Package google.cloud.gkehub.v1beta1

string

Immutable. Self-link of the GCP resource for the Appliance Cluster. For example:

//transferappliance.googleapis.com/projects/my-project/locations/us-west1-a/appliances/my-appliance

string

Optional. A JSON Web Token (JWT) issuer URI. issuer must start with https:// and be a valid URL with length <2000 characters.

If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer.

Clearing issuer disables Workload Identity. issuer cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).

string

Output only. The name of the workload identity pool in which issuer will be recognized.

There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is {PROJECT_ID}.hub.id.goog, although this is subject to change in newer versions of this API.

string

Output only. An identity provider that reflects the issuer in the workload identity pool.

bytes

Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517).

When this field is set, OIDC discovery will NOT be performed on issuer, and instead OIDC tokens will be validated using this field.

string

Optional. Output only. The name of the scope-tenancy workload identity pool. This pool is set in the fleet-level feature.

string

Optional. Output only. The identity provider for the scope-tenancy workload identity pool.

string

Do not set.

bytes

Optional. URI of a proxy if connectivity from the agent to gkeconnect.googleapis.com requires the use of a proxy. Format must be in the form http(s)://{proxy_address}, depending on the HTTP/HTTPS protocol supported by the proxy. This will direct the connect agent's outbound traffic through a HTTP(S) proxy.

string

Optional. Namespace for GKE Connect agent resources. Defaults to gke-connect.

The Connect Agent is authorized automatically when run in the default namespace. Otherwise, explicit authorization must be granted with an additional IAM binding.

TypeMeta

Kubernetes type of the resource.

string

YAML manifest of the resource.

string

Required. The parent (project and location) where the Memberships will be created. Specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

• gkehub.memberships.create

string

Required. Client chosen ID for the membership. membership_id must be a valid RFC 1123 compliant DNS label:

1. At most 63 characters in length
2. It must consist of lower case alphanumeric characters or -
3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.

Membership

Required. The membership to create.

string

Optional. A request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request.

For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments.

The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

• gkehub.memberships.delete

string

Optional. A request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request.

For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments.

The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).

bool

Optional. If set to true, any subresource from this Membership will also be deleted. Otherwise, the request will only work if the Membership has no subresource.

string

Immutable. Self-link of the GCP resource for the Edge Cluster. For example:

//edgecontainer.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster

string

Required. The Membership resource name the Agent will associate with, in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

• gkehub.memberships.generateConnectManifest

ConnectAgent

Optional. The connect agent to generate manifest for.

string

Optional. The Connect agent version to use. Defaults to the most current version.

bool

Optional. If true, generate the resources for upgrade only. Some resources generated only for installation (e.g. secrets) will be excluded.

string

Optional. The registry to fetch the connect agent image from. Defaults to gcr.io/gkeconnect.

bytes

Optional. The image pull secret content for the registry, if not public.

ConnectAgentResource

The ordered list of Kubernetes resources that need to be applied to the cluster for GKE Connect agent installation/upgrade.

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

• gkehub.memberships.generateConnectManifest

string

Optional. The YAML manifest of the membership CRD retrieved by kubectl get customresourcedefinitions membership. Leave empty if the resource does not exist.

string

Optional. The YAML manifest of the membership CR retrieved by kubectl get memberships membership. Leave empty if the resource does not exist.

string

The YAML manifest of the membership CRD to apply if a newer version of the CRD is available. Empty if no update needs to be applied.

string

The YAML manifest of the membership CR to apply if a new version of the CR is available. Empty if no update needs to be applied.

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

• gkehub.memberships.get

string

Immutable. Self-link of the GCP resource for the GKE cluster. For example:

//container.googleapis.com/projects/my-project/locations/us-west1-a/clusters/my-cluster

Zonal clusters are also supported.

bool

Output only. If cluster_missing is set then it denotes that the GKE cluster no longer exists in the GKE Control Plane.

string

Output only. Kubernetes API server version string as reported by '/version'.

string

Output only. Node providerID as reported by the first node in the list of nodes on the Kubernetes endpoint. On Kubernetes platforms that support zero-node clusters (like GKE-on-GCP), the node_count will be zero and the node_provider_id will be empty.

int32

Output only. Node count as reported by Kubernetes nodes resources.

int32

Output only. vCPU count as reported by Kubernetes nodes resources.

int32

Output only. The total memory capacity as reported by the sum of all Kubernetes nodes resources, defined in MB.

Timestamp

Output only. The time at which these details were last updated. This update_time is different from the Membership-level update_time since EndpointDetails are updated internally for API consumers.

string

Input only. The YAML representation of the Membership CR. This field is ignored for GKE clusters where Hub can read the CR directly.

