clustersv1.AwsAuthMechanismSecretKeys:
+				{
+					psecretIn.AWS.CfParamStackName = fmt.Sprintf("%s-%s", d.env.AWSCfStackNamePrefix, psecretIn.Id)
+					psecretIn.AWS.CfParamRoleName = fmt.Sprintf("%s-%s", d.env.AWSCfRoleNamePrefix, psecretIn.Id)
+					psecretIn.AWS.CfParamInstanceProfileName = fmt.Sprintf("%s-%s", d.env.AWSCfInstanceProfileNamePrefix, psecretIn.Id)
+
+					if psecretIn.AWS.AuthSecretKeys == nil {
+						psecretIn.AWS.AuthSecretKeys = &entities.AWSAuthSecretKeys{}
+					}
+					psecretIn.AWS.AuthSecretKeys.CfParamUserName = fmt.Sprintf("kloudlite-user-%s", psecretIn.Id)
+				}
+			case clustersv1.AwsAuthMechanismAssumeRole:
+				{
+					if psecretIn.AWS.AssumeRoleParams == nil {
+						return nil, fmt.Errorf("aws assume role params, must be set")
+					}
+					psecretIn.AWS.CfParamStackName = fmt.Sprintf("%s-%s", d.env.AWSCfStackNamePrefix, psecretIn.Id)
+					psecretIn.AWS.CfParamRoleName = fmt.Sprintf("%s-%s", d.env.AWSCfRoleNamePrefix, psecretIn.Id)
+					psecretIn.AWS.CfParamInstanceProfileName = fmt.Sprintf("%s-%s", d.env.AWSCfInstanceProfileNamePrefix, psecretIn.Id)
+					psecretIn.AWS.AssumeRoleParams.CfParamTrustedARN = d.env.AWSCfParamTrustedARN
+
+					psecretIn.AWS.AssumeRoleParams.ExternalID = fn.CleanerNanoidOrDie(40)
+					psecretIn.AWS.AssumeRoleParams.RoleARN = psecretIn.AWS.GetAssumeRoleRoleARN()
+				}
+			default:
+				{
+					return nil, fmt.Errorf("unknown aws auth mechanism (%s)", psecretIn.AWS.AuthMechanism)
+				}
+			}
+		}
+	default:
+		return nil, errors.Newf("unknown cloud provider")
+	}
+
 	if err := psecretIn.Validate(); err != nil {
 		return nil, errors.NewE(err)
 	}
@@ -210,31 +139,8 @@ func (d *domain) CreateProviderSecret(ctx InfraContext, psecretIn entities.Cloud
 	}
 
 	psecretIn.LastUpdatedBy = psecretIn.CreatedBy
-	psecretIn.Id = d.secretRepo.NewId()
-	switch psecretIn.CloudProviderName {
-	case ct.CloudProviderAWS:
-		{
-			psecretIn.AWS = &entities.AWSSecretCredentials{
-				AWSAccountId: psecretIn.AWS.AWSAccountId,
-				AccessKey:    psecretIn.AWS.AccessKey,
-				SecretKey:    psecretIn.AWS.SecretKey,
-
-				CfParamStackName:           fmt.Sprintf("%s-%s", d.env.AWSCfStackNamePrefix, psecretIn.Id),
-				CfParamRoleName:            fmt.Sprintf("%s-%s", d.env.AWSCfRoleNamePrefix, psecretIn.Id),
-				CfParamInstanceProfileName: fmt.Sprintf("%s-%s", d.env.AWSCfInstanceProfileNamePrefix, psecretIn.Id),
-				CfParamTrustedARN:          d.env.AWSCfParamTrustedARN,
-				CfParamExternalID:          fn.CleanerNanoidOrDie(40),
-			}
-
-			if err := psecretIn.AWS.Validate(); err != nil {
-				return nil, errors.NewE(err)
-			}
-		}
-	default:
-		return nil, errors.Newf("unknown cloud provider")
-	}
 
-	secret := corev1SecretFromProviderSecret(&psecretIn)
+	secret, _ := corev1SecretFromProviderSecret(&psecretIn)
 	psecretIn.ObjectMeta = secret.ObjectMeta
 
 	nSecret, err := d.secretRepo.Create(ctx, &psecretIn)
@@ -251,7 +157,6 @@ func (d *domain) CreateProviderSecret(ctx InfraContext, psecretIn entities.Cloud
 	return nSecret, nil
 }
 
