cluster-options takes a single opt arg: we must wrap credentials in a map