Package google.cloud.gkehub.configmanagement.v1

Index

• ConfigSync (message)
• ConfigSyncDeploymentState (message)
• ConfigSyncError (message)
• ConfigSyncState (message)
• ConfigSyncVersion (message)
• DeploymentState (enum)
• ErrorResource (message)
• GatekeeperDeploymentState (message)
• GitConfig (message)
• GroupVersionKind (message)
• HierarchyControllerConfig (message)
• HierarchyControllerDeploymentState (message)
• HierarchyControllerState (message)
• HierarchyControllerVersion (message)
• InstallError (message)
• MembershipSpec (message)
• MembershipState (message)
• OciConfig (message)
• OperatorState (message)
• PolicyController (message)
• PolicyControllerMigration (message)
• PolicyControllerMigration.Stage (enum)
• PolicyControllerMonitoring (message)
• PolicyControllerMonitoring.MonitoringBackend (enum)
• PolicyControllerState (message)
• PolicyControllerVersion (message)
• SyncError (message)
• SyncState (message)
• SyncState.SyncCode (enum)

ConfigSync

Configuration for Config Sync

Fields
git	GitConfig Git repo configuration for the cluster.
source_format	string Specifies whether the Config Sync Repo is in "hierarchical" or "unstructured" mode.
prevent_drift	bool Set to true to enable the Config Sync admission webhook to prevent drifts. If set to false, disables the Config Sync admission webhook and does not prevent drifts.
oci	OciConfig OCI repo configuration for the cluster
allow_vertical_scale (deprecated)	bool This item is deprecated! Set to true to allow the vertical scaling. Defaults to false which disallows vertical scaling. This field is deprecated.
metrics_gcp_service_account_email	string The Email of the Google Cloud Service Account (GSA) used for exporting Config Sync metrics to Cloud Monitoring and Cloud Monarch when Workload Identity is enabled. The GSA should have the Monitoring Metric Writer (roles/monitoring.metricWriter) IAM role. The Kubernetes ServiceAccount default in the namespace config-management-monitoring should be bound to the GSA.
enabled	bool Enables the installation of ConfigSync. If set to true, ConfigSync resources will be created and the other ConfigSync fields will be applied if exist. If set to false, all other ConfigSync fields will be ignored, ConfigSync resources will be deleted. If omitted, ConfigSync resources will be managed depends on the presence of the git or oci field.

ConfigSyncDeploymentState

The state of ConfigSync's deployment on a cluster

Fields
importer	DeploymentState Deployment state of the importer pod
syncer	DeploymentState Deployment state of the syncer pod
git_sync	DeploymentState Deployment state of the git-sync pod
monitor	DeploymentState Deployment state of the monitor pod
reconciler_manager	DeploymentState Deployment state of reconciler-manager pod
root_reconciler	DeploymentState Deployment state of root-reconciler
admission_webhook	DeploymentState Deployment state of admission-webhook

ConfigSyncError

Errors pertaining to the installation of Config Sync

Fields
error_message	string A string representing the user facing error message

ConfigSyncState

State information for ConfigSync

Fields
version	ConfigSyncVersion The version of ConfigSync deployed
deployment_state	ConfigSyncDeploymentState Information about the deployment of ConfigSync, including the version of the various Pods deployed
sync_state	SyncState The state of ConfigSync's process to sync configs to a cluster
errors[]	ConfigSyncError Errors pertaining to the installation of Config Sync.

ConfigSyncVersion

Specific versioning information pertaining to ConfigSync's Pods

Fields
importer	string Version of the deployed importer pod
syncer	string Version of the deployed syncer pod
git_sync	string Version of the deployed git-sync pod
monitor	string Version of the deployed monitor pod
reconciler_manager	string Version of the deployed reconciler-manager pod
root_reconciler	string Version of the deployed reconciler container in root-reconciler pod
admission_webhook	string Version of the deployed admission_webhook pod

DeploymentState

Enum representing the state of an ACM's deployment on a cluster

Enums
DEPLOYMENT_STATE_UNSPECIFIED	Deployment's state cannot be determined
NOT_INSTALLED	Deployment is not installed
INSTALLED	Deployment is installed
ERROR	Deployment was attempted to be installed, but has errors
PENDING	Deployment is installing or terminating

ErrorResource

Model for a config file in the git repo with an associated Sync error

Fields
source_path	string Path in the git repo of the erroneous config
resource_name	string Metadata name of the resource that is causing an error
resource_namespace	string Namespace of the resource that is causing an error
resource_gvk	GroupVersionKind Group/version/kind of the resource that is causing an error

GatekeeperDeploymentState

State of Policy Controller installation.