-// Depricate AWS_SECRET_KEY and AWS_ACCESS_KEY input
 func (d *domain) UpdateProviderSecret(ctx InfraContext, providerSecretIn entities.CloudProviderSecret) (*entities.CloudProviderSecret, error) {
 	if err := d.canPerformActionInAccount(ctx, iamT.UpdateCloudProviderSecret); err != nil {
 		return nil, errors.NewE(err)
@@ -261,32 +166,34 @@ func (d *domain) UpdateProviderSecret(ctx InfraContext, providerSecretIn entitie
 		return nil, errors.NewE(err)
 	}
 
-	//switch providerSecretIn.CloudProviderName {
-	//case ct.CloudProviderAWS:
-	//	{
-	//		currScrt.AWS.AccessKey = providerSecretIn.AWS.AccessKey
-	//		currScrt.AWS.SecretKey = providerSecretIn.AWS.SecretKey
-	//	}
-	//}
-
-	patchForUpdate := common.PatchForUpdate(
-		ctx,
-		&providerSecretIn,
-	)
-
-	uScrt, err := d.secretRepo.Patch(
-		ctx,
-		repos.Filter{
-			fields.AccountName:  ctx.AccountName,
-			fields.MetadataName: providerSecretIn.Name,
-		},
-		patchForUpdate,
-	)
+	fieldsPatch := map[string]any{}
+	switch providerSecretIn.CloudProviderName {
+	case ct.CloudProviderAWS:
+		{
+			if providerSecretIn.AWS.AuthMechanism == clustersv1.AwsAuthMechanismSecretKeys {
+				if providerSecretIn.AWS.AuthSecretKeys != nil {
+					fieldsPatch[fc.CloudProviderSecretAwsAuthSecretKeysAccessKey] = strings.TrimSpace(providerSecretIn.AWS.AuthSecretKeys.AccessKey)
+					fieldsPatch[fc.CloudProviderSecretAwsAuthSecretKeysSecretKey] = strings.TrimSpace(providerSecretIn.AWS.AuthSecretKeys.SecretKey)
+				}
+			}
+		}
+	}
+
+	patchForUpdate := common.PatchForUpdate(ctx, &providerSecretIn, common.PatchOpts{
+		XPatch: fieldsPatch,
+	})
+
+	uScrt, err := d.secretRepo.Patch(ctx, repos.Filter{fields.AccountName: ctx.AccountName, fields.MetadataName: providerSecretIn.Name}, patchForUpdate)
 	if err != nil {
 		return nil, errors.NewE(err)
 	}
 
-	if err := d.applyK8sResource(ctx, corev1SecretFromProviderSecret(uScrt), uScrt.RecordVersion); err != nil {
+	realSecret, err := corev1SecretFromProviderSecret(uScrt)
+	if err != nil {
+		return nil, errors.NewE(err)
+	}
+
+	if err := d.applyK8sResource(ctx, realSecret, uScrt.RecordVersion); err != nil {
 		return nil, errors.NewE(err)
 	}
 
@@ -304,8 +211,9 @@ func (d *domain) DeleteProviderSecret(ctx InfraContext, secretName string) error
 
 	clusters, err := d.clusterRepo.Find(ctx, repos.Query{
 		Filter: repos.Filter{
-			fields.AccountName:               ctx.AccountName,
-			fc.ClusterSpecCredentialsRefName: secretName,
+			fields.AccountName: ctx.AccountName,
+			// fc.ClusterSpecCredentialsRefName: secretName,
+			fc.ClusterSpecAwsCredentialsSecretRefName: secretName,
 		},
 	})
 	if err != nil {
@@ -316,7 +224,11 @@ func (d *domain) DeleteProviderSecret(ctx InfraContext, secretName string) error
 		return errors.Newf("cloud provider secret %q is used by %d cluster(s), deletion is forbidden", secretName, len(clusters))
 	}
 