Callers should provide the CR that is currently present in the cluster during CreateMembership or UpdateMembership, or leave this field empty if none exists. The CR manifest is used to validate the cluster has not been registered with another Membership.

ResourceManifest

Output only. Additional Kubernetes resources that need to be applied to the cluster after Membership creation, and after every update.

This field is only populated in the Membership returned from a successful long-running operation from CreateMembership or UpdateMembership. It is not populated during normal GetMembership or ListMemberships requests. To get the resource manifest after the initial registration, the caller should make a UpdateMembership call with an empty field mask.

ResourceManifest

Output only. The Kubernetes resources for installing the GKE Connect agent

This field is only populated in the Membership returned from a successful long-running operation from CreateMembership or UpdateMembership. It is not populated during normal GetMembership or ListMemberships requests. To get the resource manifest after the initial registration, the caller should make a UpdateMembership call with an empty field mask.

ResourceOptions

Optional. Options for Kubernetes resource generation.

string

Required. The parent (project and location) where the Memberships will be listed. Specified in the format projects/*/locations/*. projects/*/locations/- list memberships in all the regions.

Authorization requires the following IAM permission on the specified resource parent:

• gkehub.memberships.list

int32

Optional. When requesting a 'page' of resources, page_size specifies number of resources to return. If unspecified or set to 0, all resources will be returned.

string

Optional. Token returned by previous call to ListMemberships which specifies the position in the list from where to continue listing the resources.

string

Optional. Lists Memberships that match the filter expression, following the syntax outlined in https://google.aip.dev/160.

Examples:

• Name is bar in project foo-proj and location global:

  name = "projects/foo-proj/locations/global/membership/bar"

• Memberships that have a label called foo:

  labels.foo:*

• Memberships that have a label called foo whose value is bar:

  labels.foo = bar

• Memberships in the CREATING state:

  state = CREATING

string

Optional. One or more fields to compare and use to sort the output. See https://google.aip.dev/132#ordering.

Membership

The list of matching Memberships.

string

A token to request the next page of resources from the ListMemberships method. The value of an empty string means that there are no more resources to return.

string

List of locations that could not be reached while fetching this list.

string

Output only. The full, unique name of this Membership resource in the format projects/*/locations/*/memberships/{membership_id}, set during creation.

membership_id must be a valid RFC 1123 compliant DNS label:

1. At most 63 characters in length
2. It must consist of lower case alphanumeric characters or -
3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.

map<string, string>

Optional. GCP labels for this membership.

string

Optional. Description of this membership, limited to 63 characters. Must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.\ ]*

MembershipState

Output only. State of the Membership resource.

Authority

Optional. How to identify workloads from this Membership. See the documentation on Workload Identity for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

Timestamp

Output only. When the Membership was created.

Timestamp

Output only. When the Membership was last updated.

Timestamp

Output only. When the Membership was deleted.

string

Optional. An externally-generated and managed ID for this Membership. This ID may be modified after creation, but this is not recommended. For GKE clusters, external_id is managed by the Hub API and updates will be ignored.

The ID must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.]*

If this Membership represents a Kubernetes cluster, this value should be set to the UID of the kube-system namespace object.

Timestamp

Output only. For clusters using Connect, the timestamp of the most recent connection established with Google Cloud. This time is updated every several minutes, not continuously. For clusters that do not use GKE Connect, or that have never connected successfully, this field will be unset.

string

Output only. Google-generated UUID for this resource. This is unique across all Membership resources. If a Membership resource is deleted and another resource with the same name is created, it gets a different unique_id.

Membership.InfrastructureType

Optional. The infrastructure type this Membership is running on.

MonitoringConfig

Optional. The monitoring config information for this membership.

MembershipEndpoint

Optional. Endpoint information to reach this member.

KubernetesMetadata

Output only. Useful Kubernetes-specific metadata.

KubernetesResource

Optional. The in-cluster Kubernetes Resources that should be applied for a correctly registered cluster, in the steady state. These resources:

• Ensure that the cluster is exclusively registered to one and only one Hub Membership.
• Propagate Workload Pool Information available in the Membership Authority field.
• Ensure proper initial configuration of default Hub Features.

GkeCluster

Optional. Specific information for a GKE-on-GCP cluster.

OnPremCluster

Optional. Specific information for a GKE On-Prem cluster. An onprem user-cluster who has no resourceLink is not allowed to use this field, it should have a nil "type" instead.

MultiCloudCluster

Optional. Specific information for a GKE Multi-Cloud cluster.

EdgeCluster

Optional. Specific information for a Google Edge cluster.