Fields
gatekeeper_controller_manager_state	DeploymentState Status of gatekeeper-controller-manager pod.
gatekeeper_audit	DeploymentState Status of gatekeeper-audit deployment.
gatekeeper_mutation	DeploymentState Status of the pod serving the mutation webhook.

GitConfig

Git repo configuration for a single cluster.

Fields
sync_repo	string The URL of the Git repository to use as the source of truth.
sync_branch	string The branch of the repository to sync from. Default: master.
policy_dir	string The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository.
sync_wait_secs	int64 Period in seconds between consecutive syncs. Default: 15.
sync_rev	string Git revision (tag or hash) to check out. Default HEAD.
secret_type	string Type of secret configured for access to the Git repo. Must be one of ssh, cookiefile, gcenode, token, gcpserviceaccount or none. The validation of this is case-sensitive. Required.
https_proxy	string URL for the HTTPS proxy to be used when communicating with the Git repo.
gcp_service_account_email	string The Google Cloud Service Account Email used for auth when secret_type is gcpServiceAccount.

GroupVersionKind

A Kubernetes object's GVK

Fields
group	string Kubernetes Group
version	string Kubernetes Version
kind	string Kubernetes Kind

HierarchyControllerConfig

Configuration for Hierarchy Controller

Fields
enabled	bool Whether Hierarchy Controller is enabled in this cluster.
enable_pod_tree_labels	bool Whether pod tree labels are enabled in this cluster.
enable_hierarchical_resource_quota	bool Whether hierarchical resource quota is enabled in this cluster.

HierarchyControllerDeploymentState

Deployment state for Hierarchy Controller

Fields
hnc	DeploymentState The deployment state for open source HNC (e.g. v0.7.0-hc.0)
extension	DeploymentState The deployment state for Hierarchy Controller extension (e.g. v0.7.0-hc.1)

HierarchyControllerState

State for Hierarchy Controller

Fields
version	HierarchyControllerVersion The version for Hierarchy Controller
state	HierarchyControllerDeploymentState The deployment state for Hierarchy Controller

HierarchyControllerVersion

Version for Hierarchy Controller

Fields
hnc	string Version for open source HNC
extension	string Version for Hierarchy Controller extension

InstallError

Errors pertaining to the installation of ACM

Fields
error_message	string A string representing the user facing error message

MembershipSpec

Anthos Config Management: Configuration for a single cluster. Intended to parallel the ConfigManagement CR.

Fields
config_sync	ConfigSync Config Sync configuration for the cluster.
policy_controller	PolicyController Policy Controller configuration for the cluster.
hierarchy_controller	HierarchyControllerConfig Hierarchy Controller configuration for the cluster.
version	string Version of ACM installed.
cluster	string The user-specified cluster name used by Config Sync cluster-name-selector annotation or ClusterSelector, for applying configs to only a subset of clusters. Omit this field if the cluster's fleet membership name is used by Config Sync cluster-name-selector annotation or ClusterSelector. Set this field if a name different from the cluster's fleet membership name is used by Config Sync cluster-name-selector annotation or ClusterSelector.

MembershipState

Anthos Config Management: State for a single cluster.

Fields
cluster_name	string This field is set to the cluster_name field of the Membership Spec if it is not empty. Otherwise, it is set to the cluster's fleet membership name.
membership_spec	MembershipSpec Membership configuration in the cluster. This represents the actual state in the cluster, while the MembershipSpec in the FeatureSpec represents the intended state
operator_state	OperatorState Current install status of ACM's Operator
config_sync_state	ConfigSyncState Current sync status
policy_controller_state	PolicyControllerState PolicyController status
hierarchy_controller_state	HierarchyControllerState Hierarchy Controller status

OciConfig

OCI repo configuration for a single cluster

Fields
sync_repo	string The OCI image repository URL for the package to sync from. e.g. LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME.
policy_dir	string The absolute path of the directory that contains the local resources. Default: the root directory of the image.
sync_wait_secs	int64 Period in seconds between consecutive syncs. Default: 15.
secret_type	string Type of secret configured for access to the Git repo.
gcp_service_account_email	string The Google Cloud Service Account Email used for auth when secret_type is gcpServiceAccount.

