Class WorkloadMetadataConfig (2.38.0) 

WorkloadMetadataConfig(mapping=None, *, ignore_unknown_fields=False, **kwargs)

WorkloadMetadataConfig defines the metadata configuration to expose to workloads on the node pool.

Attributes

NameDescription
node_metadata google.cloud.container_v1beta1.types.WorkloadMetadataConfig.NodeMetadata
NodeMetadata is the configuration for how to expose metadata to the workloads running on the node.
mode google.cloud.container_v1beta1.types.WorkloadMetadataConfig.Mode
Mode is the configuration for how to expose metadata to workloads running on the node pool.

Classes

Mode

Mode(value)

Mode is the configuration for how to expose metadata to workloads running on the node.

Values: MODE_UNSPECIFIED (0): Not set. GCE_METADATA (1): Expose all Compute Engine metadata to pods. GKE_METADATA (2): Run the GKE Metadata Server on this node. The GKE Metadata Server exposes a metadata API to workloads that is compatible with the V1 Compute Metadata APIs exposed by the Compute Engine and App Engine Metadata Servers. This feature can only be enabled if Workload Identity is enabled at the cluster level.

NodeMetadata

NodeMetadata(value)

NodeMetadata is the configuration for if and how to expose the node metadata to the workload running on the node.

Values: UNSPECIFIED (0): Not set. SECURE (1): Prevent workloads not in hostNetwork from accessing certain VM metadata, specifically kube-env, which contains Kubelet credentials, and the instance identity token.

    Metadata concealment is a temporary security
    solution available while the bootstrapping
    process for cluster nodes is being redesigned
    with significant security improvements.  This
    feature is scheduled to be deprecated in the
    future and later removed.
EXPOSE (2):
    Expose all VM metadata to pods.
GKE_METADATA_SERVER (3):
    Run the GKE Metadata Server on this node. The
    GKE Metadata Server exposes a metadata API to
    workloads that is compatible with the V1 Compute
    Metadata APIs exposed by the Compute Engine and
    App Engine Metadata Servers. This feature can
    only be enabled if Workload Identity is enabled
    at the cluster level.