-	if err := d.deleteK8sResource(ctx, corev1SecretFromProviderSecret(cps)); err != nil {
+	realSecret, err := corev1SecretFromProviderSecret(cps)
+	if err != nil {
+		return errors.NewE(err)
+	}
+	if err := d.deleteK8sResource(ctx, realSecret); err != nil {
 		return errors.NewE(err)
 	}
 	return d.secretRepo.DeleteById(ctx, cps.Id)
diff --git a/apps/infra/internal/entities/field-constants/generated_constants.go b/apps/infra/internal/entities/field-constants/generated_constants.go
index d967e4cf1..c063f14c2 100644
--- a/apps/infra/internal/entities/field-constants/generated_constants.go
+++ b/apps/infra/internal/entities/field-constants/generated_constants.go
@@ -2,83 +2,103 @@
 
 package field_constants
 
+// constant vars generated for struct AWSAssumeRoleParams
+const (
+	AWSAssumeRoleParamsAwsAccountId      = "awsAccountId"
+	AWSAssumeRoleParamsCfParamTrustedARN = "cfParamTrustedARN"
+	AWSAssumeRoleParamsExternalID        = "externalID"
+	AWSAssumeRoleParamsRoleARN           = "roleARN"
+)
+
+// constant vars generated for struct AWSAuthSecretKeys
+const (
+	AWSAuthSecretKeysAccessKey       = "accessKey"
+	AWSAuthSecretKeysCfParamUserName = "cfParamUserName"
+	AWSAuthSecretKeysSecretKey       = "secretKey"
+)
+
 // constant vars generated for struct AWSSecretCredentials
 const (
-	AWSSecretCredentialsAccessKey                  = "accessKey"
-	AWSSecretCredentialsAwsAccountId               = "awsAccountId"
-	AWSSecretCredentialsCfParamExternalID          = "cfParamExternalID"
-	AWSSecretCredentialsCfParamInstanceProfileName = "cfParamInstanceProfileName"
-	AWSSecretCredentialsCfParamRoleName            = "cfParamRoleName"
-	AWSSecretCredentialsCfParamStackName           = "cfParamStackName"
-	AWSSecretCredentialsCfParamTrustedARN          = "cfParamTrustedARN"
-	AWSSecretCredentialsSecretKey                  = "secretKey"
+	AWSSecretCredentialsAssumeRoleParams                  = "assumeRoleParams"
+	AWSSecretCredentialsAssumeRoleParamsAwsAccountId      = "assumeRoleParams.awsAccountId"
+	AWSSecretCredentialsAssumeRoleParamsCfParamTrustedARN = "assumeRoleParams.cfParamTrustedARN"
+	AWSSecretCredentialsAssumeRoleParamsExternalID        = "assumeRoleParams.externalID"
+	AWSSecretCredentialsAssumeRoleParamsRoleARN           = "assumeRoleParams.roleARN"
+	AWSSecretCredentialsAuthMechanism                     = "authMechanism"
+	AWSSecretCredentialsAuthSecretKeys                    = "authSecretKeys"
+	AWSSecretCredentialsAuthSecretKeysAccessKey           = "authSecretKeys.accessKey"
+	AWSSecretCredentialsAuthSecretKeysCfParamUserName     = "authSecretKeys.cfParamUserName"
+	AWSSecretCredentialsAuthSecretKeysSecretKey           = "authSecretKeys.secretKey"
+	AWSSecretCredentialsCfParamInstanceProfileName        = "cfParamInstanceProfileName"
+	AWSSecretCredentialsCfParamRoleName                   = "cfParamRoleName"
+	AWSSecretCredentialsCfParamStackName                  = "cfParamStackName"
 )
 
 // constant vars generated for struct CloudProviderSecret
 const (
-	CloudProviderSecretAws                           = "aws"
-	CloudProviderSecretAwsAccessKey                  = "aws.accessKey"
-	CloudProviderSecretAwsAwsAccountId               = "aws.awsAccountId"
-	CloudProviderSecretAwsCfParamExternalID          = "aws.cfParamExternalID"
-	CloudProviderSecretAwsCfParamInstanceProfileName = "aws.cfParamInstanceProfileName"
-	CloudProviderSecretAwsCfParamRoleName            = "aws.cfParamRoleName"
-	CloudProviderSecretAwsCfParamStackName           = "aws.cfParamStackName"
-	CloudProviderSecretAwsCfParamTrustedARN          = "aws.cfParamTrustedARN"
-	CloudProviderSecretAwsSecretKey                  = "aws.secretKey"
-	CloudProviderSecretCloudProviderName             = "cloudProviderName"
+	CloudProviderSecretAws                                  = "aws"
+	CloudProviderSecretAwsAssumeRoleParams                  = "aws.assumeRoleParams"
+	CloudProviderSecretAwsAssumeRoleParamsAwsAccountId      = "aws.assumeRoleParams.awsAccountId"
+	CloudProviderSecretAwsAssumeRoleParamsCfParamTrustedARN = "aws.assumeRoleParams.cfParamTrustedARN"
+	CloudProviderSecretAwsAssumeRoleParamsExternalID        = "aws.assumeRoleParams.externalID"
+	CloudProviderSecretAwsAssumeRoleParamsRoleARN           = "aws.assumeRoleParams.roleARN"
+	CloudProviderSecretAwsAuthMechanism                     = "aws.authMechanism"
+	CloudProviderSecretAwsAuthSecretKeys                    = "aws.authSecretKeys"
+	CloudProviderSecretAwsAuthSecretKeysAccessKey           = "aws.authSecretKeys.accessKey"
+	CloudProviderSecretAwsAuthSecretKeysCfParamUserName     = "aws.authSecretKeys.cfParamUserName"
+	CloudProviderSecretAwsAuthSecretKeysSecretKey           = "aws.authSecretKeys.secretKey"
+	CloudProviderSecretAwsCfParamInstanceProfileName        = "aws.cfParamInstanceProfileName"
+	CloudProviderSecretAwsCfParamRoleName                   = "aws.cfParamRoleName"
+	CloudProviderSecretAwsCfParamStackName                  = "aws.cfParamStackName"
+	CloudProviderSecretCloudProviderName                    = "cloudProviderName"
 )
 