OperatorState

State information for an ACM's Operator

Fields
version	string The semenatic version number of the operator
deployment_state	DeploymentState The state of the Operator's deployment
errors[]	InstallError Install errors.

PolicyController

Configuration for Policy Controller

Fields
enabled	bool Enables the installation of Policy Controller. If false, the rest of PolicyController fields take no effect.
exemptable_namespaces[]	string The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster.
referential_rules_enabled	bool Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated.
log_denies_enabled	bool Logs all denies and dry run failures.
mutation_enabled	bool Enable or disable mutation in policy controller. If true, mutation CRDs, webhook and controller deployment will be deployed to the cluster.
monitoring	PolicyControllerMonitoring Monitoring specifies the configuration of monitoring.
update_time	Timestamp Output only. Last time this membership spec was updated.
template_library_installed	bool Installs the default template library along with Policy Controller.
audit_interval_seconds	int64 Sets the interval for Policy Controller Audit Scans (in seconds). When set to 0, this disables audit functionality altogether.

PolicyControllerMigration

State for the migration of PolicyController from ACM -> PoCo Hub.

Fields
stage	PolicyControllerMigration.Stage Stage of the migration.
copy_time	Timestamp Last time this membership spec was copied to PoCo feature.

Stage

Stage marks what stage of the migration ACM hub is in.

Enums
STAGE_UNSPECIFIED	Unknown state of migration.
ACM_MANAGED	ACM Hub/Operator manages policycontroller. No migration yet completed.
POCO_MANAGED	All migrations steps complete; Poco Hub now manages policycontroller.

PolicyControllerMonitoring

PolicyControllerMonitoring specifies the backends Policy Controller should export metrics to. For example, to specify metrics should be exported to Cloud Monitoring and Prometheus, specify backends: ["cloudmonitoring", "prometheus"]

Fields
backends[]	PolicyControllerMonitoring.MonitoringBackend Specifies the list of backends Policy Controller will export to. An empty list would effectively disable metrics export.

MonitoringBackend

Supported backend options for monitoring

Enums
MONITORING_BACKEND_UNSPECIFIED	Backend cannot be determined
PROMETHEUS	Prometheus backend for monitoring
CLOUD_MONITORING	Stackdriver/Cloud Monitoring backend for monitoring

PolicyControllerState

State for PolicyControllerState.

Fields
version	PolicyControllerVersion The version of Gatekeeper Policy Controller deployed.
deployment_state	GatekeeperDeploymentState The state about the policy controller installation.
migration	PolicyControllerMigration Record state of ACM -> PoCo Hub migration for this feature.

PolicyControllerVersion

The build version of Gatekeeper Policy Controller is using.

Fields
version	string The gatekeeper image tag that is composed of ACM version, git tag, build number.

SyncError

An ACM created error representing a problem syncing configurations

Fields
code	string An ACM defined error code
error_message	string A description of the error
error_resources[]	ErrorResource A list of config(s) associated with the error, if any

SyncState

State indicating an ACM's progress syncing configurations to a cluster

Fields
source_token	string Token indicating the state of the repo.
import_token	string Token indicating the state of the importer.
sync_token	string Token indicating the state of the syncer.
last_sync (deprecated)	string This item is deprecated! Deprecated: use last_sync_time instead. Timestamp of when ACM last successfully synced the repo The time format is specified in https://golang.org/pkg/time/#Time.String
last_sync_time	Timestamp Timestamp type of when ACM last successfully synced the repo
code	SyncState.SyncCode Sync status code
errors[]	SyncError A list of errors resulting from problematic configs. This list will be truncated after 100 errors, although it is unlikely for that many errors to simultaneously exist.

SyncCode

An enum representing Config Sync's status of syncing configs to a cluster.

Enums
SYNC_CODE_UNSPECIFIED	Config Sync cannot determine a sync code
SYNCED	Config Sync successfully synced the git Repo with the cluster
PENDING	Config Sync is in the progress of syncing a new change
ERROR	Indicates an error configuring Config Sync, and user action is required
NOT_CONFIGURED	Config Sync has been installed but not configured
NOT_INSTALLED	Config Sync has not been installed
UNAUTHORIZED	Error authorizing with the cluster
UNREACHABLE	Cluster could not be reached