ApplianceCluster

Optional. Specific information for a GDC Edge Appliance cluster.

MembershipState.Code

Output only. The current state of the Membership resource.

string

This field is never set by the Hub Service.

Timestamp

This field is never set by the Hub Service.

string

Optional. Project used to report Metrics

string

Optional. Location used to report Metrics

string

Optional. Cluster name used to report metrics. For Anthos on VMWare/Baremetal/MultiCloud clusters, it would be in format {cluster_type}/{cluster_name}, e.g., "awsClusters/cluster_1".

string

Optional. Kubernetes system metrics, if available, are written to this prefix. This defaults to kubernetes.io for GKE, and kubernetes.io/anthos for Anthos eventually. Noted: Anthos MultiCloud will have kubernetes.io prefix today but will migration to be under kubernetes.io/anthos.

string

Optional. For GKE and Multicloud clusters, this is the UUID of the cluster resource. For VMWare and Baremetal clusters, this is the kube-system UID.

string

Immutable. Self-link of the GCP resource for the GKE Multi-Cloud cluster. For example:

//gkemulticloud.googleapis.com/projects/my-project/locations/us-west1-a/awsClusters/my-cluster //gkemulticloud.googleapis.com/projects/my-project/locations/us-west1-a/azureClusters/my-cluster //gkemulticloud.googleapis.com/projects/my-project/locations/us-west1-a/attachedClusters/my-cluster

bool

Output only. If cluster_missing is set then it denotes that API(gkemulticloud.googleapis.com) resource for this GKE Multi-Cloud cluster no longer exists.

string

Immutable. Self-link of the GCP resource for the GKE On-Prem cluster. For example:

//gkeonprem.googleapis.com/projects/my-project/locations/us-west1-a/vmwareClusters/my-cluster //gkeonprem.googleapis.com/projects/my-project/locations/us-west1-a/bareMetalClusters/my-cluster

bool

Output only. If cluster_missing is set then it denotes that API(gkeonprem.googleapis.com) resource for this GKE On-Prem cluster no longer exists.

bool

Immutable. Whether the cluster is an admin cluster.

OnPremCluster.ClusterType

Immutable. The on prem cluster's type.

Timestamp

Output only. The time the operation was created.

Timestamp

Output only. The time the operation finished running.

string

Output only. Server-defined resource path for the target of the operation.

string

Output only. Name of the verb executed by the operation.

string

Output only. Human-readable status of the operation, if any.

bool

Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have [Operation.error][] value with a google.rpc.Status.code of 1, corresponding to Code.CANCELLED.

string

Output only. API version used to start the operation.

string

YAML manifest of the resource.

bool

Whether the resource provided in the manifest is cluster_scoped. If unset, the manifest is assumed to be namespace scoped.

This field is used for REST mapping when applying the resource in a cluster.

string

Optional. The Connect agent version to use for connect_resources. Defaults to the latest GKE Connect version. The version must be a currently supported version, obsolete versions will be rejected.

bool

Optional. Use apiextensions/v1beta1 instead of apiextensions/v1 for CustomResourceDefinition resources. This option should be set for clusters with Kubernetes apiserver versions <1.16.

string

Optional. Major version of the Kubernetes cluster. This is only used to determine which version to use for the CustomResourceDefinition resources, apiextensions/v1beta1 orapiextensions/v1.

string

Kind of the resource (e.g. Deployment).

string

APIVersion of the resource (e.g. v1).

string

Required. The membership resource name in the format: projects/[project_id]/locations/global/memberships/[membership_id]

Authorization requires the following IAM permission on the specified resource name:

• gkehub.memberships.update

FieldMask

Required. Mask of fields to update. At least one field path must be specified in this mask.

Membership

Required. Only fields specified in update_mask are updated. If you specify a field in the update_mask but don't specify its value here that field will be deleted. If you are updating a map field, set the value of a key to null or empty string to delete the key from the map. It's not possible to update a key's value to the empty string. If you specify the update_mask to be a special path "*", fully replaces all user-modifiable fields to match resource.

string

Optional. A request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request.

For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments.

The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).

string

Required. The parent (project and location) where the Memberships will be created. Specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

• gkehub.memberships.generateConnectManifest

string

Optional. The YAML of the membership CR in the cluster. Empty if the membership CR does not exist.

string

Required. The intended membership name under the parent. This method only does validation in anticipation of a CreateMembership call with the same name.

Status

The validation result.

• OK means that exclusivity is validated, assuming the manifest produced by GenerateExclusivityManifest is successfully applied.
• ALREADY_EXISTS means that the Membership CRD is already owned by another Hub. See status.message for more information.