 // constant vars generated for struct Cluster
 const (
-	ClusterSpec                                         = "spec"
-	ClusterSpecAccountId                                = "spec.accountId"
-	ClusterSpecAccountName                              = "spec.accountName"
-	ClusterSpecAvailabilityMode                         = "spec.availabilityMode"
-	ClusterSpecAws                                      = "spec.aws"
-	ClusterSpecAwsK3sMasters                            = "spec.aws.k3sMasters"
-	ClusterSpecAwsK3sMastersIamInstanceProfileRole      = "spec.aws.k3sMasters.iamInstanceProfileRole"
-	ClusterSpecAwsK3sMastersInstanceType                = "spec.aws.k3sMasters.instanceType"
-	ClusterSpecAwsK3sMastersNodes                       = "spec.aws.k3sMasters.nodes"
-	ClusterSpecAwsK3sMastersNvidiaGpuEnabled            = "spec.aws.k3sMasters.nvidiaGpuEnabled"
-	ClusterSpecAwsK3sMastersRootVolumeSize              = "spec.aws.k3sMasters.rootVolumeSize"
-	ClusterSpecAwsK3sMastersRootVolumeType              = "spec.aws.k3sMasters.rootVolumeType"
-	ClusterSpecAwsNodePools                             = "spec.aws.nodePools"
-	ClusterSpecAwsRegion                                = "spec.aws.region"
-	ClusterSpecAwsSpotNodePools                         = "spec.aws.spotNodePools"
-	ClusterSpecAwsVpc                                   = "spec.aws.vpc"
-	ClusterSpecAwsVpcId                                 = "spec.aws.vpc.id"
-	ClusterSpecAwsVpcPublicSubnets                      = "spec.aws.vpc.publicSubnets"
-	ClusterSpecBackupToS3Enabled                        = "spec.backupToS3Enabled"
-	ClusterSpecCloudProvider                            = "spec.cloudProvider"
-	ClusterSpecCloudflareEnabled                        = "spec.cloudflareEnabled"
-	ClusterSpecClusterInternalDnsHost                   = "spec.clusterInternalDnsHost"
-	ClusterSpecClusterTokenRef                          = "spec.clusterTokenRef"
-	ClusterSpecClusterTokenRefKey                       = "spec.clusterTokenRef.key"
-	ClusterSpecClusterTokenRefName                      = "spec.clusterTokenRef.name"
-	ClusterSpecClusterTokenRefNamespace                 = "spec.clusterTokenRef.namespace"
-	ClusterSpecCredentialKeys                           = "spec.credentialKeys"
-	ClusterSpecCredentialKeysKeyAWSAccountId            = "spec.credentialKeys.keyAWSAccountId"
-	ClusterSpecCredentialKeysKeyAWSAssumeRoleExternalID = "spec.credentialKeys.keyAWSAssumeRoleExternalID"
-	ClusterSpecCredentialKeysKeyAWSAssumeRoleRoleARN    = "spec.credentialKeys.keyAWSAssumeRoleRoleARN"
-	ClusterSpecCredentialKeysKeyAccessKey               = "spec.credentialKeys.keyAccessKey"
-	ClusterSpecCredentialKeysKeyIAMInstanceProfileRole  = "spec.credentialKeys.keyIAMInstanceProfileRole"
-	ClusterSpecCredentialKeysKeySecretKey               = "spec.credentialKeys.keySecretKey"
-	ClusterSpecCredentialsRef                           = "spec.credentialsRef"
-	ClusterSpecCredentialsRefName                       = "spec.credentialsRef.name"
-	ClusterSpecCredentialsRefNamespace                  = "spec.credentialsRef.namespace"
-	ClusterSpecKloudliteRelease                         = "spec.kloudliteRelease"
-	ClusterSpecMessageQueueTopicName                    = "spec.messageQueueTopicName"
-	ClusterSpecOutput                                   = "spec.output"
-	ClusterSpecOutputJobName                            = "spec.output.jobName"
-	ClusterSpecOutputJobNamespace                       = "spec.output.jobNamespace"
-	ClusterSpecOutputKeyAWSVPCId                        = "spec.output.keyAWSVPCId"
-	ClusterSpecOutputKeyAWSVPCPublicSubnets             = "spec.output.keyAWSVPCPublicSubnets"
-	ClusterSpecOutputKeyK3sAgentJoinToken               = "spec.output.keyK3sAgentJoinToken"
-	ClusterSpecOutputKeyK3sServerJoinToken              = "spec.output.keyK3sServerJoinToken"
-	ClusterSpecOutputKeyKubeconfig                      = "spec.output.keyKubeconfig"
-	ClusterSpecOutputSecretName                         = "spec.output.secretName"
-	ClusterSpecPublicDNSHost                            = "spec.publicDNSHost"
-	ClusterSpecTaintMasterNodes                         = "spec.taintMasterNodes"
+	ClusterSpec                                    = "spec"
+	ClusterSpecAccountId                           = "spec.accountId"
+	ClusterSpecAccountName                         = "spec.accountName"
+	ClusterSpecAvailabilityMode                    = "spec.availabilityMode"
+	ClusterSpecAws                                 = "spec.aws"
+	ClusterSpecAwsCredentials                      = "spec.aws.credentials"
+	ClusterSpecAwsCredentialsAuthMechanism         = "spec.aws.credentials.authMechanism"
+	ClusterSpecAwsCredentialsSecretRef             = "spec.aws.credentials.secretRef"
+	ClusterSpecAwsCredentialsSecretRefName         = "spec.aws.credentials.secretRef.name"
+	ClusterSpecAwsCredentialsSecretRefNamespace    = "spec.aws.credentials.secretRef.namespace"
+	ClusterSpecAwsK3sMasters                       = "spec.aws.k3sMasters"
+	ClusterSpecAwsK3sMastersIamInstanceProfileRole = "spec.aws.k3sMasters.iamInstanceProfileRole"
+	ClusterSpecAwsK3sMastersInstanceType           = "spec.aws.k3sMasters.instanceType"
+	ClusterSpecAwsK3sMastersNodes                  = "spec.aws.k3sMasters.nodes"
+	ClusterSpecAwsK3sMastersNvidiaGpuEnabled       = "spec.aws.k3sMasters.nvidiaGpuEnabled"
+	ClusterSpecAwsK3sMastersRootVolumeSize         = "spec.aws.k3sMasters.rootVolumeSize"
+	ClusterSpecAwsK3sMastersRootVolumeType         = "spec.aws.k3sMasters.rootVolumeType"
+	ClusterSpecAwsNodePools                        = "spec.aws.nodePools"
+	ClusterSpecAwsRegion                           = "spec.aws.region"
+	ClusterSpecAwsSpotNodePools                    = "spec.aws.spotNodePools"
+	ClusterSpecAwsVpc                              = "spec.aws.vpc"
+	ClusterSpecAwsVpcId                            = "spec.aws.vpc.id"
+	ClusterSpecAwsVpcPublicSubnets                 = "spec.aws.vpc.publicSubnets"
+	ClusterSpecBackupToS3Enabled                   = "spec.backupToS3Enabled"
+	ClusterSpecCloudProvider                       = "spec.cloudProvider"
+	ClusterSpecCloudflareEnabled                   = "spec.cloudflareEnabled"
+	ClusterSpecClusterInternalDnsHost              = "spec.clusterInternalDnsHost"
+	ClusterSpecClusterTokenRef                     = "spec.clusterTokenRef"
+	ClusterSpecClusterTokenRefKey                  = "spec.clusterTokenRef.key"
+	ClusterSpecClusterTokenRefName                 = "spec.clusterTokenRef.name"
+	ClusterSpecClusterTokenRefNamespace            = "spec.clusterTokenRef.namespace"
+	ClusterSpecKloudliteRelease                    = "spec.kloudliteRelease"
+	ClusterSpecMessageQueueTopicName               = "spec.messageQueueTopicName"
+	ClusterSpecOutput                              = "spec.output"
+	ClusterSpecOutputJobName                       = "spec.output.jobName"
+	ClusterSpecOutputJobNamespace                  = "spec.output.jobNamespace"
+	ClusterSpecOutputKeyAWSVPCId                   = "spec.output.keyAWSVPCId"
+	ClusterSpecOutputKeyAWSVPCPublicSubnets        = "spec.output.keyAWSVPCPublicSubnets"
+	ClusterSpecOutputKeyK3sAgentJoinToken          = "spec.output.keyK3sAgentJoinToken"
+	ClusterSpecOutputKeyK3sServerJoinToken         = "spec.output.keyK3sServerJoinToken"
+	ClusterSpecOutputKeyKubeconfig                 = "spec.output.keyKubeconfig"
+	ClusterSpecOutputSecretName                    = "spec.output.secretName"
+	ClusterSpecPublicDNSHost                       = "spec.publicDNSHost"
+	ClusterSpecTaintMasterNodes                    = "spec.taintMasterNodes"
 )
 
 // constant vars generated for struct ClusterManagedService
@@ -230,6 +250,17 @@ const (
 	NodePoolSpecAwsVpcId                            = "spec.aws.vpcId"
 	NodePoolSpecAwsVpcSubnetId                      = "spec.aws.vpcSubnetId"
 	NodePoolSpecCloudProvider                       = "spec.cloudProvider"
+	NodePoolSpecGcp                                 = "spec.gcp"
+	NodePoolSpecGcpAvailabilityZone                 = "spec.gcp.availabilityZone"
+	NodePoolSpecGcpBootVolumeSize                   = "spec.gcp.bootVolumeSize"
+	NodePoolSpecGcpBootVolumeType                   = "spec.gcp.bootVolumeType"
+	NodePoolSpecGcpCredentials                      = "spec.gcp.credentials"
+	NodePoolSpecGcpCredentialsName                  = "spec.gcp.credentials.name"
+	NodePoolSpecGcpCredentialsNamespace             = "spec.gcp.credentials.namespace"
+	NodePoolSpecGcpMachineType                      = "spec.gcp.machineType"
+	NodePoolSpecGcpNodes                            = "spec.gcp.nodes"
+	NodePoolSpecGcpPoolType                         = "spec.gcp.poolType"
+	NodePoolSpecGcpRegion                           = "spec.gcp.region"
 	NodePoolSpecMaxCount                            = "spec.maxCount"
 	NodePoolSpecMinCount                            = "spec.minCount"
 	NodePoolSpecNodeLabels                          = "spec.nodeLabels"
diff --git a/apps/infra/internal/entities/provider-secret.go b/apps/infra/internal/entities/provider-secret.go
index eefcece0a..e772d9545 100644
--- a/apps/infra/internal/entities/provider-secret.go
+++ b/apps/infra/internal/entities/provider-secret.go
@@ -2,11 +2,13 @@ package entities
 
 import (
 	"fmt"
+
 	"github.com/kloudlite/api/pkg/errors"
 	"github.com/kloudlite/operator/pkg/operator"
 
 	"github.com/kloudlite/api/common"
 	"github.com/kloudlite/api/pkg/repos"
+	clustersv1 "github.com/kloudlite/operator/apis/clusters/v1"
 	ct "github.com/kloudlite/operator/apis/common-types"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -21,24 +23,37 @@ const (
 	AWSInstanceProfileName  string = "awsInstanceProfileName"
 )
 
+type AWSAssumeRoleParams struct {
+	AWSAccountID                   string `json:"awsAccountId"`
+	CfParamTrustedARN              string `json:"cfParamTrustedARN" graphql:"noinput"`
+	clustersv1.AwsAssumeRoleParams `json:",inline" graphql:"noinput"`
+}
+
+type AWSAuthSecretKeys struct {
+	CfParamUserName              string `json:"cfParamUserName" graphql:"noinput"`
+	clustersv1.AwsAuthSecretKeys `json:",inline"`
+}
+
 type AWSSecretCredentials struct {
-	AccessKey *string `json:"accessKey,omitempty"`
-	SecretKey *string `json:"secretKey,omitempty"`
-
-	AWSAccountId               *string `json:"awsAccountId,omitempty"`
-	CfParamStackName           string  `json:"cfParamStackName,omitempty" graphql:"noinput"`
-	CfParamRoleName            string  `json:"cfParamRoleName,omitempty" graphql:"noinput"`
-	CfParamInstanceProfileName string  `json:"cfParamInstanceProfileName,omitempty" graphql:"noinput"`
-	CfParamTrustedARN          string  `json:"cfParamTrustedARN,omitempty" graphql:"noinput"`
-	CfParamExternalID          string  `json:"cfParamExternalID,omitempty" graphql:"noinput"`
+	CfParamStackName           string `json:"cfParamStackName,omitempty" graphql:"noinput"`
+	CfParamRoleName            string `json:"cfParamRoleName,omitempty" graphql:"noinput"`
+	CfParamInstanceProfileName string `json:"cfParamInstanceProfileName,omitempty" graphql:"noinput"`
+
+	AuthMechanism clustersv1.AwsAuthMechanism `json:"authMechanism"`
+
+	AuthSecretKeys   *AWSAuthSecretKeys   `json:"authSecretKeys,omitempty"`
+	AssumeRoleParams *AWSAssumeRoleParams `json:"assumeRoleParams,omitempty"`
 }
 
 func (asc *AWSSecretCredentials) GetAssumeRoleRoleARN() string {
-	return fmt.Sprintf("arn:aws:iam::%s:role/%s", *asc.AWSAccountId, asc.CfParamRoleName)
+	if asc.AssumeRoleParams != nil {
+		return fmt.Sprintf("arn:aws:iam::%s:role/%s", asc.AssumeRoleParams.AWSAccountID, asc.CfParamRoleName)
+	}
+	return ""
 }
 
 func (asc *AWSSecretCredentials) IsAssumeRoleConfiguration() bool {
-	return asc.AccessKey == nil || asc.SecretKey == nil
+	return asc.AuthMechanism == clustersv1.AwsAuthMechanismAssumeRole
 }
 
 func (asc *AWSSecretCredentials) Validate() error {
@@ -46,28 +61,47 @@ func (asc *AWSSecretCredentials) Validate() error {
 		return errors.Newf("aws secret credentials, is nil")
 	}
 
-	if asc.AccessKey != nil || asc.SecretKey != nil {
-		return nil
-	}
+	switch asc.AuthMechanism {
+	case clustersv1.AwsAuthMechanismSecretKeys:
+		{
+			if asc.AuthSecretKeys == nil {
+				return fmt.Errorf("with aws auth mechanism (%s), secretKeys must be set", asc.AuthMechanism)
+			}
+			if asc.AuthSecretKeys.AccessKey == "" || asc.AuthSecretKeys.SecretKey == "" {
+				return fmt.Errorf("with aws auth mechanism (%s), secretKeys accessKey, and secretKey must be set", asc.AuthMechanism)
+			}
+		}
 
-	if asc.AWSAccountId == nil {
-		return errors.Newf("awsAccountId, must be provided")
-	}
+	case clustersv1.AwsAuthMechanismAssumeRole:
+		{
+			if asc.AssumeRoleParams == nil {
+				return errors.Newf(".spec.assumeRoleParams, must be set, when accessKey and secretKey are not set")
+			}
 
-	if asc.CfParamStackName == "" {
-		return errors.Newf("cfParamStackName, must be provided")
-	}
-	if asc.CfParamExternalID == "" {
-		return errors.Newf("cfParamExternalID, must be provided")
-	}
-	if asc.CfParamRoleName == "" {
-		return errors.Newf("cfParamRoleName, must be provided")
-	}
-	if asc.CfParamTrustedARN == "" {
-		return errors.Newf("cfParamTrustedARN, must be provided")
-	}
-	if asc.CfParamInstanceProfileName == "" {
-		return errors.Newf("cfParamInstanceProfileName, must be provided")
+			if asc.AssumeRoleParams.AWSAccountID == "" {
+				return errors.Newf("awsAccountId, must be provided")
+			}
+
+			if asc.CfParamStackName == "" {
+				return errors.Newf("cfParamStackName, must be provided")
+			}
+			if asc.AssumeRoleParams.ExternalID == "" {
+				return errors.Newf("ExternalID, must be provided")
+			}
+			if asc.CfParamRoleName == "" {
+				return errors.Newf("cfParamRoleName, must be provided")
+			}
+			if asc.AssumeRoleParams.CfParamTrustedARN == "" {
+				return errors.Newf("CfParamTrustedARN, must be provided")
+			}
+			if asc.CfParamInstanceProfileName == "" {
+				return errors.Newf("cfParamInstanceProfileName, must be provided")
+			}
+		}
+	default:
+		{
+			return fmt.Errorf("unknown aws auth mechanism (%s)", asc.AuthMechanism)
+		}
 	}
 
 	return nil
@@ -75,14 +109,14 @@ func (asc *AWSSecretCredentials) Validate() error {
 
 type CloudProviderSecret struct {
 	repos.BaseEntity `json:",inline" graphql:"noinput"`
-	// corev1.Secret     `json:",inline" graphql:"uri=k8s://secrets.crds.kloudlite.io"`
+	AccountName      string `json:"accountName" graphql:"noinput"`
+
 	metav1.ObjectMeta `json:"metadata"`
+
 	CloudProviderName ct.CloudProvider `json:"cloudProviderName"`
 
 	common.ResourceMetadata `json:",inline"`
 	AWS                     *AWSSecretCredentials `json:"aws,omitempty"`
-
-	AccountName string `json:"accountName" graphql:"noinput"`
 }
 
 func (cps *CloudProviderSecret) GetDisplayName() string {
@@ -127,19 +161,15 @@ func (cps *CloudProviderSecret) Validate() error {
 	case ct.CloudProviderAWS:
 		{
 			if cps.AWS == nil {
-				return errors.Newf(".aws is nil, must be provided when cloudproviderName is set to aws")
-			}
-			if cps.AWS.AWSAccountId == nil && (cps.AWS.AccessKey == nil || cps.AWS.SecretKey == nil) {
-				return errors.Newf("neither .aws.%s nor (.aws.%s and .aws.%s) is provided", AWSAccountId, AccessKey, SecretKey)
+				return errors.Newf(".aws is nil, it must be provided when cloudproviderName is set to aws")
 			}
+
+			return nil
+			// return cps.AWS.Validate()
 		}
 	default:
 		{
-			// if cps.StringData[AccessKey] == "" || cps.StringData[SecretKey] == "" {
-			// 	return false, errors.Newf(".stringData.accessKey or .stringData.accessSecret is empty")
-			// }
+			return fmt.Errorf("not implemented for cloudprovider (%s)", cps.CloudProviderName)
 		}
 	}
-
-	return nil
 }
diff --git a/go.mod b/go.mod
index c3b3febed..5c434cc80 100644
--- a/go.mod
+++ b/go.mod
@@ -42,7 +42,7 @@ require (
 
 require (
 	github.com/kloudlite/container-registry-authorizer v0.0.0-20231021122509-161dc30fde55
-	github.com/kloudlite/operator v1.0.4-0.20240308095549-4095d51d810a
+	github.com/kloudlite/operator v1.0.4-0.20240310104102-47509b4ea038
 	github.com/nats-io/nats.go v1.31.0
 	github.com/onsi/ginkgo/v2 v2.12.0
 	github.com/onsi/gomega v1.27.10
diff --git a/go.sum b/go.sum
index 053795b04..9bbd6735f 100644
--- a/go.sum
+++ b/go.sum
@@ -164,6 +164,8 @@ github.com/kloudlite/container-registry-authorizer v0.0.0-20231021122509-161dc30
 github.com/kloudlite/container-registry-authorizer v0.0.0-20231021122509-161dc30fde55/go.mod h1:GZj3wZmIw/qCciclRhgQTgmGiqe8wxoVzMXQjbOfnbc=
 github.com/kloudlite/operator v1.0.4-0.20240308095549-4095d51d810a h1:dxMWxaDJhEkZcnIzXH/eLQU2+OHHw/bmGeDiuFKukDU=
 github.com/kloudlite/operator v1.0.4-0.20240308095549-4095d51d810a/go.mod h1:kMXogvCB4qSG56WlJ5lhyL6JVeVLJ+IyyE18g/1FF1I=
+github.com/kloudlite/operator v1.0.4-0.20240310104102-47509b4ea038 h1:6ljM+6FSptDMonrW2jTXzksV5QNzCGcJFcCe0amYAH4=
+github.com/kloudlite/operator v1.0.4-0.20240310104102-47509b4ea038/go.mod h1:kMXogvCB4qSG56WlJ5lhyL6JVeVLJ+IyyE18g/1FF1I=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=